PR-01 · CrisWorking/portfolio● open
feat: introduce Cristiano, DevSecOps Engineer #1
looking for new challengesOurém, PT · remote / hybridPT · EN C2
- if it works, don't touch it.
+ If it exists, it can be better.
There's always a way to improve what's already there.
✓ All checks have passed20/20 checks · 0 vulnerabilities · 0 secrets leaked · 6 kept private · sbom attached
HEAD → feature/about-megit log --graph
- +Certified at the highest CEFR level (C2) in English
- +Built the company's reusable GitHub Actions security pipelines (SAST, DAST, secret scanning)+Added pre-commit hooks and a merge quality gate that stop insecure code before it ships+Diagnosed and fixed pipeline failures, including a database deadlock in E2E tests-E2E test time per shard: 37 min+E2E test time per shard: ~10 minGitHub ActionsSemgrepSonarQubeOWASP ZAPGitleaksDocker
- +Co-founded a platform for booking track days; launched it and grew to 400 users+Developed the first version of the platform in TypeScript, including AI tools on the Claude API (trip planner, car setup assistant)+Led QA and gathered user feedback to drive fixes and improvementsTypeScriptNode.jsClaude APIPostgreSQLDockerJestGitHub Actions
- +Final year, graduating December 2026+HealthIT Security Audit: full audit of a simulated healthcare network (risk matrix, GDPR, 9 findings)
- +Designed network infrastructure for a business client+Built a diagnostic USB toolkit for technicians
- +Cybersecurity, networking and operating systems foundations
- +Network mapping, Wi-Fi deployment and IT support+Built internal desktop and mobile apps
Running checks…
0 of 20 · triggered by your visit
01DevSecOps & CI/CDdevsecops.yml · 7 checks
02Developmentdevelopment.yml · 6 checks
03Systems & Securitysystems.yml · 7 checks
5 files changed+28 −2
1+export const pipegen = {
2 // public but still in development · built test-first
3+ what: "CLI that audits a GitHub repo against 30+ DevSecOps checks"
4+ then: "opens one PR with a complete, tested security pipeline"
5+ for: "small teams without a security engineer"
6+ stack: ["TypeScript", "Node.js", "Jest", "GitHub Actions"]
7+ rigor: ["threat model", "independent security reviews"]
8+}
1+export const apexScout = {
2 // track-day booking platform · I developed the first version
3+ version: "v1" // Nov 2025 – Jun 2026
4− users: 0
5+ users: 400
6+ ai: ["trip planner", "car setup assistant"] // Claude API
7+ stack: ["TypeScript", "Node.js", "PostgreSQL", "Docker"]
8+ role: "co-founder & COO · built v1 · led QA"
9+}
+5completed
1+export const healthitAudit = {
2 // security audit of a simulated healthcare network
3+ scope: "full network + compliance review"
4+ findings: 9
5+ delivered: ["risk matrix", "GDPR analysis", "remediation plan"]
6+}
1+export const hardwareStatus = {
2 // real-time system monitor that runs in the browser
3+ shows: ["CPU", "RAM", "disk", "network", "temperatures"]
4+ where: "any phone on the same network"
5+}
+5−1you are here
1+export const thisSite = {
2 // this site, shipped by a real DevSecOps pipeline
3+ pipeline: "pre-commit → PR checks → signed deploy"
4+ checks: ["gitleaks", "semgrep", "trivy", "sbom", "cosign"]
5− motto: "if it works, don't touch it"
6+ motto: "if it exists, it can be better"
7+}
About
I'm Cristiano, a DevSecOps engineer.
What I care about
Currently
Explore