about
Vitor Sienna
Security Operations Lead · DevSecOps, AppSec and Blue Team
Security operations leader with a background in AppSec and DevSecOps: WAF and L7 defense, incident detection and response, SAST, DAST and SCA in CI/CD pipelines. This site is my public study notebook and portfolio: an interactive map that shows what each check does, where it fits in the pipeline and how the pieces connect.
Brasília, Brazil Portuguese (native) · English (fluent)
- DevSecOps
- AppSec
- WAF
- SAST
- DAST
- SCA
- CI/CD
- Cloud Security
- Blue Team
- Automação
experience
CloudWalk · Security Operations Lead and Security Engineerfev/2025 – hoje
SOC leadership, L7 defense, edge and application telemetry, incident response and post-mortem with hardening.
BB Tecnologia e Serviços · Application Security Engineer (Senior)jan/2024 – fev/2025
DevSecOps strategy, Azure DevOps pipelines with Defender, security training and workshops.
NOVA8 · Application Security Engineerjun/2023 – fev/2024
Code analysis, vulnerability management, secure development and security automation.
Every Cybersecurity and GRC Solutions · Technology Analystmai/2021 – jun/2023
GRC and security automations and integrations in Python and NodeJS, serving large enterprise clients.
Vert Integradora de TI · Technical Supportjan/2019 – jan/2021
Linux and Windows servers, automation scripts (Python, Ansible, PowerShell).
education
Postgraduate degree in offensive cybersecurity · Acadi-TI2022 – 2024
Systems Analysis and Development (CST) · UniCEUB2016 – 2018
certifications
Microsoft Certified: Azure AI Engineer Associate
Microsoft · issued Nov 2024, expired Nov 2025
CSAE · Certified Security Architecture Expert
Acadi-TI · May 2023
CNSE · Certified Network Security Expert
Acadi-TI · 2022
why this project exists
Security tools are usually presented in isolation: SAST here, SCA there, IAM somewhere else. What is missing is the map: where each control fits, what it covers, what it lets through and how the pieces complete each other.
That is why each domain is a navigable graph, with study paths, attack scenarios that show the layers in action and quizzes to make it stick. It is a more visual way to learn and, at the same time, a sample of how the project was designed and built.
technical behind the scenes
Minimal surface
A 100% static site: no backend, database, forms or cookies. A restrictive CSP and the other headers are versioned in the repository.
Content validated at build
A validator runs before the build and fails if a topic loses its place on the map, a quiz is incomplete or a path points to a topic that does not exist.
Performance budget
The build fails if the bundle size goes over its limits. Client JS was reduced by keeping topic content on the server and loading quizzes and search on demand.
Accessibility and motion
Keyboard navigation on the map, screen-reader labels, visible focus and respect for prefers-reduced-motion.
Privacy by default
No tracking. The only data kept is your study progress, in the learner's own browser, and it can be erased whenever you want.
Translations without drift
English is the source of truth. Every translation stores a hash of the text it came from, so when the original changes the translation is flagged and the build fails until it is updated.
The full checklist, with the real CSP and trade-offs, is at /security.
about the content
Found an error or an inaccuracy? Let me know on LinkedIn: I will fix it and log it in the changelog.
Changes and corrections are recorded in /changelog.
Shall we talk?
If this map was useful, or if you want to talk about software security, the best way to reach me is LinkedIn.
open my LinkedIn