Musdaf Omar · Stockholm, Sweden
System Development — DevSecOps | Cloud & Platform Engineering
Building, securing, and automating cloud-native software delivery through hands-on engineering projects.
This portfolio documents nine hands-on DevSecOps projects spanning continuous integration, Kubernetes deployment, GitOps, software supply chain security, container scanning, dynamic security testing, compliance, runtime detection, and automated response.
Focus: CI/CD · Kubernetes · GitOps · Cloud Security · Security Automation
flowchart TD
A[Source code in GitHub] --> B[Jenkins CI / Maven]
B --> C[Dependency analysis and SBOM]
C --> D[Container build and image scanning]
D --> E[Container registry]
E --> F[Kubernetes / GKE]
G[Git configuration] --> H[Argo CD]
H --> F
F --> I[Running application]
I --> J[OWASP ZAP / InSpec checks]
I --> K[Falco runtime detection]
K --> L[Argo Events]
L --> M[Argo Workflows]
M --> N[Scoped remediation]
Conceptual overview of the integrated portfolio workflow. Individual project directories contain implementation details and evidence.
| # | Project | Main tools | What it demonstrates |
|---|---|---|---|
| 01 | CI/CD with Jenkins | Jenkins, Maven, Kaniko | Automated build and delivery |
| 02 | Kubernetes | Kubernetes, GKE | Cloud-native deployments |
| 03 | GitOps with Argo CD | Argo CD, Git | Declarative deployment management |
| 04 | Software Composition Analysis | CycloneDX, Dependency-Track | Dependency visibility and SBOMs |
| 05 | Container Security | Trivy, Dockle | Vulnerability and configuration scanning |
| 06 | Dynamic Security Testing | OWASP ZAP | Testing running applications |
| 07 | Compliance as Code | Chef InSpec | Automated compliance checks |
| 08 | Runtime Security | Falco | Suspicious behavior detection |
| 09 | Automated Remediation | Argo Events, Argo Workflows | Event-driven security response |
View the complete architecture and implementation notes →
- Automate: Build and deployment pipelines reduce manual steps and improve repeatability.
- Shift security left: Analyze dependencies, SBOMs, and container images before deployment.
- Secure operations: Use compliance checks and runtime monitoring after deployment.
- Respond carefully: Scope automated remediation to avoid unintended changes or feedback loops.
- Document evidence: Each project directory provides context, configurations, screenshots, and lessons where available.
Explore the individual project directories for configuration files, screenshots, test output, architecture notes, and lessons learned. The strongest evidence is a reproducible command, configuration, or workflow accompanied by its result.
I am a DevSecOps student at KYH in Stockholm, developing practical skills in secure software delivery, cloud infrastructure, Linux, containers, CI/CD, and platform engineering. I have secured a six-month workplace-learning placement (LIA) at Kaerus Software AB starting in November 2026.
My longer-term goal is to contribute as a junior DevSecOps, DevOps, Cloud, or Platform Engineer, building reliable and secure systems while continuing to learn from experienced teams.
Learning by building, testing, securing, and improving.