Pavlo M.

Seven years in enterprise security: scaled container security across 50+ microservices with zero critical CVEs to production, led SOC 2 Type II and ISO 27001 audits, designed 20+ security controls, mentored 50+ engineers on secure development. I specialize in shift-left SDLC security, Kubernetes/container hardening, and compliance automation. I don't audit and disappear - I implement security controls, automate compliance checks, and mentor your team to sustain them. SDLC SECURITY TRANSFORMATION Shift-left strategies, secure code review automation, threat modeling workshops, SAST/SCA integration into CI/CD pipelines. Build security into development culture, not as an afterthought. CONTAINER & KUBERNETES SECURITY Image scanning (Trivy, Grype, Snyk, Qualys, Wiz, Sonar), admission control (OPA/Gatekeeper, Kyverno), runtime security (Falco), pod security standards, RBAC hardening, network policies, secrets management (Vault), supply chain security (SBOM, cosign). DEVSECOPS & CI/CD HARDENING SAST integration (SonarQube, Semgrep), dependency scanning (Dependabot, Snyk, FOSSA), IaC security (Terraform scanning, checkov), secret detection (TruffleHop, GitGuardian), shift-left automation, compliance-as-code. AWS CLOUD SECURITY ECS/ECR security, EKS hardening, IAM least-privilege design, VPC security, CloudTrail auditing, AWS Config compliance rules, Security Hub integration. COMPLIANCE & AUDIT FRAMEWORKS SOC 2 Type II, ISO 27001, GDPR, CIS Kubernetes Benchmarks, NIST Cybersecurity Framework. Design controls, collect evidence, automate compliance checks, remediation planning. THREAT MODELING & PRODUCT SECURITY STRIDE methodology, attack trees, threat modeling workshops, secure-by-design architecture, anti-phishing systems, threat detection pipelines. PROFESSIONAL EXPERIENCE (7+ Years): Container Security at Scale: - Designed & scaled image scanning architecture (Trivy, Grype) across 50+ microservices, preventing critical CVEs pre-deployment - Implemented Gatekeeper admission control policies blocking insecure deployments - Deployed Falco for kernel-level runtime threat detection - Configured pod security standards, network policies, service mesh security (Istio), least-privilege RBAC - Built binary authorization & supply chain security (SBOM with Syft, container signing with cosign) SDLC Security Transformation: - Integrated SAST (SonarQube, Semgrep) + SCA (Snyk, Dependabot) scanning into GitHub Actions pipelines - Automated IaC security scanning (Terraform with checkov, tfsec) - Implemented secret detection (TruffleHop, GitGuardian) preventing credential leaks - Designed shift-left security strategy: vulnerabilities caught during code review, not in production Compliance & Audit: - Led SOC 2 Type II and ISO 27001 certification audits—achieved certification within timelines - Designed 20+ security controls, documented evidence, automated compliance checks - Built compliance-as-code using policy engines (AWS Config rules, OPA policies) FOUNDER | SafeBot (2021-present) | Anti-Phishing Messenger Bot Shipped end-to-end secure product: - Product architecture: Designed security-first system from day 1 (threat model, secure auth, encryption, audit logging) - Backend development (Python): Phishing detection engine, API layer, data pipeline Why this matters: I don't just audit or advise—I ship secure products. I understand how to balance security, UX, and product velocity. This comes through in how I architect solutions. TECHNICAL TOOLKIT: Container & Kubernetes: Trivy, Grype, Anchore, Snyk, OPA/Gatekeeper, Kyverno, Falco, Cilium, Istio, Linkerd, Helm SDLC & CI/CD: SonarQube, Semgrep, Checkmarx, Snyk, Dependabot, Black Duck, FOSSA, TruffleHop, GitGuardian, GitHub Actions, GitLab CI, Jenkins, Terraform, checkov, tfsec, CloudFormation Cloud: AWS (ECS, ECR, EKS, IAM, VPC, CloudTrail, Config, Security Hub) Secrets & Identity: HashiCorp Vault, AWS Secrets Manager, Sealed Secrets Monitoring: Prometheus, Grafana, ELK Stack, CloudWatch, Splunk Languages: Python, Bash, Terraform, Helm, YAML Supply Chain: Syft (SBOM), cosign (container signing) HOW I WORK: Phase 1: Assessment (1 weeks) Understand your architecture, threat model, current security posture, compliance requirements, team size & skill levels Phase 2: Roadmap & Design (Week 2-3) Prioritize quick wins vs. architectural changes, define implementation timelines, design tools/automat Phase 3: Implementation (Weeks 4+) Hands-on architecture, tool deployment, automation, security control design, policy-as-code, evidence collection Knowledge Transfer & Mentorship Ensure your team can sustain security practices long-term—not consultant-dependent