Application security engineer

Classic single-column layout highlighting AppSec programs, SDL, and vuln management.

No photoclassicsecurity-tech

Alex Rivera

Application Security Engineer

alex.rivera@email.com+44 7700 900123Manchester, UKlinkedin.com/in/alexrivera

Summary

Application security engineer with 6+ years finding and fixing vulnerabilities in web platforms and APIs. Comfortable partnering with product and platform teams to ship secure code without slowing delivery.

Skills

Burp Suite
OWASP ASVS
Python
threat modeling
secure code review
CI/CD security
AWS
Kubernetes

Certifications

OSWE (Offensive Security Web Expert)Offensive Security
2023

Experience

Senior Application Security EngineerNorthwind Security
Remote · EU
2021 – Present
- Led web and API assessments for customer-facing products; reduced critical findings by 40% YoY.
- Built secure SDLC gates in CI (SAST/DAST) and threat modeling for new features.
- Mentored engineers on OWASP ASVS and bug bounty triage.
Penetration TesterHelix Consulting
London, UK
2018 – 2021
- Delivered external and internal assessments for finance and SaaS clients.
- Authored reproducible reports with clear remediation paths for engineering teams.

Projects

Secure SDLC checklist (internal)
Python, GitHub Actions, Semgrep
- Maintained ASVS-aligned gates and dashboards for 12 product teams.

Education

BSc Computer ScienceUniversity of Manchester
2018
Focus: systems security, cryptography

Use this template

More templates

Jordan Klein

Penetration Tester · OSCP

Summary

Penetration tester focused on web, cloud, and identity systems. Experienced writing clear reports for both leadership and engineering, with a track record of retests that close critical issues quickly.

Certifications

OSCPOffensive Security
2019

Experience

Senior Penetration TesterRedline Assurance
Berlin, Germany
2020 – Present
- Lead external and internal assessments for fintech and health-tech clients under strict scope rules.
- Developed reusable attack chains for OAuth/OIDC and multi-tenant SaaS; findings drove product security roadmap.
- Delivered executive summaries and engineer-ready remediation notes within 48 hours of test close.
Security ConsultantCipherpath GmbH
Remote · DACH
2017 – 2020
- Performed network, web, and mobile assessments; maintained 98% on-time delivery across 40+ engagements.
- Built lightweight reporting templates adopted firm-wide for consistency and faster client sign-off.

Education

MSc Information SecurityTU Munich
2017
Thesis: practical exploitation of misconfigured cloud IAM

Featured

Penetration tester

Use this template

James Okoro

Director of Information Security · CISSP

j.okoro@email.com+1 206 555 0110Seattle, WAlinkedin.com/in/jamesokoro-ciso

Summary

Security leader with 15+ years building programs that scale with product growth — balancing risk, compliance, and engineering velocity. Track record of board-ready metrics, budget stewardship, and hiring diverse security teams.

Skills

Program management
GRC
AppSec
cloud security
budget & vendor management
SOC 2/ISO 27001
incident response
executive communication
hiring & mentoring
M&A security diligence

Experience

Director of Information SecurityBrightpath SaaS
Seattle, WA · Hybrid
2019 – Present
- Scaled security program from 12 to 45 FTE; established product security, GRC, and MDR partnerships.
- Owned $4.2M annual budget; delivered SOC 2 and ISO 27001 with zero major findings in last cycle.
- Partnered with CTO and sales on enterprise deals; reduced security questionnaire turnaround by 50%.
Head of Security EngineeringCascade Payments
Portland, OR
2014 – 2019
- Built AppSec and cloud security functions; introduced bug bounty and tabletop exercises for leadership.
- Led incident response for payment processing outage; improved MTTR and customer comms playbooks.

Education

MBA · Technology ManagementUniversity of Washington Foster School
2014
BS Computer Engineering, Oregon State University · 2008

Certifications

CISSP(ISC)²
2016

Awards & honors

Security leadership awardPacific Northwest CISO Forum
2023
Recognized for cross-functional security culture programs and measurable risk reduction.

