Open to opportunities

Vasco Martins

@vascomartins

Message

I secure banking applications through DevSecOps, vulnerability management, and coordinated offensive security testing.

Portugal

Message

What I'm looking for

I'm open to opportunities in Portugal or abroad where I can deepen hands-on penetration testing and red teaming skills while applying my application security, DevSecOps and vulnerability management experience.

I coordinate security assessments at Caixa Geral de Depósitos, one of Portugal's largest banks, spanning web, mobile, infrastructure, network, Active Directory, PCI-DSS, DDoS, WiFi, TIBER and purple team engagements.

I validate more than 100 remediation retests each year, manage SAST, DAST and SCA across over 100 projects, and help development teams shift security left by integrating automated scans into CI/CD pipelines. I also support DORA TLPT and TIBER-EU red-team engagements through planning, documentation, execution oversight and coordination across providers, branches and internal teams.

Previously at Redshift Consulting, I onboarded more than 50 client projects to Checkmarx, built GitHub Actions SAST integrations and PowerShell automation, and supported threat modeling and secure SDLC adoption. I'm building hands-on offensive security skills toward PNPT and penetration testing, alongside developing an AI-supported multi-agent vulnerability research system.

Experience

Work history, roles, and key accomplishments

Current

Analista de segurança

Current

Caixa Geral de Depósitos

Sep 2023 - Present (2 years 11 months)

- Coordination of security assessments delivered by external vendors, including blind tests, penetration testing of web and mobile applications, infrastructure, networks and Active Directory, TIBER exercises, PCI-DSS, DDoS, WiFi and purple team engagements, around 40 tests per two-year contract cycle
- Alignment of scope and scheduling between the bank's branches and the external testing teams, an

SAST DAST SCA Penetration Testing TIBER Purple Team PCI DSS CVSS Vulnerability Management DevSecOps CI CD Secure SDLC Active Directory

CyberSecurity Consultant

Redshift Consulting

Oct 2020 - Jul 2023 (2 years 9 months)

- Application security consulting focused on Checkmarx (SAST and SCA/OSA)
- Onboarding of more than 50 client projects onto the Checkmarx platform, including configuration, threat modeling and integration into the client's secure SDLC
- SAST pipeline integration into CI/CD environments using GitHub Actions, following a DevSecOps approach
- PowerShell tooling development for security process automa

Checkmarx SAST SCA GitHub Actions PowerShell DevSecOps CI CD Threat Modeling

Estagiário

Redshift Consulting

Jun 2020 - Sep 2020 (3 months)

Internship at Redshift Consulting.

Estagiário

Câmara Municipal de Alcácer do Sal

Apr 2017 - Nov 2018 (1 year 7 months)

Internship at Câmara Municipal de Alcácer do Sal.

Education

Degrees, certifications, and relevant coursework

Ipluso - Instituto Politécnico da Lusofonia

Licenciatura, Engenharia Informática e Aplicações

2022 - 2026

BSc with a focus on software development and cybersecurity. Final project on educational tooling for offensive security. Completed while working full time.

ATEC - Academia de Formação

Técnico Especialista de Cibersegurança, Guerra Cibernética

2019 - 2020

Formação técnica em cibersegurança: análise de vulnerabilidades, ciberdefesa, redes, sistemas operativos e fundamentos de programação aplicada à segurança.