Saad Benbouzid

- Coaching and training in cybersecurity for development teams

- Security audit on a set of web and desktop applications (Java)

- Integration chain audit

- Documentation and implementation of improvement solutions

- Analysis and implementation of procedures and tools for continuous vulnerability detection

- Continuous review of code and practices for alignment with security standards and norms (ISO, IEC 62304, GDPR, ...).

- Transverse TechLead and DevSecOps for 7 Scrum squads

> Design of application architecture in response to functional and non-functional needs and requirements (security, performance, traceability, RESTful and code-first conventions, choice of exchange types between synchronous or asynchronous event-driven communications).

> Construction of the technical backlog: descriptions, estimations, tracking.

> Transverse tech lead referent across squads for monitoring DevSecOps and development standards and best practices (including release management and ALM).

> Administration of Github Enterprise (permissions, environments, secrets, etc.) and CI/CD pipelines (jobs, steps, actions).

> Monitoring and tracking for support assistance: end-to-end logging and metrics (Datadog, Splunk).

> Responsible for security requests to the IAM team (REST access matrix by scopes), and for specific IP:port opening/closing requests for external resources (vLAN, Datacenter).

> Leading sprint and PI reviews (demos).

> Development of high-availability, high-volume periodic batch jobs (partitioning, error recovery, etc.) with Spring Batch.

> Development of the webclient security layer and controllers for securing http exchanges (OIDC Okta, AWS/EKS service accounts, JWT token generation and validation, etc.).

> Development of integration tests and end-to-end microservice tests using minikube mocks and mountebank.

> Maintenance and monitoring of Sonarqube profiles and quality gates with company policies.

> Ensuring compliance with infrastructure management policies, standards, and procedures.

TECHNOLOGICAL ENVIRONMENT

Java 11/17, Spring Framework (boot, webflux/reactor, batch, jdbc, tx, aop), Maven, RESTful, OpenAPI, AWS, Kubernetes, Minikube, Docker, EKS (Istio), Vault, Okta, IBM MQ, SQS, Kafka, Github Enterprise, Bitbucket, JIRA, Nexus, Nexus IQ, Veracode, Snyk, Sonarqube, Datadog, Splunk, SAFe/Scrum (7 squads)

> Point of contact and referent for the migration of a set of 6 Oracle Forms applications to an Angular / Java JEE technical stack.

> Fullstack Architect (frontend – backend – DevSecOps): implementation of development foundations (repositories, modules, microservices breakdown, coding conventions, data models).

> Automation of backend REST and frontend exchange model generation via swagger-codegen for java/Spring and typescript/Angular.

> Point of contact between the development team and the project manager, and the infrastructure and security managers.

> Creation of technical documentation and architecture files.

> Risk assessment and feasibility studies. Application audit (modularity, dependencies, security, performance, coding conventions and best practices, etc.).

> Extraction, development, support, and maintenance of common UI/Angular elements within a core npm library, as well as common java webapp elements within a core jar library to factorize, facilitate maintenance, and reduce duplication risks.

> Training developers on all new tools and components (spring, REST, Angular, docker, etc.) through dedicated masterclass tutoring sessions.

> Creation and implementation of new DevSecOps chains in line with company constraints (network traffic, mandated orchestration tools and software, externalization and storage of secrets, AD/LDAP authorizations for applications, etc.).

> Configuration of environments and servers (shell, RedHat, etc.).

> Support and tech-lead/team-lead for Scrum rituals, agility, and development (agile coaching).

TECHNOLOGICAL ENVIRONMENT

Java 11, Angular 12, Spring Framework (boot, web, data), RESTFul, Node, Webpack, Karma, Jasmine, Maven, Nexus, Bitbucket, Bamboo, Docker, XL Deploy, keycloak, Splunk, Sonarqube, AppDynamics, Redhat/Linux