Vasyl D.

I’m a security engineer with 10+ years of experience across cloud infrastructure, application security, access management and AI/ML systems. I do the technical work myself, from reviewing architecture and configurations to implementing controls and fixing issues with the engineering team. Most recently, I brought Limitless Exchange to SOC 2 Type II audit readiness in three months. The work covered access controls, secrets management, vulnerability management, data classification and disaster-recovery exercises, along with the policies and evidence needed for the assessment. Cloud security and access management My projects include GCP permissions and just-in-time privileged access, Terraform configuration, and automated access provisioning through MidPoint. I’ve reviewed GitHub organisation and repository permissions, team-based access and direct user grants. I’ve also implemented Bitwarden for employee credentials and worked with Google Secret Manager for application secrets. Application security and development pipelines At Airplatforms and Equals Money, I established secure development processes with automated SAST, DAST and IAST integrations in CI/CD. More recently, I worked on GitHub Actions workflows for dependency scanning, supply-chain checks and changes to workflow files, alongside repository hardening and commit-signing requirements. I’ve also integrated open-source scanners with DefectDojo to collect findings in one place and make them easier for developers to review and fix. Architecture reviews and vulnerability assessment My reviews have covered API authorisation, tenant isolation, public access and file-upload permissions. Recent findings included cross-tenant writes through API permissions and unauthenticated uploads that allowed public content hosting. I assess the actual impact, document the evidence and explain the specific configuration or code changes needed. Where something has not been verified, I make that clear. AI/ML security and abuse prevention At DataRobot, I developed dataset-integrity protections and adversarial threat models for machine-learning systems. My work also included policy-as-code for IAM, encryption and network segmentation. At Chegg, I developed fraud-detection telemetry that helped reduce abuse by 90%. Compliance and security programmes I’ve worked on ISO certification projects and compliance work involving SOC 2, HIPAA and FedRAMP. My responsibilities have included implementing controls, writing policies, reviewing access, collecting evidence and preparing teams for assessments. I check that the documentation describes how the system actually works and that the team can produce evidence for the claims it makes. I work directly with developers, platform engineers and management. Projects can range from a specific security review or integration to building a security programme for a company that does not yet have a dedicated security team. I’m used to working with limited budgets and engineering capacity. My recommendations include what needs fixing first, what can wait, and what the team will need to maintain afterwards. I also write the technical instructions and handover documentation, so the work does not depend on me staying involved.