Application Security Architect | DevSecOps | Security Automation
I help teams ship software that survives contact with attackers.
I work at the intersection of application security, DevSecOps, and automation, focusing on building security into delivery pipelines instead of stapling it on later.
- 🔐 Web & API Security Testing (manual + automated)
- ⚙️ DevSecOps pipelines (SAST, DAST, SCA, secrets scanning)
- 🧪 Security automation using Python, Bash, PowerShell
- 🧱 Secure SDLC design and architecture reviews
- 📚 Security training & awareness for engineering teams
Because stagnation is just technical debt with feelings.
-
🤖 AI for Application Security
Using GenAI for threat modeling, secure code review assistance, and security test generation -
🔍 Advanced API Security Testing
GraphQL, BOLA prevention, schema-driven testing, and abuse-case modeling -
🧰 Security Automation at Scale
Policy-as-code, custom security gates in CI/CD, and automated evidence generation -
🧠 Threat Modeling for Agile Teams
Lightweight, repeatable models that developers actually use -
🛡️ Cloud-Native Security Controls
Container hardening, secrets management, and runtime visibility
- AppSec: Burp Suite, OWASP ZAP, Semgrep, SonarQube
- DevSecOps: GitHub Actions, Azure DevOps, GitLab CI
- Containers: Docker, WSL, container security tooling
- Scripting: Python, Bash, PowerShell
- Frameworks: OWASP Top 10, ASVS, SAMM 2.0, PCI DSS
- Observability: Grafana, Loki, Promtail
- 🔎 Security testing scripts and automation
- 🤖 DevSecOps pipeline integrations
- 🧩 Proof-of-concepts for vulnerabilities and mitigations
- 📄 Labs, notes, and teaching material
Most repositories exist because doing things manually is a design failure.
Because numbers make people feel reassured.
### Badges
My GitHub Stats
Top Repositories
- Adjunct faculty teaching DevOps and cybersecurity
- Trainer for secure coding and application security
- Advocate for security that enables delivery instead of blocking it
- 💼 LinkedIn: https://linkedin.com/in/salmaankhwaja
- 🧠 Talks / Training: available on request
If you’re here to learn, borrow, or validate your security assumptions. You’re in the right place.