// cat ./projects/gitlab-devsecops.md
Hardened GitLab DevSecOps Platform
Secure CI/CD with Terraform, tfsec, Trivy, SonarQube
End-to-end hardened GitLab platform — autoscaling immutable runners, EBS persistence, RDS-backed metadata, and CI gates that block insecure Terraform, vulnerable images, and leaked secrets before merge.
## Problem
Off-the-shelf GitLab runners and pipelines ship without the guardrails enterprises need. Insecure Terraform, vulnerable base images, and committed secrets slip into production unless the platform enforces the contract.
## Platform
Autoscaling immutable GitLab runners on AWS with EBS-backed caches and RDS-backed GitLab metadata. Pipelines are templated and centrally governed; project pipelines extend the template rather than redefine it.
## Security Gates
tfsec validates every Terraform plan, Trivy scans container images, detect-secrets blocks credential leaks, and SonarQube enforces code quality and security smells. Failing gates block merge — no override path without security review.
## Outcome
Drift prevention at the IaC layer, vulnerable images caught before deployment, and a reusable platform pattern that small teams can adopt without a dedicated platform group.
// ls ../
FLAGSHIP
Snock →
Autonomous Cloud Security AI Agent
RESEARCH
SpecterHeal →
AI-Assisted Self-Healing Infrastructure
PRODUCTION
Enterprise DDoS Defense →
AWS Shield Advanced & Firewall Manager Automation
ENGAGEMENT
Trend Micro XDR Remediation →
Enterprise Endpoint Detection & Response Tuning
PRODUCTION
AWS Incident Response Automation →
Event-Driven Containment with Lambda + CloudWatch
PRODUCTION
SOC Automation & Visualization →
TheHive + Elasticsearch + Grafana + n8n
PRODUCTION
Fortinet SD-WAN Deployment →
Resilient Multi-Site Connectivity
INTERNAL
CTF Training Platform →
Practical Cybersecurity Training Lab
PRODUCTION
Cloud Monitoring & Observability Platform →
Terraform, ECS Fargate, cross-account CloudWatch
DELIVERED
CIS Benchmark & Remediation Program →
Measured posture improvement across a DevOps platform
DELIVERED
Open Banking Auth Flow Load Testing →
k6, mTLS, FAPI/OAuth2 with PAR, browser-driven SCA