20+ years in IT · 15+ dedicated to cybersecurity · securing the full SDLC, from threat model to production pipeline.

📍 Aracruz, ES, Brazil (UTC−3)  ·  🌎 Remote (Americas / EU)  ·  🇮🇹 Italian citizen — EU work authorization

I design and run Application Security and DevSecOps programs that let teams ship fast without trading away security. My work spans the whole secure SDLC — threat modeling, secure code review, and SAST/DAST/SCA/IaC automation — down to the CI/CD pipelines and cloud infrastructure that carry it to production.

• 🛡️ Built and managed AppSec programs based on OWASP SAMM for clients across multiple industries.
• 🚦 Secured CI/CD pipelines for a major European telecom (MEO / Altice Portugal).
• 🏛️ Operated large-scale ISO 27001 / ITIL environments — 400+ servers, 20,000+ workstations.
• 🤖 Early adopter of AI-augmented engineering (LLM-assisted development, n8n workflow automation) — combining delivery speed with a strong security mindset.
• 🎤 Conference speaker at BSides Vitória and FISL.

Application Security

Security Tooling — SAST / DAST / SCA / IaC

DevOps & Cloud

Automation & AI

Governance & Frameworks

🐉 OWASP Threat Dragon — AI Threat Report  ·  contribution in progress Designing and building an AI-assisted threat report feature for OWASP Threat Dragon: one-click STRIDE analysis of a diagram (image + structured model) via an operator-configured LLM. Built secure by construction — the API key is proxied server-side and never reaches the browser, payloads are bounded against DoS, endpoints are https-only, and no secrets or model contents are ever logged.

🧮 SAMMwise-AI — Gap Analysis AI Report  ·  open-source fork, active Maintaining kbcasurf/sammwise-ai, a modernized fork of OWASP SAMMwise (upgraded to Next.js 16 / React 19, with saved assessment history and trend comparison) that adds an optional AI-powered Gap Analysis Report — a consent-gated, per-report LLM call (OpenAI-compatible or Anthropic) that turns SAMM maturity scores into prioritized remediation guidance. Backed by a full DevSecOps CI/CD pipeline gating every pull request: SAST (CodeQL + Semgrep), DAST (OWASP ZAP Baseline), SCA (npm audit + Trivy image scanning), and secret scanning (TruffleHog), all failing the build on HIGH/CRITICAL findings.

🏆 ChampionForge  ·  open-source, active Building kbcasurf/sec-champs-trail (ChampionForge), a tool to build, run, and mature Security Champions programs on the OWASP Security Champions Guide's 10-principle Manifesto — deliberately measuring how an organization recruits, trains, and retains its champions, not code security posture (that's SAMMwise-AI's job). Ships per-team maturity assessments with historical snapshots, the official OWASP checklist library, and a rule-based 3/6/12-month action roadmap that prioritizes the weakest principles first, with an AI-assisted training-track and executive-report layer on the roadmap.

🔎 Where I focus my open-source work

• Secure SDLC pipelines — reference DevSecOps pipelines (GitHub Actions / GitLab CI) chaining SAST, SCA, secret scanning, IaC scan, DAST and SBOM.
• OWASP SAMM tooling — assessment templates and reporting that turn maturity scores into actionable roadmaps.
• IaC & container security — hardened Terraform baselines with policy-as-code (Checkov / Trivy / OPA) and OpenSCAP/CIS container hardening with SBOM and image signing.
• AI × AppSec — n8n + LLM automation for vulnerability triage and remediation guidance.

• BSides Vitória 2023 — "AppSec: Far Beyond Automated Testing" (OWASP SAMM, security by design, threat modeling, Security Champions).
• BSides Vitória 2022 — "Hardening Servers and Containers with OpenSCAP + Ansible."
• FISL 13 (2012) — "Introduction to Virtualization with Free Software Tools."

“Security by design — far beyond automated testing.”