Renzo Franco Barros Email & Phone Number

• As a Senior Information Security Analyst, I lead strategic initiatives to integrate security practices throughout the software development cycle. My focus is on establishing and enhancing DevSecOps processes, applying.
• DevSecOps Pipeline Management: Responsible for implementing and maintaining the DevSecOps pipeline using tools such as GitLab CI, integrating security practices from design to production.
• Execution of AST Techniques: Implementation and management of Application Security Testing (AST) tools, including Code Review, Fuzzing, SAST, DAST, SCA, IAST and solutions such as SemGrep, DependencyTrack, GitLeaks.
• Mapping Secure Development Requirements: Developing requirements based on OWASP frameworks such as ASVS, SCP and TOP TEN.
• Documentation and procedures for secure development: Creating and maintaining detailed documentation and procedures focused on secure development practices.
• Center of Excellence for Secure Development: Structure and continuously improve the Center of Excellence to ensure the adoption of best security practices by all development teams.

• As a mid-level Information Security Analyst, I specialized in conducting offensive testing and integrating security practices throughout the software development cycle. My experience ranged from carrying out fuzzing.
• Offensive Testing: Conducting offensive tests focused on identifying and mitigating vulnerabilities in systems.
• Fuzzing Testing: Implementing fuzz testing within the security testing cycle to assess system robustness.
• Security Assessment and AWS WAF Rules Review: Continuously assessing security and reviewing the rules of the Web Application Firewall (WAF) on AWS to ensure effective protection against attacks.
• Security Integration in Software Development: Embedding security practices into the software development cycle, ensuring that security considerations are addressed from the start of each project.
• Vulnerability Management: Managing the vulnerability management process, identifying and addressing vulnerabilities efficiently.

• As an Information Security Trainee, I was involved in several important activities to strengthen the security infrastructure of clients' systems. My role included both technical actions and collaborative efforts.
• Threat Modeling: Using the STRIDE model to identify and mitigate potential threats.
• Security Requirements Definition: Establishing security requirements for web and mobile applications.
• Security Champion: Serving as a security champion in tribes, helping to integrate security practices into daily activities.
• Client Vivo (Telefônica Brasil): Direct involvement with one of our major clients as a Security Champion, ensuring security in critical projects.
• Vulnerability Management: Managing the process of identifying and resolving vulnerabilities in the systems.

Shift, Devsecops - Security Ci/Cd And Devops

Technical Course, Information Technology