Skip to content
View CHDevSec's full-sized avatar
31 followers · 0 following

Achievements

Achievement: Starstruck

Achievements

Achievement: Starstruck

Block or report CHDevSec

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
CHDevSec/readme.md

Caio Henrique, Staff Security Engineer. AppSec, DevSecOps and Cloud Security. I cut risk without cutting velocity.

About

I'm a security engineer focused on application security, with DevSecOps and cloud security as the way to make it stick at scale. For 7+ years I've built security into how software ships: threat modeling and code review with product teams, CI gates that block on exploitable findings instead of noise, guardrails across AWS, GCP and Azure, and vulnerability programs that leadership can follow week by week.

I run security as an engineering problem, end to end: the tooling, the pipeline, the metrics, and the monthly forum where the heads of every tech team decide what gets fixed. Today I lead CHDevSec, an AppSec and cloud security practice; before that I was a Security Engineer at frete.com.

Selected results: 60%+ of the Go stack adopted SecScan; -87% false positives in CI security gates; Ubuntu fleet vulnerabilities -44% (569k to 318k); 4 scanners unified into one vulnerability program

What I do

  • Application security: threat modeling, secure code review, OWASP Top 10 / ASVS, API security, pentests of web apps, APIs and cloud
  • DevSecOps: SAST, SCA, secrets and IaC scanning in GitHub Actions and GitLab CI, tuned so builds fail only on real risk
  • Cloud security: IAM guardrails and posture on AWS, GCP and Azure, Kubernetes, hardening and patching at fleet scale
  • Vulnerability management: one workflow for every scanner (DefectDojo, Jira), risk-based SLAs, risk acceptance, reporting to leadership

Experience

Company Role Highlights
CHDevSec · 2026 – now Founder, security consultant AppSec reviews and pentests (web, API, cloud), DevSecOps pipelines, hardening and vuln management for clients
frete.com · 2024 – 2026 Security Engineer, Cloud & DevSecOps Built SecScan (60%+ of the Go stack), CI gates with −87% false positives, Ubuntu fleet vulns 569k → 318k, ran the vulnerability program and monthly forum with heads of tech
Volt Sport · 2023 – 2024 Security Engineer Infra pentest with 16 critical findings closed, Wazuh SOC, Zero Trust and Cloudflare WAF across branches
Global Estratégias Financeiras · 2021 – 2023 Cybersecurity Analyst IAM lifecycle for 500+ users in a regulated fintech, CIS hardening

Also: SoftExpert (2026) and Evolution Soluções Empresariais (2023). Full history on the portfolio.

Open source

Project What it does
SecScan Snyk SAST/SCA orchestrator for hundreds of repositories, deterministic output, CI-ready exit codes Go
CIS Auditor CIS Benchmark audit and remediation for Ubuntu 22.04, parallel engine, HTML/JSON reports Go · Bash
S1 Vulnerability Automation SentinelOne inventory → false-positive rules, exposure metrics, week-over-week diff → Sheets / Grafana Python
Kernel Guardian The automation behind the −44% Ubuntu fleet reduction: kernel updates, GRUB hardening Bash · Python
Recon Pro Web reconnaissance for pentest and bug bounty Python

Certifications

CRTA (CyberWarFare Labs) · Ethical Hacking Essentials (EC-Council) · Ethical Hacking (Cisco) · ISO/IEC 27001 Foundation  —  in progress: OSCP · CompTIA Security+ · CEH

chdevsec.com.br  ·  LinkedIn  ·  caiohenriquesinger@gmail.com  ·  Open to staff / senior security roles, remote or global

Pinned Loading

  1. RedPhaton RedPhaton Public

    Red team reconnaissance and vulnerability-testing framework with Nuclei and Metasploit integration. For authorized engagements only.

    Python 4 1

  2. ShadowPort ShadowPort Public

    Port scanning and service enumeration: TCP/UDP, banner grabbing, DNS recon, HTML/JSON reports. Authorized testing only.

    Python 3 1

  3. Recon_pro_v2 Recon_pro_v2 Public

    Modular web reconnaissance: asset discovery, intelligent fuzzing, vulnerability detection and HTML/JSON/CSV reports.

    Python 3 1

  4. BreachHunter BreachHunter Public

    Email and password breach auditing across multiple databases (HIBP, LeakCheck, Breached). Batch mode and CSV reports.

    Python 4

  5. DirBusterPro DirBusterPro Public

    Directory and access-control bypass tester: path-manipulation techniques, multi-threaded, CSV/JSON/HTML reports. Authorized testing only.

    Python 3

  6. recon_pro.py recon_pro.py Public

    Web reconnaissance for pentest and bug bounty: dorking, tech detection, context-aware checks and HTML reports.

    HTML 18 2