DevSecOps and Platform Architect

Arslan Khurram Khan

I design the security gates software ships through, test it the way an attacker would, and deploy what passes on AWS and Azure.

PR REVIEW 01 LOCAL · BEFORE COMMIT 02 PULL REQUEST 03 PRODUCTION
GitHub Actions
Docker
SE Semgrep
Trivy
Snyk
SonarQube
AW AWS
LA Lambda
FA Fargate
Gemini
Jira
Terraform
NestJS
Next.js
React
TypeScript
PostgreSQL
MySQL
FastAPI
Python
Grafana
Prometheus
WA Wazuh
Burp Suite
Ollama
nginx
GitHub
GitHub Actions
Docker
SE Semgrep
Trivy
Snyk
SonarQube
AW AWS
LA Lambda
FA Fargate
Gemini
Jira
Terraform
NestJS
Next.js
React
TypeScript
PostgreSQL
MySQL
FastAPI
Python
Grafana
Prometheus
WA Wazuh
Burp Suite
Ollama
nginx
GitHub

01

Selected work

Six things I built. Each with a real stack behind it.

3

Security gates

2

Clouds in production

0

Long-lived keys

Project 01 · Headline

Secure SDLC program

Three security gates, one rule set: local, pull request, production. Built and owned end to end.

GitHub ActionsLambdaStep FunctionsSemgrepGemini

Project 02 · Tooling

Security reporting and PR automation

AI triage that screens false positives before a report exists.

GeminiS3Jira

Project 03 · Full-stack and AWS

Real-estate portal

One engineer owning the app and the full production AWS topology.

NestJSNext.jsFargate

Project 04 · Internal product

Internal docs platform

The Confluence replacement I designed and built end to end.

ReactTipTapEntra ID

Project 05 · Practice I introduced

AI-assisted penetration testing

A black-box practice I introduced and turned into a service.

Black-boxBurp SuiteCVSS

Project 06 · Client cloud engineering

Racing-analytics platform

Cloud and full-stack engineering on an AWS CDK monorepo.

FastAPINeptuneAWS CDK

02 · Project 01

Secure SDLC program

Type
Internal platform
Status
Live, org-wide
Role
Designed, built, own

Level 1

Local, before commit

Level 2

Pull request

Level 3

Production push

The same security rules run at every gate.

$ secure-scan

One image. One command. Every scanner.

Developers pull one container image and run the full scan set before they commit, on any OS.

webhook → review bot

Every pull request gets a first pass.

A serverless bot runs the scanners in parallel, then posts an AI summary and one consolidated report on the pull request.

on push → security judge

Production is judged, reported and gated.

Parallel SAST, SCA and secret scans. An AI judge screens false positives, reports are versioned, Jira syncs, hard gates block.

Dashboard

Reports behind role-based access, with version history, PDF export and Jira integration.

Runners

Scanners run on ephemeral serverless runners with short-lived OIDC credentials, so there are no long-lived keys.

Outcome

From manual and inconsistent to automatic, uniform and auditable across the whole project estate.

02 · Project 02

Security reporting and PR automation

Type
Component tooling
Role
Architect and builder
GeminiPythonS3JiraTeams

Machine-first triage. Human judgment on top.

Judge agent

Classifies each finding as real or false positive before the report exists.

Reports

Branded HTML with severity charts and remediation, versioned in S3 and announced in Teams.

Jira sync

Findings deduplicated by fingerprint, severity mapped to priority, false-positive management built in.

PR bot

A change summary and review comments on every pull request.

02 · Project 04

Internal docs platform

Type
Knowledge base replacing Confluence
Role
Designed and built end to end
ReactTipTapNestJSMySQLS3Entra IDAmplify

A Confluence replacement, built end to end.

Editor

TipTap rich text with code blocks, tables, panels and inline images.

Structure

Spaces, page trees, roles and visibility, versioning with compare and revert.

Collaboration

Comments, mentions, notifications, full-text search, templates and attachments.

Identity and AI

Microsoft 365 SSO, Confluence migration tooling and a streaming AI writing assistant.

02 · Project 03

Real-estate portal

Type
Customer portal, full stack and AWS
Status
Pilot
Role
Full-stack engineer and AWS architect
NestJSNext.jsTypeScriptPostgreSQLCognitoCloudFrontWAFECS FargateRDSSQSKMS

The application and its production architecture, built by one engineer.

edge    CloudFront + WAF

api     API Gateway, JWT authorizer, VPC Link

compute internal ALB → ECS Fargate

data    RDS PostgreSQL

async   SQS → Lambda → SES, with DLQ

ci      GitHub OIDC, image scanning as a deploy gate

Application

TypeScript monorepo: NestJS API, Next.js portal, shared Zod contracts and a TypeORM data layer. Separate Cognito pools for customers and staff.

