AI coding agents like Claude Code are my first reviewer on pull requests. They read a change in context, follow data through the code and explain real flaws instead of just matching patterns. Semgrep stays underneath as the fast, predictable check. The real work is triage: a few findings developers trust, each with a fix ready to merge.

I test running applications and APIs from the outside, the way an attacker would, to find what code review cannot see: auth flaws, misconfigurations and broken business logic. Burp Suite is where the hands-on testing of sensitive flows happens, ZAP runs automated scans against staging, and Nuclei sweeps everything we expose for known issues.

Leaked credentials are the cheapest way in. TruffleHog digs through full git history and checks which secrets are still live, Gitleaks blocks new ones at pre-commit and in CI, and detect-secrets keeps a clean baseline for older repositories. Every hit gets an owner, a rotation and a move into a proper secrets manager.

Most of the code we ship is someone else's. Dependency-Check maps every library to known CVEs, OSV-Scanner checks lockfiles against the open vulnerability database, and Dependabot opens the update pull requests. The goal is fewer, more meaningful alerts and a fast path to patch what really matters.

I secure the path from image to running pod: minimal base images, scanning and signing in CI, and admission policies that only let trusted images into the cluster. Trivy scans images and manifests on every build, Grype double-checks against the SBOM, and Cosign signs what passes so the cluster can verify it before it runs.

I review cloud architectures for identity, network exposure, encryption and blast radius, then codify the answers as guardrails that hold while teams move fast. Prowler audits live accounts against the benchmarks, Checkov stops risky infrastructure as code before it is deployed, and CloudSploit catches the drift in between.

LLM features bring new attack surface: prompt injection, data leakage between tenants, over-privileged agents and tool abuse. I threat-model these systems and put least privilege between the model and anything it can touch. Then I attack them: garak probes the model itself, promptfoo red-teams prompts and agents in CI, and DeepTeam covers the wider catalogue of known attacks.

Controls have to stand up to auditors as well as attackers. I write guardrails as code with Open Policy Agent, use OpenCRE to map one control across ISO 27001, SOC 2, PCI-DSS and the rest, and let Drata collect the evidence, so compliance becomes a by-product of good engineering.