Ready to publish
Secure CI/CD Starter secure-cicd-starter Reusable GitHub Actions templates for building, scanning, signing, and releasing container services with security gates that engineers can copy into real repositories.
Shows practical shift-left delivery: secrets detection, SAST, IaC checks, SBOM generation, image scanning, and signed artifacts in one pipeline.
GitHub Actions Gitleaks Semgrep Checkov Trivy Syft Cosign
Proof to show
- Pull request annotations for security findings - SARIF uploads into GitHub code scanning - SBOM artifact attached to every release - Documented break-glass bypass with expiry Build steps
- Create reusable workflow files under .github/workflows/ - Add sample Docker app and Terraform module with known passing controls - Publish screenshots of successful and failed security gates - Write a clear technical README with architecture and tradeoffs Shows how the pipeline design turns scanner output into enforceable DevSecOps guardrails.
GitHub repo target
Next build
Terraform Azure Landing Zone Lite terraform-azure-landing-zone-lite Small but realistic Azure landing zone module with identity, networking, policy, tagging, budget, logging, and least-privilege defaults.
Demonstrates cloud platform engineering, secure-by-default infrastructure, and governance-as-code for regulated teams.
Terraform Azure Azure Policy Checkov OPA GitHub OIDC
Proof to show
- Terraform plan output captured in CI - Checkov and policy-as-code reports - Module examples for dev, test, and prod - Security decision records for each baseline control Build steps
- Scaffold reusable Terraform modules for resource groups, networking, diagnostics, and policy assignments - Add example environments with tfvars templates and no secrets - Add GitHub Actions validation: fmt, validate, tflint, checkov, plan - Document how OIDC avoids static Azure credentials in CI Proves you can design the cloud foundation teams deploy onto, including controls and developer experience.
GitHub repo target
Next build
Kubernetes Security Baseline kubernetes-security-baseline AKS/EKS-ready hardening baseline with namespaces, network policies, RBAC, admission controls, image scanning, and secure Helm examples.
Shows container platform depth: workload identity, policy enforcement, runtime visibility, and deployable secure defaults.
Kubernetes Helm OPA Gatekeeper Trivy Falco Prometheus
Proof to show
- Policy tests for privileged pods and unsafe capabilities - NetworkPolicy examples with allowed and denied flows - Helm chart lint and template validation in CI - Runtime detection runbook for suspicious container behavior Build steps
- Create a local kind-based demo cluster path - Add Gatekeeper constraints for pod security and image provenance - Ship secure and insecure sample workloads to prove the gates - Add diagrams for request flow, policy flow, and alert flow Moves your profile beyond pipeline tooling into platform security and production Kubernetes thinking.
GitHub repo target
Portfolio lab
SonarQube + Trivy DevSecOps Lab sonarqube-trivy-devsecops-lab Hands-on lab that builds a Java or Node service, runs code quality and security checks, scans the container image, and publishes findings.
Turns tutorial-style DevSecOps learning into your own working lab with screenshots, pipeline logs, and clear remediation notes.
Jenkins SonarQube Trivy Docker Maven or Node GitHub
Proof to show
- Pipeline screenshots for build, quality gate, and security scan - Before-and-after remediation commit history - Documented false-positive handling - Docker Compose lab setup for local reproduction Build steps
- Create docker-compose.yml for Jenkins and SonarQube - Add a sample app with intentional low-risk findings - Write Jenkinsfile stages for build, unit test, SonarQube, Trivy, and publish - Capture results in README and link from the portfolio page Makes your GitHub activity visible through CI, scanning, and troubleshooting proof.
GitHub repo target
Differentiator
Cloud Cost Governance Bot cloud-cost-governance-bot Python automation that reviews cloud inventory exports, flags cost and governance drift, and opens actionable GitHub issues.
Combines FinOps, governance, automation, and security hygiene into a project that speaks to senior platform roles.
Python GitHub Actions Azure Cost Management AWS Cost Explorer Markdown reports
Proof to show
- Sample CSV inventory input with anonymised data - Generated governance report - GitHub issue creation dry-run mode - Unit tests around tagging and budget rules Build steps
- Define cost and tag policy rules in YAML - Parse sample Azure and AWS export files locally - Generate a markdown report for pull requests - Add dry-run GitHub issue creation for drift items Shows the business side of platform engineering: controls, cost, and automation that leaders care about.
GitHub repo target
Writing plus automation
Cloud Incident Response Runbooks cloud-incident-response-runbooks Operational runbooks and small automation scripts for leaked secret response, exposed storage, suspicious IAM changes, and vulnerable image rollout.
Demonstrates incident thinking, communication, containment steps, and automation without exposing any employer-specific work.
Bash Python AWS CLI Azure CLI GitHub Actions Markdown
Proof to show
- Runbooks with severity, owner, detection, containment, and recovery sections - CLI scripts with dry-run defaults - Post-incident review template - Mapping to common controls such as least privilege and logging Build steps
- Write four runbooks from realistic but anonymised scenarios - Add scripts that validate access before changing anything - Create tabletop exercise checklist - Publish a blog post linking each runbook to platform controls Positions you as someone who can operate under pressure and build repeatable security response, not just deploy tools.
GitHub repo target