DB

Experience

What I’ve
shipped

I work on the detection side of an open-source cloud security scanner: the checks that find misconfigurations, and the providers that let people run them against whatever cloud they are actually on.

Roles

Prowler

Cloud Security Engineer · Jan 2025 – present · Remote

PythonAWSAzureGoogle CloudOpenStackOktaMicrosoft 365
  • 528Commits merged into Prowler, the sixth-highest of 398 contributors on a project with 14.8k stars, and 294,573 lines added.
  • 15Cloud providers worked on: AWS, Azure, Google Cloud, Microsoft 365, OpenStack, Okta, MongoDB Atlas, Oracle Cloud, Alibaba Cloud, GitHub, Vercel and Linode among them.
  • 2OpenStack and Okta, both taken end to end from the core SDK through the checks, the API, the web UI and the documentation.
  • 144Pull requests touching security checks and fixers: the detection logic organisations run against their own infrastructure.
  • NowLeading the detection and remediation team, after a year of community issue triage, pull request review and Slack support.

Prowler

Intern Cloud Security Engineer · Jun 2024 – Dec 2024 · Remote

PythonGoogle CloudAWSpytest
  • 80Pull requests merged during the internship, starting with test coverage for Google Cloud checks and moving quickly into new detections.
  • 7Months from first commit to a full-time offer.

Speaking and conferences

  • Hackén, JaénSpeaker, two consecutive years.
  • fwd:cloudsecAttended, Berlin.
  • AWS re:InventAttended, Las Vegas.
  • RootedCONAttended, Madrid.

Open source

  • ProwlerThe open-source cloud security platform. Sixth by commit count of 398 contributors, with 528 commits across 15 providers, from the core SDK through the checks, the API, the web UI and the documentation.
  • pathfinding.cloudBrought pathfinding.cloud’s AWS privilege-escalation research into Prowler as Attack Paths coverage, and linked every query back to its Prowler Hub page so a finding leads to an explanation.
  • okta-sdk-pythonTwo bugs found and reported upstream in Okta’s own Python SDK while building Prowler’s Okta provider: a validation error on lowercase policy constraint types, and a regex missing a quantifier that broke log stream listing. One is fixed.

Every number here comes from the public repository and can be checked. Some of the work is not public, including features that came from enterprise customer requests and the internal support side, so these figures are a floor rather than a total.