Andriy Zelenyuk

Partnered with 8+ product teams to embed secure-by-design requirements throughout the SDLC and drive a risk-based vulnerability management program across cloud and on-prem estates.

• Integrated Snyk, Tenable, Orca, and Armis with CI/CD pipelines
• Reduced critical vulnerability backlog by 60% in two quarters
• Implemented policy-as-code guardrails cutting review time from days to under 30 minutes
• Hardened multi-cloud environments (AWS & GCP) using Terraform and CIS benchmarks

Designed and built a RAG-powered Slack bot that automates compliance evidence collection, intelligent report generation, and real-time security alerting.

• Built RAG pipeline for intelligent compliance querying and report generation
• Developed interactive Slack bot with LLM-powered natural language interface
• Integrated with Asana for automated remediation task tracking
• Leveraged AWS Athena to analyze CloudTrail logs and surface anomalies
• Reduced manual compliance effort by 75%

Led enterprise-wide security tooling deployment for a medical IoT platform, enabling secure development practices at scale.

• Led SonarQube Enterprise rollout with Terraform HA cluster and CI/CD integration
• Deployed Burp Suite Enterprise with pipeline hooks and DAST triage training
• Enabled 120+ engineers through developer security training sessions
• Achieved 85% DAST scan coverage across 30 repositories

Enhanced security automation for a cloud-native software-defined networking platform delivering managed services to enterprise customers.

• Integrated Black Duck for container and application SCA
• Developed security tools for CI/CD pipeline integration
• Established automated security testing frameworks
• Improved release compliance from 40% to 90%

Personal open-source project (AGPL-3.0): a security testing platform for web apps, APIs, AI systems and connected devices, self-hosted in Docker with a web UI, REST API and CLI, and built to be driven by an AI coding agent in plain English.

• Scan: repeatable DAST from a quick posture check to authorized active XSS/SQLi testing; Hunt: AI-assisted investigation using your own Codex, Claude Code or OpenCode session, with scope, budgets and evidence managed by the platform
• AI Gate tests for chat, RAG, agent and MCP endpoints; Model Intake checks for model artifacts; continuous attack-surface monitoring; connected-device posture for TVs, cameras, printers and routers
• One-line Docker install, Homebrew tap, Fleet workers for distributed execution; Enterprise edition adds SSO, roles and audit logging
• Source and docs: github.com/andriyze/shakerscan · shakerscan.com

a3sec.net is its own case study: everything below is built and running here, all of it managed in Terraform.

• Static site on S3 behind CloudFront with Origin Access Control: no public bucket, no website endpoint, all of it in Terraform.
• Security headers and a strict CSP at the edge: no inline script on any page, scripts only from the site itself (plus cdnjs for the calculator charts).
• A self-healing cost circuit breaker: one-minute CloudFront alarms, automatic restore, a budget scoped to the site's own services.
• A public JSON API and MCP server on Lambda with input validation, rate limits, origin validation and tests.
• Honeypot paths armed with Canarytokens, and a public traffic dashboard built from access logs that publishes aggregates only.
• Everything readable without JavaScript and documented for agents in llms.txt.
• Try it: type help in the terminal above, call /api, or point an MCP client at https://www.a3sec.net/mcp

An interactive course on everyday cybersecurity for non-specialists, in Ukrainian: the habits and settings that stop most real-world attacks.

• Modules on passwords and managers, MFA, phishing, browser privacy, device hygiene, safe tools, and networking basics
• Hands-on checks and quizzes instead of slides, so readers verify their own setup as they go
• Live at sec101.a3sec.net