Application Security Engineer @ SproutXP
Finding the bug in review, not in production.
- 🛡️ Application Security Engineer at SproutXP, embedded with product teams to build security into the SDLC.
- 🔎 I spend my days on secure code review, web & API penetration testing, threat modeling, and vulnerability triage.
- 🤖 Big believer in security automation — SAST, DAST, and dependency scanning wired straight into CI/CD.
- 📚 Always learning: OWASP Top 10 deep dives, exploit primitives in modern frameworks, and supply chain security.
- 💬 Ask me about AppSec, secure code review, DevSecOps, or shifting security left.
Languages
Security
Cloud & Infra
| Area | Focus |
|---|---|
| 🧪 Secure Code Review | Manual review + SAST tuning to cut false positives |
| 🕵️ App Pentesting | Web and API testing against the OWASP Top 10 |
| 🧵 Threat Modeling | Design reviews, abuse cases, STRIDE on new features |
| 📦 Supply Chain | Dependency risk, SBOMs, and third-party library triage |
| ⚙️ DevSecOps | Security gates in CI/CD without slowing shipping |
"Every input is hostile until proven otherwise."