Rodrigo Diez Alonso

Security Engineer - Product Security, Application Security & DevSecOps

Madrid, ES.

About

DevSecOps Cybersecurity Engineer with 5+ years of experience specializing in Product Security, Application Security, and AWS within SaaS environments. Proven expertise in integrating security automation into CI/CD pipelines, managing comprehensive vulnerability programs, and defining AppSec standards to foster secure software development. Adept at scaling security initiatives across large-scale systems and driving compliance with key industry standards.

Work

RatedPower

|

DevSecOps Cybersecurity Engineer

Madrid, Madrid, Spain

→

Summary

Currently leads DevSecOps and Application Security initiatives at a SaaS product company, overseeing vulnerability management and integrating security automation into CI/CD pipelines to enhance secure software development.

Highlights

Led DevSecOps and Application Security initiatives within a dynamic SaaS product environment, ensuring a robust and secure software development lifecycle (SDLC).

Owned and optimized the application security vulnerability management process, driving timely remediation and risk mitigation across product and development teams.

Architected and deployed a reusable GitHub Actions workflow, integrating Snyk SAST, SCA, and container scanning using the Snyk CLI, scaling security coverage to over 1,000 repositories.

Implemented automated security gates, PR checks, and automated vulnerability reporting within CI/CD pipelines, significantly enhancing secure CI/CD practices and developer efficiency.

Developed and managed a Security Champions program, defined AppSec standards, and maintained secure coding guidelines and internal security documentation, fostering a proactive security culture.

Participated in comprehensive security reviews for new product features and supported SOC 2 and GDPR-related compliance activities, applying AWS security best practices across cloud environments.

RatedPower

|

Junior AppSec Engineer

Madrid, Madrid, Spain

→

Summary

Supported application security activities across product development teams, assisting with vulnerability remediation and integrating security tooling into CI/CD workflows.

Highlights

Supported application security activities across product development teams, focusing on vulnerability remediation and promoting secure development practices.

Designed and implemented the integration of security checks into CI/CD workflows, using SAST, SCA and dependency scanning tools to identify vulnerabilities earlier in the development lifecycle.

Collaborated closely with developers to review security findings, providing guidance and promoting a proactive approach to secure software development.

RatedPower

|

AppSec Intern

Madrid, Madrid, Spain

→

Summary

Supported application security testing and secure development initiatives, gaining practical experience in DevSecOps and cloud security fundamentals.

Highlights

Supported application security testing and vulnerability analysis, contributing to secure development initiatives within the product lifecycle.

Assisted with documenting remediation guidance for identified vulnerabilities, improving clarity and efficiency for development teams.

Gained practical experience in DevSecOps, CI/CD security, cloud security, and software security fundamentals, building a strong foundational understanding.

Education

Universidad Rey Juan Carlos

Móstoles, Madrid, Spain
→
BSc Software Engineering Grade:

Languages

Spanish

Native

English

Fluent

Certificates

AWS Certified Security – Specialty

AWS

Certified DevSecOps Expert (CDE)

Practical DevSecOps

Certified DevSecOps Professional (CDP)

Practical DevSecOps

Skills

Product & Application Security

Application Security, Product Security, Secure SDLC, Vulnerability Management, Security Reviews, Secure Coding Guidelines, AppSec Standards, Risk Acceptance, Developer Enablement, Security Champion Program, Threat Modelling, SAST, SCA, Dependency Scanning, Container Image Scanning, Checkmarx One, Snyk, SonarQube, SonarCloud, Dependabot, Semgrep, OWASP ZAP, Burp Suite, Bandit, TruffleHog.

DevSecOps & CI/CD Security

DevSecOps, Secure CI/CD, GitHub Actions, Travis CI, GitLab CI, Security Gates, PR Checks, Automated Vulnerability Reporting, IaC Security Scanning, Container Hardening, Jenkins.

Cloud Security (AWS)

AWS, IAM, S3, CloudFront, Lambda, Cognito, ECS, ECR, CloudTrail, WAF, Secrets Manager, SSM Parameter Store, Terraform, Serverless Framework, Docker, AWS Security Hub, GuardDuty.

Compliance & Standards

SOC 2, GDPR, Security Standards.