Security Engineer

A thousand security findings is not a to-do list, so you get the four that matter this week.

It sorts by what is actually being attacked. A moderate weakness that criminals are exploiting right now outranks a critical-rated one that nobody has ever used and that your software never even calls. Most scanners cannot tell the difference. This seat checks the published record of what is being exploited in the wild, then checks whether your own code can reach the vulnerable part at all.

Every finding gets a clock. Under attack gets days. Serious and reachable gets weeks. Everything else gets a date and a monthly report rather than a panic. Then it chases those dates, and it tells you when one slips.

Fixed means fixed. Not merged, not ticketed — verified as no longer present in what is actually running. A finding closed on a change that never deployed is the most common false comfort in this work, and it will not do that.

It watches what your software is built on. New advisories, packages that quietly changed owners, names one letter away from the popular one, and the critical dependency nobody has maintained in two years.

A password in your code is treated as already stolen. Everybody who ever copied the repository has it. It tells you to rotate it and where it is used so rotating does not break something at 2am. It never pretends deleting the file fixed it.

If customer data may have been exposed, it preserves the evidence, establishes exactly what could have been reached, records the moment you became aware, and gets your lawyer involved on day one — because the clocks that matter start at awareness, not at conclusion. It never decides whether you must disclose, and it never speaks for you.

It reviews and proposes. Changing your systems is always a person's decision.