{
  "$schema": "https://raw.githubusercontent.com/jsonresume/resume-schema/v1.2.1/schema.json",
  "basics": {
    "name": "Carlos Eduardo Gonçalves dos Santos",
    "label": "Software engineer. I build web systems end to end and I'm studying offensive security.",
    "email": "cesaints.engineer@gmail.com",
    "url": "https://cesaints.dev/en",
    "summary": "In four years I went from trainee to running technology for small companies: I wrote code, designed architecture, looked after data and led delivery. In my own systems I started hunting for flaws before anyone else did, which is where my move into AppSec and pentesting comes from, without leaving development behind.",
    "location": {
      "countryCode": "BR"
    },
    "profiles": [
      {
        "network": "GitHub",
        "username": "cesaints",
        "url": "https://github.com/cesaints"
      },
      {
        "network": "LinkedIn",
        "username": "carlossaints",
        "url": "https://www.linkedin.com/in/carlossaints/"
      }
    ]
  },
  "work": [
    {
      "name": "Own product (study platform)",
      "position": "Founder and engineer",
      "startDate": "2026-05",
      "summary": "Study platform with a sales site, a student app and an operations panel in one monorepo. I designed the architecture, set the business invariants and trade-offs, and built and ran the product with automated tests and quality gates before every release.",
      "highlights": [
        "Payments with signed, idempotent webhooks and access revocation in the same transaction.",
        "Security review of the system's own business logic, with flaws reproduced and fixed.",
        "CI with 8 jobs, enforced CSP and mandatory 2FA on the admin panel."
      ]
    },
    {
      "name": "Business group (two service companies)",
      "position": "Product and technology director (CPTO)",
      "startDate": "2026",
      "summary": "I ran technology for two companies in the group, most of the time as the only technical person. I built multilingual corporate sites, an in-house CRM and an internal onboarding platform.",
      "highlights": [
        "Owner of the roadmap, architecture, scalability and security and compliance (LGPD); I built the group's platform end to end.",
        "Own site and CRM on edge infrastructure, replacing a SaaS, with cookieless privacy.",
        "Multi-company onboarding platform with database isolation proven by tests.",
        "A technical hiring method with challenges, a live defense and a human decision, designed but not yet used."
      ]
    },
    {
      "name": "National professional association",
      "position": "Software engineer and DBA (freelance)",
      "startDate": "2024-11",
      "summary": "The only engineer of a legacy PHP system in production that holds sensitive personal data. I lead its incremental modernization to Vue.js while administering the database: a reproducible environment, versioned migrations, CSRF protection and deploys with backup, verification and rollback.",
      "highlights": [
        "Schema design and complex SQL with stored procedures.",
        "Indexing and execution-plan tuning.",
        "Backups and safe data migration from legacy to modern.",
        "CSRF protection and gated deploys."
      ]
    },
    {
      "name": "Software house (federal government systems)",
      "position": "Scrum Master",
      "startDate": "2024-04",
      "endDate": "2025-12",
      "summary": "I led cross-functional squads on government systems and coordinated production database releases."
    },
    {
      "name": "Software house (federal government systems)",
      "position": ".NET developer",
      "startDate": "2023-09",
      "endDate": "2024-04",
      "summary": "Built mission-critical systems for federal agencies."
    },
    {
      "name": "Software house (federal government systems)",
      "position": "Intern, then full-stack developer",
      "startDate": "2022-09",
      "endDate": "2023-09",
      "summary": "Financial and sustainability projects in .NET with React and Angular front ends."
    },
    {
      "name": "Trainee program",
      "position": "Trainee",
      "startDate": "2022-07",
      "endDate": "2022-10",
      "summary": "First system migration work (PHP and Laravel to Java, Spring Boot and Angular), plus support and networking."
    }
  ],
  "education": [
    {
      "institution": "GRAN",
      "area": "Postgraduate (lato sensu) in Process and Project Management",
      "studyType": "Postgraduate lato sensu",
      "startDate": "2025-02",
      "endDate": "2026-05"
    },
    {
      "institution": "GRAN",
      "area": "Postgraduate (lato sensu) in Innovation, AI and Robotic Care",
      "studyType": "Postgraduate lato sensu",
      "startDate": "2025-02",
      "endDate": "2026-07"
    },
    {
      "institution": "UDF University Center",
      "area": "Systems Analysis and Development (associate degree)",
      "studyType": "Technology degree",
      "startDate": "2022",
      "endDate": "2024"
    }
  ],
  "awards": [
    {
      "title": "2nd place, representing UDF",
      "awarder": "PMI-DF Hackathon",
      "date": "2023",
      "summary": "Second place as a team."
    }
  ],
  "certificates": [
    {
      "name": "Scrum Fundamentals Certified",
      "issuer": "SCRUMstudy"
    },
    {
      "name": "Registered Scrum Basics",
      "issuer": "Scrum Inc."
