I work where code meets policy: embedding security in CI so bad commits fail fast — SAST, SCA, secrets, containers, IaC checks — without turning the pipeline into a paperweight.
Policy-as-code, clear exemptions, and metrics leadership actually reads beat heroics after merge. Earlier depth in SOC and IR means I still speak fluent alert fatigue; today I prefer preventing the incident.
TypeScript automation that turns IOCs and CVE context into structured incident reports — same "pipeline output" mindset as security tooling in CI.
View on GitHub →Local rig for prototyping CI guardrails — SAST/SCA gates, secrets policy, container scanners — before they touch a real repo.
Diffs SBOMs between builds and flags suspicious deltas — silent transitive bumps, unexpected licenses, ghost dependencies.