work / case
Security as a Discipline: AppSec to Estate Hardening
5+ years owning security for a RegTech group — came up through offensive security, built a repeatable pre-release security gate, and now own hardening across the whole platform as it grows.
Problem
A RegTech / KYC-compliance SaaS group was shipping customer-facing compliance products without a repeatable security gate in front of release. Security testing happened, when it happened, late and by hand — after design decisions were already set — so issues that should have been caught early were instead absorbed by whoever was closest at the time. For products whose entire value is regulatory trust, there was no standing practice that said a release had been threat-modelled and tested before it left the building, and no consistent way to record what was found or track it to closure.
Approach
I’ve owned security here from the day I joined — doing the work before it carried a title, then formally as a dedicated Cybersecurity Analyst, and now as part of platform engineering — building the discipline from the offensive side first rather than handing it off. Across 5+ years the aim stayed the same: make security a repeatable step in how things ship, not a periodic event:
- A repeatable web-application pentest workflow — a consistent methodology and an automated scanning stack applied to the customer-facing compliance products, run against builds before release rather than after, so findings landed while they were still cheap to fix.
- Reporting and remediation tracking around it — every assessment produced a structured report and findings that were tracked to closure, so security work was visible and auditable instead of living in someone’s head.
- Shift-left into the release process — folding that testing into the path to production so a release carried a known security posture by the time it went out.
- Estate-wide ownership in the current role — as Infrastructure Engineer I now own security across the stack: system hardening, vulnerability management, and web-application security testing, with the same offensive habits applied to the platform itself.
The toolchain is the standard offensive-security kit — OWASP ZAP, Burp Suite, Nuclei, Nessus, Metasploit — wired into an automated scanning stack so the routine work runs itself and the judgement goes where it matters.
Outcome
Security is now a standing discipline rather than a late checkpoint: issues are found and remediated before release, assessments are recorded and tracked, and hardening and vulnerability management are owned continuously across the whole estate as it grows. Because the same person threat-models and builds the infrastructure, security shows up in the design itself — RBAC and tenant isolation, careful secret handling, encryption at rest — instead of being bolted on afterwards. The lasting outcome is the rarer profile underneath all of it: an infrastructure engineer who came up through offensive security and threat-models a system before shipping it, not after something breaks.