{"name":"Andriy Zelenyuk","title":"Senior Product Security Engineer | DevSecOps","location":"Dallas, TX","summary":"Application security engineer with 13+ years across product security, secure SDLC, cloud security and connected-device security. Builds security programs that engineering teams actually adopt, integrates SAST/DAST/SCA into CI/CD, and automates vulnerability management, security monitoring and incident response with Python and TypeScript. Uses LLM tooling, MCP servers and AI coding agents to speed up triage and day-to-day security work.","availability":{"status":"available for contract work","mode":"remote (US Central time) or on site in the Dallas–Fort Worth area","engagement":"fixed price for scoped work, day rate for retainers, quoted after a 30-minute call","contact":["contact@a3sec.net","https://www.linkedin.com/in/andriyzelenyuk"]},"services":[{"name":"AppSec program setup","description":"SAST, DAST, SCA and secrets scanning wired into GitHub Actions, GitLab CI or Jenkins with triage engineers accept, policy-as-code guardrails and a 30-day rollout plan. Typical scope: two to four weeks."},{"name":"Security automation and incident response","description":"Vulnerability-management pipelines across Snyk, Tenable, Wiz, SonarQube and GitHub Advanced Security; alerting, runbooks and AI-assisted triage. Retainer or fixed scope."},{"name":"AI application and agent security review","description":"Prompt-injection, tool-permission and data-exfiltration testing of chatbots, RAG apps, agents and MCP servers (ShakerScan AI Gate), then hardening of permissions and confirmation flows. Typical scope: one week."},{"name":"Cloud security audit (AWS or GCP)","description":"Account and Terraform review against CIS benchmarks and least privilege; a prioritised findings report and, if wanted, the fixes applied in Terraform. Typical scope: one to two weeks, fixed price."},{"name":"Connected-device and mobile security assessment","description":"Threat model and hands-on testing of smart TV platforms, Android apps and other connected products, with a monitoring plan. Typical scope: two to three weeks."},{"name":"ShakerScan deployment and custom checks","description":"Self-hosted or Enterprise rollout, custom checks for your stack, and team training."}],"links":{"site":"https://www.a3sec.net","email":"contact@a3sec.net","linkedin":"https://www.linkedin.com/in/andriyzelenyuk","github":"https://github.com/andriyze","shakerscan":"https://shakerscan.com","pgp":"https://www.a3sec.net/publickey.contact@a3sec.net-fb31c67225207deaa16b73017b52504a49ba480a.asc","securityTxt":"https://www.a3sec.net/.well-known/security.txt","llms":"https://www.a3sec.net/llms.txt"},"skills":{"applicationSecurity":["Secure SDLC","threat modeling","vulnerability management","security assessments","code review"],"deviceMobileResponse":["Smart TV / embedded platform testing","Android application security","connected-device monitoring","incident response","digital forensics"],"securityTooling":["Snyk","Tenable","Nexpose (Rapid7)","Wiz","Orca","SonarQube","GitHub Advanced Security","Burp Suite Enterprise","Black Duck","Armis VIPR"],"cloudAndIaC":["AWS","GCP","Terraform","CIS benchmarks","infrastructure hardening"],"automation":["Python","TypeScript","GitHub Actions","Jenkins","GitLab CI","Docker","Bash"],"aiSecurity":["OpenAI Codex","Claude Code","prompt injection research","MCP servers","AI red teaming"],"frameworks":["OWASP Top 10","OWASP ASVS","BSIMM","SAMM","NIST"]},"experience":[{"title":"Senior Security Engineer","industry":"Smart TV & streaming","period":"2026-07 - present","location":"Dallas, TX","highlights":["Security monitoring for connected devices: smart TV platforms and companion Android apps","Threat modeling and security design reviews for TV platform and mobile features","Hands-on testing of smart TVs and Android apps, static and dynamic, with Burp Suite Enterprise","Automated vulnerability management and code scanning across Tenable, Nexpose, Wiz, SonarQube and GitHub Advanced Security","Incident response