Kevin Reyes

I founded and, as the sole technical founder, developed Vulnerabbit, an automated offensive security SaaS platform that unifies DAST, Attack Surface Management (ASM), and Cloud Security Posture Management (CSPM) with an AI-powered Security Copilot.

The platform simulates real attacks 24/7 on cloud infrastructure (AWS, GCP, Azure), web applications, APIs, and Firebase databases, prioritizing vulnerabilities by real exploitability — not theoretical alerts — and generating personalized step-by-step remediation plans for each client.

I built specialized scanning agents in Golang (DNS, SSL, ports, subdomains) and a multi-agent system with LangChain and Python that coordinates scanning, triaging, and report generation. I developed a Security Copilot that leverages LLMs and semantic search on vector databases to provide contextualized remediation answers.

I designed the entire architecture from start to finish: client platform and backoffice in Next.js/TypeScript, APIs in Python/FastAPI, infrastructure as code in Azure with Pulumi, and MongoDB and vector databases. The platform helps startups and B2B SaaS companies continuously detect and fix vulnerabilities without relying on internal security teams.

I designed and developed AI chatbots with AWS Bedrock for security queries, regulatory compliance, and project due diligence. I performed threat modeling (STRIDE) and proactive vulnerability management, identifying risks and proposing mitigations. I developed internal tools to automate security and compliance checks, eliminating bottlenecks in the development cycle. I improved CI/CD pipelines in Jenkins and GitLab CI/CD by integrating automated security checks at each stage (SAST, dependency analysis, secret detection).

I led the cloud infrastructure and security team for the Arcos Dorados project (McDonald's Latam), establishing security practices and standards for the entire organization. I designed security architectures in AWS and GCP, and led the migration from Terraform to Pulumi with TypeScript. I built CircleCI pipelines to generate hardened AMIs according to NIST and CIS benchmarks. I analyzed pentest reports and led the response to SOC 2 Type II audits. I collaborated with development to containerize services and migrate them to the cloud, acting as a technical mentor in cybersecurity.