📍 Bogotá / Cali, Colombia · 🌎 English (full professional) · Spanish (native) Open to AppSec · QA · Python Backend · DevSecOps roles
I'm a Software Engineer focused on application security, software quality, and secure Python backends. I currently lead QA and Application Security for a social-impact multiplayer game project at SENA, where I design and run OWASP Top 10 vulnerability assessments on REST APIs and client-server architectures, and turn the findings into prioritized, reproducible reports the development team can act on.
I build with security integrated from code to deployment — FastAPI, relational databases, Docker, CI/CD with GitHub Actions, and cloud (Azure & AWS) — and I also review and fix the bugs and risks left behind by careless use of AI-generated code.
- 🔐 Application Security: OWASP Top 10, vulnerability assessment, XSS, SQL/NoSQL injection, broken authentication, secure coding, risk assessment.
- 🧪 QA & Testing: test strategy & test plans, functional / regression / performance testing, bug reporting, technical documentation.
- 🐍 Python Backend: FastAPI, REST APIs, SQLModel / Pydantic, SQL & relational databases, software architecture patterns.
- ⚙️ DevSecOps & Cloud: Docker, CI/CD (GitHub Actions), Git, Linux / Bash, Microsoft Azure, AWS, Cloudflare.
- 🎮 Backend & Real-Time (C#/.NET): SignalR, WebSockets and Clean Architecture from my multiplayer game-infrastructure work.
| Project | What it shows | Stack |
|---|---|---|
| 🛡️ todo-api-fastapi | Security-hardened RESTful API built with Clean Architecture: OWASP SQL-injection mitigation, Pydantic input validation at the boundary, and a pytest test suite run in CI. | Python 3.12, FastAPI, SQLModel, pytest, Docker |
| 🧠 TinyLM | Local LLM inference microservice on hardened multi-stage Alpine containers (≤ 2 GB RAM) with a minimal attack surface and OpenAI-compatible REST endpoints. | Python, FastAPI, Docker Hardening, REST |
| 🎮 Unity2DBackend | Real-time .NET 9 + SignalR backend for Unity 2D multiplayer games: spatial rooms, presence, EF Core, Redis backplane and full containerization. | C#, .NET 9, SignalR, Redis, Docker |
| 🔌 WebSocketServer | Low-latency, high-concurrency C# WebSocket engine for continuous event streaming and distributed backend services. | C#, .NET, WebSockets, Async |
| 🧮 Algorithms | High-performance sorting algorithms & data structures with strict generic constraints, xUnit suites and BenchmarkDotNet memory profiling. | C#, .NET 10, xUnit, BenchmarkDotNet |
| 🌐 portfolio | Modular SPA portfolio with a fully decoupled JSON data layer, bilingual content and automated GitHub Pages deployment. | Vite, JavaScript, Tailwind CSS, GitHub Actions |
🗂️ More security assessments, QA evidence and DevSecOps notes live in my live portfolio & progress log.
- Shift left: security and tests are built in from the first commit, not bolted on at the end.
- Threat-model first: I map features to OWASP Top 10 risks before writing a single test case.
- Evidence over opinions: every finding ships with severity, step-by-step reproduction, impact and a concrete mitigation.
- Verify the fix: regression testing confirms each finding is closed without breaking the product.
- Document everything: test plans, risk reports and runbooks the team can reuse.
| Role | Company | Period |
|---|---|---|
| Lead QA & Application Security Engineer | Servicio Nacional de Aprendizaje (SENA) | 2026 – Present |
| IT Support & Network Infrastructure | Hotel Derroches | 2021 – 2024 |
| Programming & Web Security Instructor | Compusistemas | 2022 |
What I did (highlights)
- SENA — Designed and ran vulnerability assessments (OWASP Top 10) on web game components, APIs and client-server architectures; led the end-to-end QA lifecycle of a social-impact game project and delivered actionable bug & risk reports.
- Hotel Derroches — Kept a stable, secure infrastructure (network configuration & segmentation, endpoint protection) and built custom inventory-management software.
- Compusistemas — Trained groups of 20+ students on the SDLC and secure coding, and developed a hands-on web-security module covering common vulnerabilities and their mitigation.
- 🎓 B.S. in Systems Engineering — Universidad Autónoma de Occidente (in progress, 2021 – 2027)
- 🎮 Game Development Technologist — SENA (in progress, 2024 – 2027)
- 🛡️ Google Cybersecurity Professional Certificate — Google
- 🐍 Backend Developer Specialist — Oracle + Alura Latam
- 📊 Data Science — MatsuoLab, The University of Tokyo