Featured

Security leadership

Use this template

Jordan Klein

Penetration Tester · OSCP

Summary

Certifications

OSCPOffensive Security
2019

Experience

Senior Penetration TesterRedline Assurance
Berlin, Germany
2020 – Present
- Lead external and internal assessments for fintech and health-tech clients under strict scope rules.
- Developed reusable attack chains for OAuth/OIDC and multi-tenant SaaS; findings drove product security roadmap.
- Delivered executive summaries and engineer-ready remediation notes within 48 hours of test close.
Security ConsultantCipherpath GmbH
Remote · DACH
2017 – 2020
- Performed network, web, and mobile assessments; maintained 98% on-time delivery across 40+ engagements.
- Built lightweight reporting templates adopted firm-wide for consistency and faster client sign-off.

Education

MSc Information SecurityTU Munich
2017
Thesis: practical exploitation of misconfigured cloud IAM

Featured

Pentest portrait sidebar

Use this template

Morgan Lee

SOC Analyst · Security+

morgan.lee@email.com
(512) 555-0182
Austin, TX
linkedin.com/in/morganlee-soc

Summary

SOC analyst with hands-on experience in alert triage, log analysis, and incident documentation. Calm under pressure and focused on accurate escalation and clear handoffs to IR and engineering.

Skills

Splunk · Microsoft Sentinel · CrowdStrike · phishing analysis · MITRE ATT&CK · Wireshark · ticketing · runbooks · Python basics

Experience

SOC Analyst IISummit Defense MDR
Austin, TX
2022 – Present
- Triage 200+ alerts weekly across EDR, SIEM, and email security; escalate true positives with full timeline context.
- Authored detection rules for impossible travel and suspicious PowerShell; reduced noise by 25%.
- Coordinated containment with IT during ransomware scare; restored operations within SLA.
IT Support SpecialistLakeside Credit Union
Round Rock, TX
2019 – 2022
- First-line support for 800 endpoints; documented runbooks for VPN and MFA rollout.
- Volunteered for after-hours incident bridge during phishing campaigns.

Education

Associate of Applied Science · CybersecurityAustin Community College
2019
Security+ prep track; capstone: SIEM lab with Splunk

Certifications

CompTIA Security+CompTIA
2022

SOC analyst

Use this template

Samira Okonkwo

Software Engineer · TypeScript / Node

samira.okonkwo@email.com+1 416 555 0144Toronto, ONgithub.com/sokonkwo

Summary

Full-stack engineer who ships reliable web products and treats security as part of everyday development — input validation, least privilege, and sensible logging — not a late-stage audit.

Experience

Software Engineer IITrailmap Analytics
Toronto, ON · Hybrid
2021 – Present
- Shipped customer dashboards in React and Node; cut page load time 35% via query tuning and caching.
- Partnered with security on SSRF and auth fixes; added dependency scanning to CI.
- On-call rotation for production API; maintained 99.9% uptime over 12 months.
Junior DeveloperOpenStreet Labs (contract)
Remote
2019 – 2021
- Built internal tooling in TypeScript for data QA pipelines.
- Contributed security fixes to open-source geospatial libraries.

Projects

Trailmap customer dashboard
React, Node, PostgreSQL · github.com/sokonkwo/trailmap-ui
- Feature flags, role-based views, and audit-friendly activity logging.

Education

BEng Software EngineeringUniversity of Waterloo
2019
Co-op terms in SaaS and infrastructure teams

Software engineer (secure SDLC)

Use this template

Taylor Nguyen

Computer Science Student · Security track

t.nguyen@student.edu(951) 555-0177Riverside, CAlinkedin.com/in/taylornguyen-cs

Summary

Junior pursuing computer science with hands-on lab work, a municipal security internship, and active participation in campus cyber club and CTF events. Seeking entry-level SOC, IT security, or junior engineering roles.