    },
    {
      "name": "Six Sigma Yellow Belt"
    }
  ],
  "skills": [
    {
      "name": "Languages",
      "level": "Evidence level: strong",
      "keywords": [
        "JavaScript (Node.js)",
        "SQL (PostgreSQL, SQLite, MySQL)",
        "TypeScript"
      ]
    },
    {
      "name": "Frameworks and libraries",
      "level": "Evidence level: strong",
      "keywords": [
        "Astro",
        "Turborepo and pnpm monorepo",
        "Next.js (App Router)",
        "React",
        "Tailwind CSS",
        "Schema validation with Zod"
      ]
    },
    {
      "name": "Data",
      "level": "Evidence level: strong",
      "keywords": [
        "SQLite and Cloudflare D1",
        "PostgreSQL",
        "Prisma",
        "Supabase (Auth, RLS, Storage)"
      ]
    },
    {
      "name": "Authentication and access",
      "level": "Evidence level: strong",
      "keywords": [
        "Auth.js with mandatory TOTP 2FA",
        "Custom authentication (modern hashing, opaque sessions, roles, audit trail)",
        "Multi-tenant isolation with RLS"
      ]
    },
    {
      "name": "Infrastructure and delivery",
      "level": "Evidence level: strong",
      "keywords": [
        "Cloudflare Workers (D1, R2, KV)",
        "Gated deploys and migrations (backup, verification, rollback)",
        "GitHub Actions",
        "Vercel"
      ]
    },
    {
      "name": "Testing",
      "level": "Evidence level: strong",
      "keywords": [
        "Security tests (isolation, role escalation, CSP, concurrency)",
        "Vitest"
      ]
    },
    {
      "name": "AI in the product",
      "level": "Evidence level: strong",
      "keywords": [
        "LLM in the product with validated output and a spend cap"
      ]
    },
    {
      "name": "Security",
      "level": "Evidence level: strong",
      "keywords": [
        "CSP and security headers",
        "Criticality-based rate limiting"
      ]
    },
    {
      "name": "Process",
      "level": "Evidence level: strong",
      "keywords": [
        "Architecture decision records",
        "Runbooks and operations docs"
      ]
    }
  ],
  "languages": [
    {
      "language": "Portuguese",
      "fluency": "native"
    },
    {
      "language": "English",
      "fluency": "technical reading and writing"
    }
  ],
  "projects": [
    {
      "name": "A study platform with payments, access control and timed exams",
      "description": "My own product: a sales site, a student app and an operations panel, three apps in one monorepo. The rules that touch money, access and personal data live on the server, in packages the three share, tested against a real Postgres. It is live and in commercial pre-launch; this case is about the engineering, not traction.",
      "url": "https://cesaints.dev/en/projects/study-platform",
      "startDate": "2026-05",
      "roles": [
        "Technical founder and architect"
      ],
      "keywords": [
        "nextjs",
        "postgres",
        "payments",
        "exams",
        "monorepo"
      ]
    },
    {
      "name": "A security review of the business logic of my own system",
      "description": "I reviewed the business logic of my own system, with payments, credits, rankings and paid content, and fixed thirteen classes of flaws, each with a regression test. The process was an adversarial review that never touched production: every hypothesis reproduced in a failing test and fixed at the narrowest boundary. The costliest flaws were the ones scanners and generic checklists miss.",
      "url": "https://cesaints.dev/en/projects/business-logic-review",
      "startDate": "2026-08",
      "endDate": "2026-09",
      "roles": [
        "Author of the process and owner of the decisions"
      ],
      "keywords": [
        "appsec",
        "business-logic",
        "concurrency",
        "postgres"
      ]
    },
    {
      "name": "A multi-company onboarding platform with isolation in the database",
      "description": "Two companies of a business group use the same platform to onboard new hires, in the same database, without either one seeing a single row of the other's data. Each person gets a guided trail by phase, assembled for their department, role and contract, and the admin panel follows progress in real time without sending any personal data over the real-time channel.",
      "url": "https://cesaints.dev/en/projects/multi-company-onboarding",
      "startDate": "2026-07",
      "endDate": "2026-09",
      "roles": [
        "Sole engineer, from product to operations"
      ],
      "keywords": [
        "nextjs",
        "postgres",
        "rls",
        "multi-tenant",
        "lgpd"
      ]
    },
    {
      "name": "This site",
      "description": "A portfolio that works like a terminal session: every page answers a command, and the next commands are links, so anyone can navigate by clicking. People who prefer typing get a real terminal and a command palette, and all the content reads without JavaScript. The site itself is the evidence: its HTML, headers and commands can be checked in the browser.",
      "url": "https://cesaints.dev/en/projects/this-site",
      "startDate": "2026-09",
      "roles": [
        "Concept, architecture, development and content"
      ],
      "keywords": [
        "astro",
        "accessibility",
        "security",
        "process"
      ]
    },
    {
      "name": "A corporate site and an in-house CRM at the edge, with privacy as a requirement",
      "description": "A B2B group replaced an off-the-shelf CRM with its own system: a site in three languages that captures contacts through an interactive assessment and meeting booking, and a CRM with leads, a deal pipeline, a meeting queue, content and analytics. It all runs in a single Worker at the edge, with five access roles, owner-scoped data and Brazil's data protection law (LGPD) treated as part of the product.",
      "url": "https://cesaints.dev/en/projects/edge-crm",
      "startDate": "2026-06",
      "endDate": "2026-09",
      "roles": [
        "Sole engineer, from product to operations"
      ],
      "keywords": [
        "astro",
        "cloudflare",
        "edge",
        "crm",
        "lgpd"
      ]
    },
    {
      "name": "A national confederation's member system, modernized with the legacy still live",
      "description": "A national professional confederation keeps its members' records, the digital membership card with a QR code, the regional offices' request batches and online membership with a contract and consent in a legacy PHP system that runs in production. As the sole engineer, I lead the modernization from the inside without stopping the system: version control, recorded decisions, tests from zero, CI with disposable databases and deploys with backup and automatic rollback.",
      "url": "https://cesaints.dev/en/projects/member-management",
      "startDate": "2026-06",
      "roles": [
        "Sole engineer of the modernization"
      ],
      "keywords": [
        "php",
        "legacy",
        "strangler-fig",
        "ci-cd",
        "lgpd"
      ]
    }
  ],
  "meta": {
    "canonical": "https://cesaints.dev/en/resume.json",
    "version": "v1.2.1",
    "lastModified": "2026-09-24T00:00:00"
  }
}