Command: cat about.md
About
In four years I went from trainee to running technology for small companies: I wrote code, designed architecture, looked after data and led delivery. In my own systems I started hunting for flaws before anyone else did, which is where my move into AppSec and pentesting comes from, without leaving development behind.
Path
I started in 2022 in a trainee program, helping migrate a system from PHP to Java and doing network support. The same year I joined, as an intern, a software house that builds systems for the Brazilian federal government. There I became a .NET developer and later a Scrum Master, leading squads and coordinating production database releases.
In 2024 I started freelancing as the only engineer and DBA of a legacy PHP system for a professional association, leading its incremental modernization to Vue.js while administering the database. In 2026 I took over technology for two companies in a business group, as their product and technology director (CPTO), and started my own product, a study platform.
Along the way the question changed. First it was “how do I build this”, and the most complete answer is the study platform. Then it became “how does this behave when the load, the data or the user isn’t what I expected”, as in the cross-company isolation tested in the database itself. Now it’s “how would someone break this”, the question behind the security review of the business logic of my own system. Offensive security is the next step on that path: I was already spending more time finding where my own systems give way than writing new screens.
How I work
- Business rules are invariants. Money, access and personal data stay on the server, with a test that fails if the rule breaks and a mandatory review gate that can block the change.
- Decisions get written down. I use ADRs, with the negative consequences as well as the positive ones.
- Proof before claims. Numbers carry a date and a source. When I haven’t verified something, I say so.
- Security in the design. Authorization on the server and closed by default, each company’s data isolated in the database itself, and protections that fail closed when something goes wrong.
- A bug becomes a test before it becomes a fix. Money and access rules are tested against a real database, and in the systems in production every change goes through the tests in CI before it is deployed.
- Uneventful deploys. Small changes, two-step migrations, backups, health checks and automatic rollback.
What I’m looking for
AppSec and secure-development roles, junior web and API pentesting, or security-minded software engineering. Fully remote only (home office). I also take freelance projects with a defined scope (services).