Marcos
Santos
CyberSecurity
Engineer

I perform code reviews in various code languages to identify potential security gaps using SAST and SCA tools. Based on these assessments, I recommend effective solutions to mitigate vulnerabilities before they can become actual threats.

• Conducting secure code analysis for embedded systems
• Auditing microservices for common security pitfalls
• Implementing SAST scans to automate detection of SQL injection or XSS

I help development teams incorporate secure coding practices, ensuring applications are designed and maintained with a focus on reliability and resilience, in accordance with key security standards and frameworks.

• Implementing input validation and sanitization measures
• Training teams on secure coding guidelines like OWASP ASVS
• Conducting security-centric code walkthroughs for quality assurance

I support the implementation of security and compliance requirements based on frameworks such as CIS Benchmark, CIS-CAT, OWASP TOP 10, NIST, FISMA, and PCI. This includes creating detection rules and defining customized policies for both Windows and Linux environments.

• Mapping organization-specific rules to OWASP Top 10 categories
• Defining automated checks for PCI-DSS compliance on e-commerce platforms
• Implementing periodic FISMA audits for government-related applications

I integrate security tools (SAST, DAST, SCA) into CI/CD pipelines, optimizing continuous development and ensuring that any vulnerabilities are proactively identified and addressed throughout the software lifecycle.

• Configuring Jenkins and TeamCity pipelines to run security scans automatically
• Setting up real-time alerts for newly discovered vulnerabilities in dependencies
• Incorporating container security checks in Kubernetes deployments

I work to secure servers and cloud services by establishing robust configurations and access controls. My experience includes Firewalls, WAF, and KMS, as well as best practices for hybrid and cloud-based environments.

• Hardening Linux servers based on CIS benchmarks
• Implementing WAF solutions to mitigate common web exploits
• Managing cloud key rotation and encryption strategies

I conduct research on the latest cybersecurity trends, developing scripts and test checklists to identify new vulnerabilities. I also create custom verification routines tailored to each project’s or client’s specific requirements.

• Designing targeted phishing simulations to measure user awareness
• Developing proof-of-concept exploits for recently disclosed CVEs
• Creating automated penetration testing scripts for internal networks