carlos@cesaints: ~/cv.pdf — zsh

PT (Read this page in Portuguese)

Command: cv

cv.pdf · updated

Carlos Eduardo Gonçalves dos Santos

Software engineer. I build web systems end to end and I'm studying offensive security.

Brazil · fully remote

Summary

In four years I went from trainee to running technology for small companies: I wrote code, designed architecture, looked after data and led delivery. In my own systems I started hunting for flaws before anyone else did, which is where my move into AppSec and pentesting comes from, without leaving development behind.

What I'm looking for

  • AppSec and secure development
  • Junior pentester (web and API)
  • Security-minded software engineering

Available for fully remote work only (home office), for roles and for freelance projects with a defined scope.

Experience

  1. Founder and engineer

    Own product (study platform) – present

    Study platform with a sales site, a student app and an operations panel in one monorepo. I designed the architecture, set the business invariants and trade-offs, and built and ran the product with automated tests and quality gates before every release.

    • Payments with signed, idempotent webhooks and access revocation in the same transaction.
    • Security review of the system's own business logic, with flaws reproduced and fixed.
    • CI with 8 jobs, enforced CSP and mandatory 2FA on the admin panel.

    TypeScript · Next.js · PostgreSQL · Prisma · Turborepo · Vitest · Playwright

  2. Product and technology director (CPTO)

    Business group (two service companies) – present

    I ran technology for two companies in the group, most of the time as the only technical person. I built multilingual corporate sites, an in-house CRM and an internal onboarding platform.

    • Owner of the roadmap, architecture, scalability and security and compliance (LGPD); I built the group's platform end to end.
    • Own site and CRM on edge infrastructure, replacing a SaaS, with cookieless privacy.
    • Multi-company onboarding platform with database isolation proven by tests.
    • A technical hiring method with challenges, a live defense and a human decision, designed but not yet used.

    Astro · Next.js · Cloudflare Workers · Supabase · PostgreSQL · TypeScript

  3. Software engineer and DBA (freelance)

    National professional association – present

    The only engineer of a legacy PHP system in production that holds sensitive personal data. I lead its incremental modernization to Vue.js while administering the database: a reproducible environment, versioned migrations, CSRF protection and deploys with backup, verification and rollback.

    • Schema design and complex SQL with stored procedures.
    • Indexing and execution-plan tuning.
    • Backups and safe data migration from legacy to modern.
    • CSRF protection and gated deploys.

    PHP · Vue.js · MySQL · Docker · GitHub Actions

  4. Scrum Master

    Software house (federal government systems) –

    I led cross-functional squads on government systems and coordinated production database releases.

    Scrum · SQL Server · Power BI

  5. .NET developer

    Software house (federal government systems) –

    Built mission-critical systems for federal agencies.

    C# · ASP.NET · Angular · SQL Server · Entity Framework · Dapper

  6. Intern, then full-stack developer

    Software house (federal government systems) –

    Financial and sustainability projects in .NET with React and Angular front ends.

    C# · .NET · React · Angular · SQL Server

  7. Trainee

    Trainee program –

    First system migration work (PHP and Laravel to Java, Spring Boot and Angular), plus support and networking.

    PHP · Java · Spring Boot · Angular

Selected projects

  1. A study platform with payments, access control and timed examscesaints.dev/en/projects/study-platform
  2. A security review of the business logic of my own systemcesaints.dev/en/projects/business-logic-review
  3. A multi-company onboarding platform with isolation in the databasecesaints.dev/en/projects/multi-company-onboarding
  4. This sitecesaints.dev/en/projects/this-site
  5. A corporate site and an in-house CRM at the edge, with privacy as a requirementcesaints.dev/en/projects/edge-crm
  6. A national confederation's member system, modernized with the legacy still livecesaints.dev/en/projects/member-management

Skills

Languages
JavaScript (Node.js) · SQL (PostgreSQL, SQLite, MySQL) · TypeScript
Frameworks and libraries
Astro · Turborepo and pnpm monorepo · Next.js (App Router) · React · Tailwind CSS · Schema validation with Zod
Data
SQLite and Cloudflare D1 · PostgreSQL · Prisma · Supabase (Auth, RLS, Storage)
Authentication and access
Auth.js with mandatory TOTP 2FA · Custom authentication (modern hashing, opaque sessions, roles, audit trail) · Multi-tenant isolation with RLS
Infrastructure and delivery
Cloudflare Workers (D1, R2, KV) · Gated deploys and migrations (backup, verification, rollback) · GitHub Actions · Vercel
Testing
Security tests (isolation, role escalation, CSP, concurrency) · Vitest
AI in the product
LLM in the product with validated output and a spend cap
Security
CSP and security headers · Criticality-based rate limiting
Process
Architecture decision records · Runbooks and operations docs

Only what has strong evidence. The full list, with the evidence level of each technology: cesaints.dev/en/stack

Education and awards

  1. Postgraduate (lato sensu) in Process and Project Management

    GRAN –

    Postgraduate lato sensu.

  2. Postgraduate (lato sensu) in Innovation, AI and Robotic Care

    GRAN –

    Postgraduate lato sensu.

  3. Systems Analysis and Development (associate degree)

    UDF University Center –

    Technology degree.

  4. 2nd place, representing UDF

    PMI-DF Hackathon

    Second place as a team.

Certifications

  • Scrum Fundamentals Certified · SCRUMstudy
  • Registered Scrum Basics · Scrum Inc.
  • Six Sigma Yellow Belt

Languages

  • Portuguese: native
  • English: technical reading and writing

Current version: cesaints.dev/en/cv · updated