Skip to content

Skills

Security and software, both sides

What I use to assess applications, and what I use to build them.

Application security

  • SAST
  • DAST
  • OWASP Top 10
  • Secure SDLC
  • Secure coding practices
  • Vulnerability management
  • Penetration test report analysis

Security and risk

  • Risk assessments
  • Security control testing
  • Privacy by design
  • Third-party risk
  • GRC methodologies

Cloud security (AWS)

  • AWS IAM
  • EC2
  • S3
  • Cloud security fundamentals

Frameworks and standards

  • ISO 27001
  • ISO 31000
  • EU AI Act
  • Compliance frameworks

Programming

  • Python
  • JavaScript
  • TypeScript
  • Node.js
  • React
  • C/C++

Databases and data

  • SQL
  • MySQL
  • MongoDB
  • Power BI

Networking and protocols

  • TCP/IP
  • HTTP/HTTPS
  • TLS/SSL
  • REST APIs
  • Network scanning fundamentals

Dev tools and automation

  • Git
  • CI/CD
  • Automation scripts

Frameworks and standards

The rulebooks I work with

OWASP Top 10
The reference list I use to classify and remediate web application risks.
Secure SDLC
Security checks built into each stage of development, not added at the end.
ISO 27001
Information security management and the controls I test against.
ISO 31000
Risk management principles behind risk-based assessments.
EU AI Act
Risk categorisation and assurance reviews for AI-enabled applications.
Privacy by design
Data protection from the first design decision, including data localisation.

Security playbook

How I explain common risks

Six common application risks, each in three layers: how it happens, what it costs and how to fix it.

Broken access control

How it happens
A user changes an ID in a request and reads someone else's record, because the server never checks who owns it.
Impact
Data exposed across accounts, or actions taken with another user's rights.
Fix
Check ownership and role on the server for every request. Deny by default.

SQL injection

How it happens
User input is joined straight into a query, so the input is run as part of the SQL.
Impact
An attacker can read, change or delete what is in the database.
Fix
Parameterised queries, input validation and a least-privilege database account.

Cross-site scripting (XSS)

How it happens
The app puts user input into a page without encoding it, so a script runs in another user's browser.
Impact
Stolen sessions and actions performed as the victim.
Fix
Encode output for its context, add a Content Security Policy and use HttpOnly cookies.

Hard-coded secrets

How it happens
API keys or passwords are committed to source code, where anyone with repository access can read them.
Impact
Direct access to whatever system the secret protects.
Fix
Environment variables or a secrets manager, secret scanning in CI, and rotation of anything exposed.

Security misconfiguration

How it happens
Default credentials, open storage buckets, verbose error pages or missing security headers.
Impact
Easy entry points and information that helps an attacker plan the next step.
Fix
Hardened baselines, reviewed infrastructure settings and regular configuration checks.

Vulnerable components

How it happens
An outdated library with a publicly known vulnerability ships inside the application.
Impact
Attackers reuse exploits that are already published.
Fix
Dependency scanning, an inventory of components and a routine for patching.