London

Keep Calm and Secure Your CI/CD Pipeline

What is the work that you are doing today?

In my day job, I'm the lead security engineer at Photobox. I'm in charge of application security, cloud security and network security within my team. And for Pride in London, I'm the tech lead and the security manager. I take care of the website and the application, manage a team of fifteen developers and implement features that the other teams in the organisation are requesting. This is all volunteer based and working on an open source project.

How do you deal with stress and development when building security features?

It depends on the features. If it's a new feature, we could set up threat modelling sessions where we would sit down with the developers, the architect and the product owner, go through those new features and see what can go wrong and how we can remediate or fix any issues that are flagged during those sessions. Also we attend their developers guilds and try to give more context and tell a story behind the vulnerabilities, because we think that presenting the OWASP Top 10 most common vulnerabilities is great, but also giving more context and how it impacts different companies, by giving real life examples, make more sense for the developers because they might not be used to the security jargon.