Security Automation
Monthly PDF scans + post-breach discovery → continuous scanning, <5s detection, CI gates devs actually use.
- Role
- SDE-II
- Context
- Cybersecurity / SaaS
- Duration
- 7 months
- Team
- 5 engineers + 1 SDE-II (me)
Tech stack
- Python
- FastAPI
- React
- TypeScript
- PostgreSQL
- Redis
- AWS Lambda
- SNS
- SQS
- Docker
- GitHub Actions
Business problem and production context.
Business problem
Security teams lacked visibility into API-layer threats. Manual security reviews took weeks, vulnerability backlogs grew faster than they could be triaged, and there was no runtime protection. Threats were only caught post-breach in log analysis.
Architecture decision
Developed Python backend services for automated API security scanning and threat detection. Built a React security dashboard with real-time threat visualization, risk scoring, and compliance status tracking. Implemented event-driven alerting with SNS/SQS for instant notification on critical vulnerabilities. Improved CI/CD pipeline efficiency by 25% with automated security gates.
The useful proof is the decision surface, not only the result number.
These are the parts of the work that show production judgment: ownership, constraints, rollback, cost, and observability.
Owned scope
- Security automation around cloud posture, guardrails, and response workflows
- Least-privilege and alerting decisions that reduced manual review pressure
- Operational handoff so alerts pointed to owners and action, not noise
Evidence artifacts
What would fail first?
Every project has constraints. The useful work is naming them early enough that rollback, cost, and ownership are designed before an incident.
Signal quality
Security automation had to reduce ambiguity instead of flooding teams with low-value alerts.
IAM risk
Permission drift needed clear boundaries and reviewable remediation paths.
Ownership
Findings needed an owner and a response path, not only a dashboard entry.
Trade-offs accepted on purpose.
Production risks and how they were controlled.
Small steps, visible changes, fewer surprises.
- 01
Analyzed existing security workflow: manual Burp Suite scans triggered monthly, results emailed as PDFs, no centralized tracking or prioritization.
- 02
Built FastAPI backend with async request handling for real-time API endpoint scanning. Each scan runs in under 5 seconds for standard REST APIs.
- 03
Designed PostgreSQL schema for multi-tenant vulnerability tracking: assets → scans → findings → remediation status, with row-level security per organization.
- 04
Implemented event-driven alerting pipeline: Lambda processes scan results, classifies severity via custom ML model, fans out via SNS to Slack/PagerDuty/email based on org preferences.
- 05
Created React dashboard with real-time WebSocket updates showing active threats, risk score trends, and compliance status against OWASP Top 10.
Before and after.
Rollback path
Automated remediation needed dry-run and rollback behavior before it touched production resources.
Cost considerations
Cost came mostly from scanning cadence, log volume, and security tooling scope.
Observability notes
The useful view was findings by owner, severity, age, and remediation state.
Related services
Have a similar production problem?
Send the current architecture, bill concern, deployment pain, or GenAI reliability issue. I will help you find the first real bottleneck.
Request the reliability audit