Application Security Engineer focused on secure software design, practical threat modeling, and automated security verification.
I approach security as part of the engineering lifecycle: identifying trust boundaries, reducing attack surface, validating controls, and documenting remediation that development teams can act on.
- Threat models for web applications, APIs, and authentication flows.
- Secure-development checks integrated into continuous delivery.
- Reproducible security tests for common application weaknesses.
- Clear findings with evidence, impact, remediation, and verification steps.
- Authentication, authorization, session, and input boundaries.
- Dependency, secret, static-analysis, and container scanning.
- Responsible testing in explicitly authorized environments.
- Remediation guidance and regression checks that prevent recurrence.
I am building a public application-security case study with an authorized test application, threat model, reproducible findings, fixes, automated regression checks, and responsible-use documentation.