March 2024 - Present
DirectDeals/U2Connect
Application Security Engineer | Backend Systems & Infrastructure
- Led end-to-end incident response for a live production compromise on a self-managed Linux VPS, containing an active cryptominer and PHP web shell. Conducted root-cause analysis (RCA) and implemented permanent hardening (disable_functions, fail2ban, file integrity monitoring) with zero client downtime, producing a full PICERL-based incident writeup.
- Set up automated security scanning (SAST, SCA, DAST) as part of the CI pipeline, consolidating fragmented security findings into a single developer dashboard.
- Proactively hardened the infrastructure attack surface across multiple client-facing Laravel deployments (nginx, PHP-FPM, fail2ban), including nginx location-block precedence flaws and overly permissive Redis access that exposed unauthenticated data paths.
- Designed and implemented secure RESTful APIs and background workers, enforcing strict input validation, parameterized querying, and rate-limiting to mitigate OWASP API Top 10 risks.
- Engineered internal administrative dashboards with Firebase-integrated authentication with role-based access control and audit logging embedded at the data layer.
- Leveraged generative AI to accelerate secure code review cycles, translating CVE descriptions into actionable remediation steps and automating the refactoring of vulnerable legacy PHP patterns (e.g., SQLi, XSS) into OWASP-compliant equivalents, reducing manual review effort by ~30%.