Renzo Franco Barros Email & Phone Number

As a Senior Information Security Analyst, I lead strategic initiatives to integrate security practices throughout the software development cycle. My focus is on establishing and enhancing DevSecOps processes, applying advanced security testing techniques, and developing robust frameworks for secure development.Activities:• DevSecOps Pipeline Management: Responsible for implementing and maintaining the DevSecOps pipeline using tools such as GitLab CI, integrating security practices from design to production.• Execution of AST Techniques: Implementation and management of Application Security Testing (AST) tools, including Code Review, Fuzzing, SAST, DAST, SCA, IAST and solutions such as SemGrep, DependencyTrack, GitLeaks, Owasp ZAP, MOBSF, Trivy and Kics.• Mapping Secure Development Requirements: Developing requirements based on OWASP frameworks such as ASVS, SCP and TOP TEN.• Documentation and procedures for secure development: Creating and maintaining detailed documentation and procedures focused on secure development practices.• Center of Excellence for Secure Development: Structure and continuously improve the Center of Excellence to ensure the adoption of best security practices by all development teams.• IT tool integrations and automations: Building integrations and automations using Python and Bash Script to optimize security processes within the bank.• Integration with Bug Tracking Solutions: Developing native integrations with bug tracking solutions such as Jira and Kanbanize, facilitating vulnerability management and incident response.• Security Champions Program: Created and managed a Security Champions program to train and engage tribes in security practices.• Training and Workshops: Develop and conduct training and workshops on secure development to educate and update technical teams.

As a mid-level Information Security Analyst, I specialized in conducting offensive testing and integrating security practices throughout the software development cycle. My experience ranged from carrying out fuzzing tests and security assessments to implementing security improvements in critical and high-visibility environments, such as distance education portals of the main educational institutions in Brazil.Activities:• Offensive Testing: Conducting offensive tests focused on identifying and mitigating vulnerabilities in systems.• Fuzzing Testing: Implementing fuzz testing within the security testing cycle to assess system robustness.• Security Assessment and AWS WAF Rules Review: Continuously assessing security and reviewing the rules of the Web Application Firewall (WAF) on AWS to ensure effective protection against attacks.• Security Integration in Software Development: Embedding security practices into the software development cycle, ensuring that security considerations are addressed from the start of each project.• Vulnerability Management: Managing the vulnerability management process, identifying and addressing vulnerabilities efficiently.• Testing in Distance Education Portals (EAD): Performing offensive tests on major Brazilian distance education portals, including PUC, FAAP, and FIA.• Support for Acquired Companies: Providing security assistance for newly acquired companies in the group, such as Passei Direto.• Requirements Definition and OWASP SAMM Maturity Analysis: Defining security requirements and conducting maturity analysis using the OWASP SAMM framework.• Development of a Security Champions Program: Structuring and implementing a Security Champions program to promote security awareness and training within the organization.

As an Information Security Trainee, I was involved in several important activities to strengthen the security infrastructure of clients' systems. My role included both technical actions and collaborative efforts, working directly with large clients and internal teams.Activities:• Threat Modeling: Using the STRIDE model to identify and mitigate potential threats.• Security Requirements Definition: Establishing security requirements for web and mobile applications.• Security Champion: Serving as a security champion in tribes, helping to integrate security practices into daily activities.• Client Vivo (Telefônica Brasil): Direct involvement with one of our major clients as a Security Champion, ensuring security in critical projects.• Vulnerability Management: Managing the process of identifying and resolving vulnerabilities in the systems.• Security Assessment: Performing assessments using the OWASP SAMM framework to validate the effectiveness of implemented security measures.

Shift, Devsecops - Security Ci/Cd And Devops

Technical Course, Information Technology