Looking for a job

Paulo Roberto Brandão

@paulorobertobrando

Application Security Architect at Volvo Group who drove DevSecOps adoption across 1,009 products.

At Volvo Group, I define global Application Security standards and secure SDLC strategies, and helped drive a DevSecOps transformation that reached 1,009 products on DAST. I also engineered Phane, Python microservices that provision AppSec tool environments and enforce security controls.

I architected Armorcode ASPM as the organization-wide source of truth for vulnerability management and coordinated the Log4J incident response. I’ve also performed application security assessments and supported SOC forensics.

At Talabat, I performed threat modeling, security code audits, and web penetration testing, and architected a new Identity Provider. At Conta Azul, I structured information security around DevSecOps and redesigned the architecture with an API Gateway microservices pattern.

I co-founded ANDE Tecnologia / Ubíqua, where I built PCI-compliant embedded POS systems and delivered security testing and software projects for clients including Bradesco and Epay. Earlier, at SetInfo, I designed cryptographic channels for mobile credit purchases and developed bank credit-card backend features.

Experience

Work history, roles, and key accomplishments

Current

Principal Lead Application Security Architect

Current

Volvo Group

Dec 2021 - Present (4 years 11 months)

Defined global Application Security standards, governance, and secure SDLC strategies. Led the global DevSecOps initiative, evaluated security tools, and engineered Python microservices for security automation.

Security Architecture DevSecOps Penetration Testing Application Security Posture Management (ASPM)Python Terraform Azure OAuth OIDC SAML

Lead Application Security Architect

Volvo Group

Nov 2020 - Nov 2021 (1 year)

Drove a three-step transformation model for SAST/SCA/DAST with vulnerability management and mitigation. Led the global IFA Transformation project for web, infrastructure, and cloud risk assessment.

SAST SCA DAST Vulnerability Management ASVS MASVS Risk Assessment

Application Security Architect

Talabat

Jun 2020 - Oct 2020 (4 months)

Performed threat modeling, security code auditing, and web pentesting; hardened AWS and Kubernetes; architected the new Identity Provider; designed Security Champions and a gamified SETA program.

Threat Modeling Penetration Testing AWS Kubernetes Identity Providers Security Awareness

Senior Application Security Engineer

Volvo Group

May 2019 - May 2020 (1 year)

Introduced SonarQube (SAST) and Dependency Check (SCA) into teams' SDLC, supported vulnerability remediation and secure coding, and performed pre-release security reviews.

SAST SCA Secure Coding Vulnerability Remediation Security Reviews

CoFounder & Cyber Security Expert

ANDE Tecnologia / Ubíqua

May 2014 - May 2019 (5 years)

Built PCI-compliant embedded POS systems and applied-cryptography and financial-messaging protocols. Delivered application and infrastructure pentests, Java/Python apps, and DevSecOps / threat modeling mentoring.

PCI DSS Applied Cryptography Penetration Testing C Java Python REST APIs

Cyber Security Engineer

Conta Azul

Apr 2018 - Feb 2019 (10 months)

Structured the Information Security area with a DevSecOps approach, adding SAST and code review to CI/CD, hardening AWS, and authoring the Information Security Policy. Redesigned the architecture with an API Gateway microservices pattern.

DevSecOps SAST AWS API Gateway JWT WAF LGPD CIS

IT Innovation Team Leader

SetInfo

Nov 2011 - May 2014 (2 years 6 months)

Designed cryptographic secure channels for mobile credit purchase transactions and developed features in a bank's credit card back end. Built embedded POS systems.

Cryptography C Python Java J2EE Embedded Systems