Focus
DevSecOps
I own the security scanning in the CI/CD pipeline. I triage SAST and SCA findings with developers and cut the false positives.
Cloud security
I configure cloud security policies and automated case workflows.
Application security
I run quarterly penetration tests of web and mobile apps and track findings to remediation.
I started in offensive security. That background helps me triage scanner output, because I can tell which findings an attacker could use.
Experience
-
to present
Cybersecurity Engineer, Tabby
I also led the company's data loss prevention rollout from scoping to production.
-
to
Cybersecurity Analyst, Tabby
I ran web and mobile penetration tests and triaged pipeline findings with engineering teams.
-
to
Cybersecurity FOSS Analyst, Valeo
I audited open-source components in automotive software written in Rust, C and C++ for security and license risk.
-
to
Cybersecurity Specialist, National Bank of Egypt
I tested internal web and mobile applications and investigated phishing, endpoint and threat incidents.
Certifications
- eMAPT Mobile Application Penetration Tester
- eWPTX Web Application Penetration Tester eXtreme
- eCPPT Certified Professional Penetration Tester
- eWPT Web Application Penetration Tester
- OSCP OffSec Certified Professional
- eCIR Certified Incident Responder
Outside reviews
I'm open to a few outside security reviews for startups and small teams, covering CI/CD pipelines, cloud configuration and web applications. We agree the scope in writing before I start, and you get a written report at the end. This work is separate from my role at Tabby.
Email hello@khalidsharafeldin.com with what you run and what you want checked.