Why it matters

Edge to data tier, one owner, with cost and failure recovery in the architecture doc.

02 · Project 05

AI-assisted penetration testing

Type
Internal and client service
Role
Introduced the practice, built the pipeline, ran engagements
Black-boxBurp SuiteCVSSCloud reconIncident response

Test like an external adversary. Let AI accelerate the analysis. Screen everything before it is written up.

Method

AI assists with bundle analysis, payload generation and response-pattern recognition. Every finding is validated by hand, and negatives are documented as carefully as positives.

Scope

Web, API and cloud surface for fintech and healthcare clients. Incident response, including production database recovery.

Service

Deliverables with CVSS severities and a proof of concept per finding, a signed-scope pre-engagement flow, and a cost model.

Why it matters

I did not just run scans. I built the AI, reporting and scope engineering that made it a sellable practice.

02 · Project 06

Racing-analytics platform

Type
Client cloud and full-stack engineering
Role
Full-stack developer and cloud engineer
Next.jsFastAPILambdaFargateNeptunePostgreSQLOpenSearchAWS CDK

Graph and relational data, serverless APIs, batch ETL, all as code.

Stack

Next.js frontend, FastAPI on Lambda and API Gateway, batch ETL on Fargate, Neptune and PostgreSQL, OpenSearch, Cognito.

Practice

Infrastructure with AWS CDK, private packages, and a strict issue-to-review workflow. Described at capability level; client details withheld.

03

About

Security should be automatic, not a checklist.

  • CompTIA Security+ (SY0-701), 2024
  • BS Computer Science (Hons), Asia Pacific University, 2020 to 2024
  • Owner of my employer's Secure SDLC program
  • Introduced AI-assisted penetration testing as a service

I work in the high-leverage middle of the stack: build systems, CI/CD, serverless compute and the security gates on top of them.

Where I work, a developer can pull one image and run the same scans locally that run on every push and every review. I built that system and I own it.

I also ship. Production deployments on AWS and Azure across Next.js, NestJS, React, Node and PHP, plus full-stack products of my own.

I started as an information security intern at a bank, graduated in Computer Science and hold CompTIA Security+. I give company-wide talks on AI development and AI-assisted testing, because an engineer who can explain the work is worth more than one who cannot.

04

Experience

Timeline

2026 to present

DevSecOps and Platform Architect, Cinnova Technologies

Promoted to own the security and platform architecture: the Secure SDLC program, the AI pentest practice, cloud architecture on AWS and Azure, and the platform tooling teams ship on.

2024 to 2026

Associate DevSecOps Engineer, Cinnova Technologies

Built the Secure SDLC program from the first local scan container to the production pipeline. PR-review automation, AI-assisted SAST, security reporting, deployments, and full-stack products.

Jul to Sep 2022

Information Security Assurance Intern, MCB Bank

Risk assessments, vulnerability scans and penetration tests, with findings presented monthly.

2020 to 2024

BS Computer Science (Hons), Asia Pacific University

Kuala Lumpur. Projects in ML essay scoring, multi-threaded simulation and malware reverse engineering.

2017 to 2019

A-Levels in Computing, The City School

05

Capabilities

What I can own end to end.

Secure SDLC and AppSec

  • Local, PR and production security gates
  • Serverless scanning on Lambda, Step Functions and Fargate
  • SAST, SCA and secret scanning with SonarQube
  • AI report generation and false-positive screening

Deployments and cloud

  • AWS: Fargate, EC2, ALB, RDS with read replicas and multi-region, API Gateway, Lambda, CloudFront and WAF, Cognito, KMS
  • Azure: App Service, file shares, registry, managed MySQL
  • Docker, nginx, TLS, GitHub OIDC, rolling deploys

Full-stack development

  • TypeScript, React, Next.js, NestJS monorepos
  • Zod contracts, TypeORM and Prisma migrations
  • PostgreSQL row-level security, AWS architecture design

Security operations

  • Penetration testing, bug bounty, incident response
  • GitHub org audits and secrets management
  • Self-hosted SonarQube, Prometheus and Grafana, Wazuh SIEM, local LLMs

Communication

  • Company-wide talks on AI development and AI-assisted testing
  • Executive-friendly findings, never scan dumps

Languages and tools

  • TypeScript, Node, Python, PHP, Java, C, C++, Rust, Bash, SQL
  • Terraform, Docker, GitHub Actions, MongoDB, Neptune, OpenSearch
  • Prompt engineering, RAG, self-hosted LLMs

06 · Contact

Let's talk.

Open to DevSecOps, platform and cloud architecture work.

[email protected] LinkedIn GitHub