Magno is available for hire
Hire MagnoMagno Rodrigues de Oliveira
Verified Expert in Engineering
Security Engineer and Developer
Ottawa, Canada
Toptal member since July 14, 2026
Bio
Magno is a staff product security engineer with over 15 years of experience in offensive security, secure development, and developer enablement for clients such as Jane Software, Okta, and Trend Micro. His primary expertise is in penetration testing, DevSecOps, and cloud and container security for technology and financial industries, where Magno thrives in cross-functional engineering environments. He engineered org-wide AI security guardrails and automated secure code review while at Jane.
Portfolio
Jane Software
Artificial Intelligence (AI), Claude Code, Cursor AI, Claude, APIs...
Okta
Secure Coding, DevSecOps, APIs, Static Application Security Testing (SAST)...
Trend Micro
DevSecOps, Python, Kubernetes Security, GitHub Actions, Secure Containers...
Experience
- Incident Response - 15 years
- Threat Modeling - 15 years
- Penetration Testing - 15 years
- Vulnerability Management - 15 years
- Secure Coding - 10 years
- DevSecOps - 10 years
- Cloud Security - 5 years
- AI Security - 3 years
Preferred Environment
AI Security, Cloud Security, Container Security, DevSecOps, Incident Response, OWASP, Penetration Testing, SCA, Secure Coding
The most amazing...
...vulnerability feed testing pipeline I've automated for a container security tool reduced test time for container vulnerabilities from days to minutes.
Work Experience
Staff Product Security Engineer
2025 - PRESENT
Jane Software
- Led the secure adoption of AI and agentic developer tooling across the organization, engineered org-wide Claude Code guardrails that block secret leakage and dangerous commands, and authored security automation Cursor rules and Claude skills.
- Performed security code reviews, design reviews, and assessments of web applications and APIs, identifying vulnerabilities and articulating their business impact to drive remediation prioritization.
- Led security architecture and design reviews for large, business-critical projects, partnering with engineering and product to design and ship secure features.
- Helped engineering teams deploy and operate SAST, DAST, and SCA tooling and triage findings into actionable fixes.
- Ran the security champions program and delivered monthly technical learning sessions and internal CTFs, building a culture of collaborative security across engineering.
Technologies: Artificial Intelligence (AI), Claude Code, Cursor AI, Claude, APIs, Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), SCA, IT Security, Web Applications, PHI, Healthcare, Insurance, Vulnerability Management, Incident Response, Jira, Docker, Kubernetes, Kubernetes Security, Security Architecture, SOC 2, Amazon EC2, Amazon Web Services (AWS), SOC Compliance, Relational Database Services (RDS), Amazon RDS, ISO 27001, React, PostgreSQL, HIPAA, TypeScript, Application Security, Security Engineering, Security Policies & Procedures, Application Security Posture Management (ASPM), Cybersecurity, Large Language Models (LLMs), SIEM, NIST, Security Orchestration, Automation, and Response (SOAR), AI Security, AI Agents, Agentic AI, Prompt Injection, AI Trust, Risk and Security Management (AI TRiSM), Compliance, Endpoint Security
Staff Product Security Engineer
2024 - 2025
Okta
- Built and delivered technical security training (secure coding, DevSecOps, container, and Kubernetes security) for engineering teams as part of the product security team.
- Led a security champions program of nearly 100 participants, guiding security tool deployment and the remediation of vulnerabilities.
- Performed security code reviews and assessments of web applications and APIs, and helped teams deploy and triage SAST, DAST, and SCA tooling.
- Organized company-wide CTFs and monthly learning sessions on technical security topics.
Technologies: Secure Coding, DevSecOps, APIs, Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), SCA, IT Security, Web Applications, Artificial Intelligence (AI), Cursor AI, Vulnerability Management, Incident Response, Jira, Docker, Kubernetes, Kubernetes Security, Docker Security, OWASP Top 10, OWASP, SOC 2, Amazon Web Services (AWS), Amazon EC2, Amazon RDS, Relational Database Services (RDS), SOC Compliance, ISO 27001, Security, Cloud Security, Security Architecture, Application Security, Security Engineering, Security Policies & Procedures, Documentation, Compliance, Policies & Procedures Compliance, Cybersecurity, Large Language Models (LLMs), SIEM, AI Security
Information Security Specialist and Senior Threat Researcher
2020 - 2024
Trend Micro
- Researched cloud, container, and Kubernetes security, cloud-native, and open-source software supply-chain security, and DevSecOps.
- Built threat models, proof-of-concept exploits, honeypots, and threat-hunting capabilities to surface and demonstrate real-world risk.
- Automated the container vulnerability-feed testing pipeline in Python, cutting test cycles from hours to minutes.
- Contributed runtime protection capabilities to the container security product.
- Designed and ran red team and blue team exercises for the entire engineering organization.
