Costa Samuel

Lead the Security By Design project as SME. Implement and integrate missing solutions to improve S-SDLC like SAST, SCA, DAST, IaC Security, Container Scanning, Secrets Scanning and MAST trying to give more visibility about security issues into the development environment. Help the Development and AppSec teams with Code Review of security issues reported by the tools and triage it looking for false-positives before deliver it to the solving groups. Create PoCs using web pentesting, API pentesting and perimeter pentesting(Cloud, Network, Domains, etc) and lead war-rooms/squads to mitigate the findings from the pentesting processes. Create flows, documentation and process to solve mitigation gaps an turn on the solving process and issues age less painfull. Create continuous security trainnings looking for the worst security ofenders on the development phase environment to mitigate those problems even before going live. Some technologies and tools used: APIs, JavaScript(Front, Back and Mobile), AWS/Azure/GCP, K8S, Docker, Checkmarkx, Fortify, OWASP-ZAP, Kics, BurpSuite, WebInspect, Checkov, SonarCloud, SonarQube, etc.

Leading the thecnical side of S-SDLC implementations(SAST, DAST, SCA, IaC Security, Container Security, etc). Test cloud solutions looking for Security posture and address those findings to the squads to solve the problems. Leading the Security By Design project. Do penetration testing into web applications, APIs and perimeter looking for Security flaws. Code Review Javascript applications and frameworks like: React, NodeJS, SpringBoot, Flutter, Kotling and other trying to mitigate the security issues reported together with the development team and use the native solutions agains XSS, SQLi and other ofenders from the OWASP Top Ten list.

Audit applications using SAST, DAST and SCA solutions to improve/implement security at the source code, primary using Fortify for SAST, WebInspect for DAST and Sonatype for SCA(OSS). The usage of other comercial and Open Source solutions was comun among the customer like: Checkmarx, Veracode, Burp Suite, OWASP Zap, OWASP Dependency-Check, etc. Deploy and maintain CI/CD pipelines and integrate them with DevSecOps tools to generate security reports. Help costumers to design tests and tune deployments across multiple stacks. Audit network, infrastructure and applications looking to exploit entry points, report and help I.T. teams to implement best practices to mitigate discovered flaws making correlation of them.

Going trough several projects about secure development and pentesting for companies and personal. For pentesting in gray, black or white box I usually was commited to do detailed reports about vulnerabilities found and exploited and how to mitigate them using phisical or software resources, also I'm often hired to improve hardening of servers, aplications or services and implanting as well firewalls, WAFs, IPS, IDS, and, sometimes, implementing monitoring systems to respond security incidents

Responsible for pre-sales and support to digital transformation projects. Project development, rollout in IoT secure solutions to connect data from the plant floor to IoT platform where the accuracy outcomes are generated. Techonologies implemented and supported: OPC, VPN, VPC, WAF, AWS Cloud Security(WAF, IAM, KMS). Highligth project: Sabesp, 250 monitored assets in São Paulo metropolitan region.

Project: 2014 Fifa World Cup Brazil Function: IT Venue Coordinator Manage I.T. and information security(Blue Team) incidents solving them and/or delegate to the right team to solve. Lead local I.T. team and making daily reports to MATCH SERVICES AG.

Lead I.T. team from the north of the country(São Luís - MA, Belém - PA). Project and implement improvements to the local network. Support internal and external clients solving IT problems at levels II and sometimes III. Pentest web applications from the company to help de development team making it safer.

Chapter SLZ https://www.owasp.org/index.php/Sao_Luis Contact: Contact: samuel.rocha 'at' owasp 'dot' org

Responsile to install Nagios+Centreon to monitoring network devices and servers looking to solve system flaws and respond to security incidents on this servers/network devices. Sometimes changed monitoring scripts to meet specific demands from the NOC/SOC team. Lead a NOC/SOC team with 8 ninjas to help them achieve their goals and solve our incident calls dailly.

Responsible for solving incidents related to Networks (Client x Server), Microsoft (Applications, Systems, etc.), Linux / Unix, Telecom and Hardware that affect directly recording systems like NICE, WITNESS, FREEDOM and MONDAY, preventing damage recordes in Brazil, as well as mapping and validating improvements to reduce incidents (records) that it decreased by 50% after 2 months starting the job. In parallel was responsible to administrate and managing TSM (Tivoli Storage Manager) environment at the Brazil level.

Responsible for a team of 20 people who answered calls remotely or in locco at Brazil level. Answering critical calls (N2) and monitoring hosts/services through Whats'UP and Nagios system. Support to internal and external customers to solve I.T. problems.

Teaching following courses: Microcomputer Operator, Computer Networks, Computing Maintenance. At this project I won as one of the three best instructors in Brazil

Worked in systems area with emphasis on hardware/software support, server/computer maintenance, network administration assistance and maintenance of printers and computer equipments.