and forensics, AWS and GCP hardening, AI tooling for triage and detection engineering"]},{"title":"Senior Product Security Engineer","industry":"Energy sector","period":"2023-01 - 2026-03","location":"Tampa, FL","highlights":["Integrated Snyk, Tenable, Orca and Armis with CI/CD, cutting the critical vulnerability backlog by 60% in two quarters","Threat modeling sessions and security design reviews for new features","Policy-as-code guardrails for builds and Terraform plans, review cycle from over a day to under 30 minutes","AWS and GCP hardening with Terraform modules aligned to CIS benchmarks","Slack-native compliance bot for evidence collection; secure SDLC training on OWASP Top 10"]},{"title":"Senior DevSecOps Engineer","industry":"IoT devices","period":"2021-06 - 2022-12","location":"remote","highlights":["SonarQube Enterprise rollout end to end for 120+ engineers","Burp Suite Enterprise with pipeline hooks and DAST triage, scan coverage to 85%","Web, API, network and AWS assessments with Tenable and Scout Suite, fixed with IaC patches","Okta SAML and AWS Control Tower for multi-account operations"]},{"title":"Security Automation Engineer","industry":"Networking platform","period":"2020-04 - 2021-05","location":"Ottawa, ON","highlights":["Automated security requirements and Black Duck SCA in release workflows","Python security testing frameworks, release compliance from 40% to 90%"]},{"title":"QA & Test Automation Engineer","industry":"Medical software, IoT, enterprise software","period":"2013 - 2020","highlights":["Test automation frameworks (Selenium, Python, TypeScript)","Vulnerability assessments and internal penetration testing","CI/CD configuration and containerized testing"]}],"certifications":["OSCP (Offensive Security Certified Professional)","CEH (Certified Ethical Hacker)","ISTQB Certified Tester"],"education":["IT Step Academy, Computer Programming (Lviv, Ukraine), 2010-2011","Ternopil National Economic University, MS in Banking (Ukraine), 2003-2008"],"speaking":["Ukrainian IT Tampa Bay Meetup (2024): Current State of AI","OWASP Ottawa (2020): Buffer Overflows"],"projects":[{"name":"ShakerScan","url":"https://shakerscan.com","description":"Open-source (AGPL-3.0) security testing platform for web apps, APIs, AI systems and connected devices: deterministic DAST scans, an AI-assisted Hunt driven by your own coding agent, continuous attack-surface monitoring, AI Gate tests for chat, RAG, agent and MCP endpoints, model-artifact intake and device posture checks. Self-hosted in Docker with a web UI, REST API and CLI. AGPL-3.0; latest release v2.3.7 (September 2026); Enterprise edition adds SSO, roles, audit logging and offline licensing.","repository":"https://github.com/andriyze/shakerscan","license":"AGPL-3.0"},{"name":"SEC101","url":"https://sec101.a3sec.net/","description":"Interactive course on everyday cybersecurity basics (passwords, MFA, phishing, browser privacy, devices, safe tools, networking) for non-specialists, in Ukrainian."},{"name":"a3sec.net tools","url":"https://www.a3sec.net/tools/","description":"US & Canada salary/tax, mortgage and retirement calculators with standalone JS engines, URL prefill and an agent panel."}],"thisSiteDemonstrates":["Static site on S3 behind CloudFront with Origin Access Control: no public bucket, no website endpoint, all of it in Terraform.","Security headers and a strict CSP at the edge: no inline script on any page, scripts only from the site itself (plus cdnjs for the calculator charts).","A self-healing cost circuit breaker: one-minute CloudFront alarms, automatic restore, a budget scoped to the site's own services.","A public JSON API and MCP server on Lambda with input validation, rate limits, origin validation and tests.","Honeypot paths armed with Canarytokens, and a public traffic dashboard built from access logs that publishes aggregates only.","Everything readable without JavaScript and documented for agents in llms.txt."],"note":"Employer names are omitted on purpose; industries and periods are listed instead."}