Bakhtiyar Abdurassulov

AppSec & DevSecOps Engineer

Integrated security checks into GitLab CI/CD pipelines to help engineering teams detect vulnerabilities earlier in the development lifecycle. Configured SAST, SCA, DAST, secrets scanning, dependency scanning, container scanning, and IaC validation workflows using Semgrep, Gitleaks, Trivy, OWASP Dependency-Check, Sonatype Lifecycle, and Checkov. Implemented severity-based security gates for High and Critical findings and leaked secrets, reducing the risk of unsafe code reaching merge or deployment stages. Improved vulnerability review by triaging scanner results, separating real issues from false positives, and preparing developer-friendly remediation guidance. Standardized security report publishing through CI artifacts and reusable pipeline patterns, making security checks repeatable across repositories. Added Trivy checks for Docker images and Kubernetes manifests, improving visibility into container and cloud-native security risks. Supported secure SDLC workflows through automated scanning, developer feedback, and risk-based prioritization.

• Integrated security checks into GitLab CI/CD pipelines to help engineering teams detect vulnerabilities earlier in the development lifecycle.
• Configured SAST, SCA, DAST, secrets scanning, dependency scanning, container scanning, and IaC validation workflows using Semgrep, Gitleaks, Trivy, OWASP Dependency-Check, Sonatype Lifecycle, and Checkov.
• Implemented severity-based security gates for High and Critical findings and leaked secrets, reducing the risk of unsafe code reaching merge or deployment stages.
• Improved vulnerability review by triaging scanner results, separating real issues from false positives, and preparing developer-friendly remediation guidance.
• Standardized security report publishing through CI artifacts and reusable pipeline patterns, making security checks repeatable across repositories.
• Added Trivy checks for Docker images and Kubernetes manifests, improving visibility into container and cloud-native security risks.
• Supported secure SDLC workflows through automated scanning, developer feedback, and risk-based prioritization.

System Administrator

Administered Linux-based servers and internal IT systems, supporting stable corporate infrastructure and daily operations. Managed user accounts, access permissions, workstations, and internal services with focus on availability, reliability, and fast incident resolution. Resolved hardware, software, network, and Linux server-related issues; worked with system configuration, basic service monitoring, troubleshooting, and access control. Built a strong foundation for later DevSecOps work, including Linux administration, automation, CI/CD environments, and secure infrastructure practices.

• Administered Linux-based servers and internal IT systems, supporting stable corporate infrastructure and daily operations.
• Managed user accounts, access permissions, workstations, and internal services with focus on availability, reliability, and fast incident resolution.
• Resolved hardware, software, network, and Linux server-related issues; worked with system configuration, basic service monitoring, troubleshooting, and access control.
• Built a strong foundation for later DevSecOps work, including Linux administration, automation, CI/CD environments, and secure infrastructure practices.

Technical Content Specialist

Reviewed and improved technical materials for clarity, logical consistency, terminology accuracy, and client requirements. Prepared structured documentation and reports, strengthening technical writing, analytical thinking, and clear communication skills later applied to developer-focused security remediation guidance.

• Reviewed and improved technical materials for clarity, logical consistency, terminology accuracy, and client requirements.
• Prepared structured documentation and reports, strengthening technical writing, analytical thinking, and clear communication skills later applied to developer-focused security remediation guidance.