How I work
Design with the attacker in mind
Years in the cyber security field, with experience including penetration testing, handling security incidents and fixing security bugs, taught me how systems are attacked and shaped how I think about my designs.
Ship fast, safely
A short release cycle backed by solid test coverage, instead of manual testing, is what lets a company react when a new vulnerability appears.
Never drop below the baseline
The goal is that nothing falls below a baseline. I architect, design and build standard tooling that continuously improves that baseline across the whole surface.
Find the balance
An organization's products and services can't make money if the software supporting them isn't reliable and secure. The software can't be reliable and secure if the development of its security and reliability isn't funded by the revenue of those products and services. Over-prioritizing either one is no good. Finding the balance is key.
Make quality visible
Delivery of a product doesn't end with deployment. Detailed monitoring, meaningful alerting and the processes built around them are a necessary condition for any design's production readiness. A fast feedback loop shows early whether what was shipped is good, and what to improve next.
Work with people
I respect the people I work with, listen to them, and understand what they are trying to achieve. That earns trust, and trust is what turns separate goals into shared ones. I speak business, cyber security and software development, and I translate between them.
Skills
- Languages
- Production code in Python, Kotlin, TypeScript and Go
- Security architecture
- Threat modeling (STRIDE, PASTA, MITRE ATT&CK, OCTAVE), C4 model, OWASP, NIST SP 800-160, ISO 27001:2022 Annex A, risk management
- Identity and access
- SAML, OAuth 2.0, JWT, Kerberos; RBAC, ABAC, ReBAC; PAM
- Cryptography and PKI
- X.509, KMS, HSM, secrets management; AES, RSA, ECC, HMAC
- Platform, delivery and observability
- AWS, Azure, Docker, Kubernetes, Terraform; GitLab CI, GitHub Actions; Datadog, Sentry, Elasticsearch
- Assessment
- Web and mobile penetration testing, secure code review; Burp Suite, ZAP, Metasploit, Snyk, Semgrep, Aqua Security
Education and certification
- ISC2 CISSP
- Master's degree (Ing.), University of Economics in Prague