Advisory and training
DevSecOps: security in your development process
Security works best when it's part of the daily process, not a check at the end. I help your team add the controls that catch problems early, without slowing development down.
Get in touch
Quoted individually, based on the scope.
What's included
- Security checks in your CI/CD pipeline.
- Dependency scanning and a process for keeping dependencies up to date.
- Secret detection in code and history.
- Review of infrastructure as code before it is applied.
- Processes for handling vulnerabilities when they appear.
What you get
- Controls implemented or documented, as agreed, so your team can maintain them.
Who it's for
- Teams that deploy often and want to keep doing so safely.
- Companies that need to show security controls to clients or auditors.
Not included
- Ongoing operation of your pipelines or infrastructure.
Frequently asked questions
Will it slow down my team?
The goal is the opposite: catch problems when they are cheap to fix. We choose the checks with your team so they fit how you already work.
Other services
- Secure code review A review of your code to find vulnerabilities before they reach production.
- Architecture review Threat modeling and design review, before the decisions are expensive to change.
- Security training Hands-on secure development workshops for engineering teams.
- Web and API penetration testing Manual testing of web applications and APIs, the way an attacker would approach them.
Have a system to test or review? Send me the scope
Tell me what you need tested (applications, APIs or environments), by when, and any constraints, and I'll reply with the next steps. I work in English and Spanish.
hello@santiagopassafiume.comLooking for development? Websites, applications and backend projects go through RyuLabs.