About
Backend and platform engineer, working in application security.
Seven years of Python — startups, a high-traffic consumer product, a bank, and now a telecom group.
What I do
I build internal platforms that put security scanning and triage inside the pipelines teams already use.
Built an application-security platform from scratch at two companies. In practice the work is getting scanners to run where the code already lives, and reducing what they return to the findings worth acting on.
Experience
Company-wide Application Security Platform
An internal DevSecOps platform that collects security data wherever code and workloads live — scanners in GitLab CI, image scanning in Kubernetes clusters, cloud inventory — and drives everything downstream from it: CI quality gates, auto-fix merge requests, and the security team’s own back-office and analytics.
Bank-wide Application Security Platform
Led the build of the platform from scratch: security scanning, triage and reporting embedded across the SDLC of a large, predominantly Java organisation under strict audit and compliance requirements.
Mobile App & Website Backend API
A high-load API for the mobile app and the website — gRPC microservices behind a service mesh, event sourcing for state changes, and product features through to the payment integration. Peaks near 10,000 requests a second were absorbed by optimisation rather than by more hardware.
Master Delivery · SQUILLA · Upwork
Backend engineering before the platform work: microservices and shared internal libraries at a last-mile delivery provider, an API gateway and a real-time quotes collector for a crypto-loans platform, and three years of contract work delivered end to end for international clients.
Technical skills
Python (primary), SQL, Bash
FastAPI, Litestar, gRPC, asyncpg, Celery, Django, Flask
PostgreSQL, Redis, MongoDB, SQLite, RabbitMQ
Docker, Kubernetes, service mesh, event-driven architecture, microservices
GitLab CI/CD, pipeline automation, quality gates, Prometheus, Grafana, Sentry
Secure SDLC, DevSecOps, threat modelling (STRIDE), secure code review, OWASP Top 10, vulnerability management and triage
SCA/SBOM, SAST, secrets detection, IaC scanning; Semgrep, Trivy, Syft, gitleaks, KICS
LLMs in development and security workflows — false-positive triage, automated remediation
Apps
Suji and Gokaku, the two apps I build under Nonbiri. Both are mine end to end, from the content pipelines to the interface.
Swift 6 · SwiftUI · GRDB/SQLite · Supabase · PencilKit · Metal
Japanese learning platform for iPadOS, iOS and macOS. Native Swift 6 under strict concurrency across 40+ modules; offline-first local SQLite syncing to Supabase through an outbox queue. FSRS-5 spaced repetition, handwriting graded against KanjiVG with dynamic time warping, on-device and cloud AI, and a full teacher-and-student loop.
Flutter · Dart · Kotlin/Android · Python
Offline trainer for Japan’s written driving-licence exams, on the App Store. 932 true/false questions, each carrying a verbatim quote from the National Police Agency rulebook and machine-verified against that corpus; 208 official sign images; twelve languages; no account, no network, no data collected.
Away from the apps
Linux 6.12 · C · AArch64 · Android GKI/KMI · Device Tree · Ghidra · AOSP · LineageOS
A retail Android phone on a MediaTek Helio G99, sold on Linux 5.10 with no published source for its kernel, device tree or hardware abstraction layers. Hand-ported it to Linux 6.12 by way of 6.1, rebuilding the device tree out of the stock compiled blob and carrying 339 out-of-tree driver trees, 290 of them loading on the running phone. Above the kernel, rewrote closed userspace in the open — an audio HAL, a sensors HAL and four HIDL→AIDL bridges — so the device can be tuned and carried onto later Android releases. Two repositories: the 6.12 kernel current, the 6.1 port archived. It is the phone I carry.
The degree was in systems security and the CTF years went on exploitation and reversing. This is that work, picked back up.
Education
Southern Federal University (SFEDU), Taganrog, Russia — Specialist Degree — 5-year programme, equivalent to Master’s level, Information & Computer Systems Security, 2013–2018.
Teaching assistant, 2016–2018. Competitive CTF player — exploitation, reverse engineering.
Languages
English — C1 · Russian — Native · Japanese — Elementary
Get in touch