Skills

Linux
Python
Wireshark
Nmap
Git
HTML/CSS
Java
technical writing
teamwork
TryHackMe
Hack The Box (beginner)

Education

BSc Computer Science (expected 2026)California State University
2026
Relevant: network security, algorithms, operating systems · Dean’s list

Projects

Campus cyber club CTF toolkit
Linux, Python, Docker
- Documented lab images and write-ups for weekly beginner-friendly challenges.

Experience

Cybersecurity InternCity of Riverside IT
Riverside, CA
Jun 2025 – Aug 2025
- Assisted vulnerability scanning and asset inventory for municipal web properties under supervisor scope.
- Drafted user-facing phishing awareness tips published on the intranet.
- Shadowed SOC shifts and documented alert triage steps in a shared wiki.
Teaching Assistant · Intro to NetworkingState University CS Department
Riverside, CA
Jan 2025 – May 2025
- Held office hours and graded labs on TCP/IP, DNS, and basic Linux administration.
- Ran a capture-the-flag review session for 40 students.

Volunteer

Cyber club memberCSU Cybersecurity Club
2024 – Present
- Organize monthly CTF nights and mentor first-year students on Linux basics.

Student & intern

Use this template

Summary

Red team operator specializing in adversary simulation, identity attack paths, and collaborative purple-team exercises. Comfortable briefing executives and pairing with detection engineers on meaningful improvements.

Certifications

OSEPOffensive Security
2022

Projects

Purple-team detection lab
Caldera, Elastic, MITRE ATT&CK
- Documented TTP chains and mapped expected detections for customer purple-team workshops.

Experience

Senior Red Team OperatorObsidian Offensive Security
Remote · US
2021 – Present
- Plan and execute adversary simulations against enterprise AD, cloud, and SaaS identity stacks.
- Develop custom C2 tradecraft and phishing pretexts aligned to customer threat models.
- Purple-team with blue staff; translate findings into detection opportunities and control gaps.
Penetration TesterVector Assurance
Denver, CO
2017 – 2021
- External and internal assessments for energy and tech clients; maintained clean scope and ROE documentation.
- Built reusable payloads and reporting snippets for red-team handoffs to client IR teams.

Education

BSc CybersecurityUniversity of Colorado Boulder
2017
Focus: offensive security, network forensics

Red team operator

Use this template

Priya Deshmukh

GRC & Compliance · CISA

priya.deshmukh@email.com(312) 555-0164Chicago, ILlinkedin.com/in/priyadeshmukh-grc

Summary

GRC professional with 8+ years running audit programs, control frameworks, and policy ownership for regulated healthcare and financial services. Clear communicator between auditors, legal, and engineering on evidence and remediation.

Skills

SOC 2
ISO 27001
NIST CSF
HITRUST
risk assessments
policy drafting
vendor due diligence
ServiceNow GRC
Archer
audit evidence
SOX ITGC basics

Experience

Senior GRC AnalystMeridian Health Systems
Chicago, IL · Hybrid
2020 – Present
- Own SOC 2 Type II and HITRUST audit cycles; coordinate evidence collection across 18 control owners.
- Mapped policies to NIST CSF and ISO 27001; reduced audit findings by 30% over two cycles.
- Facilitated risk assessments for new SaaS vendors and tracked remediation in GRC platform.
IT Compliance SpecialistGreat Lakes Mutual Insurance
Milwaukee, WI
2016 – 2020
- Maintained policy library (acceptable use, data classification, incident response) with legal and HR review.
- Supported internal audits and external regulator inquiries with traceable control narratives.
- Implemented access review workflows for privileged accounts and third-party integrations.

Education

BS Management Information SystemsUniversity of Wisconsin–Milwaukee
2016
Coursework: risk management, business law, systems analysis

Certifications

CISAISACA
2021
CRISCISACA
2023

GRC & compliance

Use this template

Swipe for more · 1/8