2025
Security Compliance Engine
Automated security scanning pipeline: SonarQube and OWASP ZAP in GitLab CI/CD, one OWASP Top 10 report
- Assessment per repository
- ~20 min
- SonarQube and OWASP ZAP
- SAST + DAST
- Top 10 report
- OWASP
- GitLab CI
- Docker
- Python
- SAST
- DAST
- YAML
- OWASP TOP10
Summary
An automated engine that enforces organizational security policies across infrastructure and codebases. Evaluates security posture against defined rulesets, generates compliance reports, and integrates into CI/CD pipelines for automated security gating on every push.
Problem
Security reviews are slow, manual, and inconsistent — teams ship vulnerabilities because there's no automated enforcement at the pipeline level.
Approach
Built a GitLab CI/CD-integrated engine that runs SAST, DAST, and compliance checks on every commit. Generates structured reports and gates deployments on policy violations.
Results
- Reduced security assessment turnaround to approximately 20 minutes per repository, compared with hours of manual review.
- Consolidates SAST findings from SonarQube and DAST findings from OWASP ZAP into a single OWASP Top 10 report.