Technologies: DevSecOps, Python, Kubernetes Security, GitHub Actions, Secure Containers, IT Security, Web Applications, Artificial Intelligence (AI), Threat Modeling, Vulnerability Management, Incident Response, Jira, Docker, Docker Hub, Docker Compose, Docker Swarm, Docker Cloud, Kubernetes, Kubernetes Operators, Self-managed Kubernetes, Amazon EKS, GitHub Actions Security, Open Source, Open Source Security, JFrog, Jenkins, Amazon EC2, Amazon RDS, Amazon Web Services (AWS), Relational Database Services (RDS), SOC 2, SOC Compliance, Azure, Azure Kubernetes Service (AKS), Amazon CloudWatch, AWS CloudTrail, Cloud Security, Security Architecture, Detection Engineering, Incident Handling, Incident Management, Software Composition Analysis (SCA), Containers, Rancher Kubernetes Engine (RKE), Google Kubernetes Engine (GKE), Cloud Native Computing Foundation (CNCF), AWS Lambda, Application Security, Vulnerability Assessment, Cybersecurity, Ethical Hacking, Certified Ethical Hacker (CEH), MITRE ATT&CK, SIEM, NIST, Security Orchestration, Automation, and Response (SOAR), Compliance, Endpoint Security
Information Security Specialist and Team Lead
2018 - 2019
SkipTheDishes
- Led penetration testing across all major web applications and APIs.
- Led the security team, the PCI-DSS compliance program, and DevSecOps adoption across the development pipeline.
- Ran incident response and monitoring using Splunk and a WAF.
- Deployed software composition analysis (Sonatype Nexus IQ) for dependency and vulnerability scanning of 3rd-party libraries.
- Managed vulnerability scanning and remediation for PCI, container, and cloud environments (Tenable.io, Rapid7 InsightVM), and delivered recurring secure coding training on the OWASP Top 10 Proactive Controls.
Technologies: APIs, DevSecOps, Splunk, Web Application Firewall (WAF), Imperva Incapsula, IT Security, Web Applications, Threat Modeling, Vulnerability Management, Incident Response, SOC 2, SOC Compliance, PCI, PCI DSS, Incident Handling, Incident Management, Security Incident Triage, ISO 27001, ISO/IEC 27017, ISO/IEC 27018, Application Security, Vulnerability Assessment, Documentation, Compliance, Security Engineering, Policies & Procedures Compliance, Security, Security Policies & Procedures, Security Policy Analysis, Cybersecurity, Ethical Hacking, Certified Ethical Hacker (CEH), MITRE ATT&CK, SIEM, NIST, Security Orchestration, Automation, and Response (SOAR)
Application Security Specialist and Consultant
2018 - 2018
Dasa
- Delivered web and network application security testing and secure code reviews as a consultant.
- Ran vulnerability scanning using Nessus and performed vulnerability management.
- Created application security and secure coding training based on OWASP.
Technologies: Nessus, OWASP, Penetration Testing, Dynamic Application Security Testing (DAST), Static Application Security Testing (SAST), Burp Suite, IT Security, Web Applications, Threat Modeling, Vulnerability Management, Incident Response, Application Security, Vulnerability Assessment, Cybersecurity, Ethical Hacking, Certified Ethical Hacker (CEH)
Application Security Specialist and Lead Pentester
2016 - 2018
TecBan - Tecnologia Bancária
- Discovered and exploited vulnerabilities in enterprise products from SAP, Oracle, IBM, Microsoft SharePoint, and Segura, building working exploits to demonstrate business impact and reporting them through responsible disclosure.
- Led the penetration testing team and DevSecOps adoption across the development pipeline.
- Performed network and application penetration testing across all systems, including the Banco24Horas transactional ATM network.
- Managed and protected external web applications with a WAF (F5 BigIP ASM).
- Performed security code review and application security auditing.
Technologies: DevSecOps, Web Application Firewall (WAF), Penetration Testing, OWASP, Burp Suite, Nessus, Metasploit, OWASP Zed Attack Proxy (ZAP), IT Security, Web Applications, Threat Modeling, Vulnerability Management, Incident Response, Application Security, Vulnerability Assessment, Cybersecurity, Ethical Hacking, Certified Ethical Hacker (CEH), MITRE ATT&CK, SIEM, NIST, Compliance, Endpoint Security
Experience
JampaSec
https://jampasec.wordpress.com/JampaSec was an information security event in João Pessoa, Paraíba. The event featured information security professionals who discussed topics and trends in the field. The event, aimed at students, professionals, managers, and anyone interested in information technology, was organized by OWASP Paraíba.
OWASP João Pessoa Chapter
https://owasp.org/www-chapter-joao-pessoa/OWASP João Pessoa is one of 12 Brazilian chapters among more than 270 active chapters worldwide. Our goal is to spread the OWASP mission, making application security visible so that people and organizations can make informed decisions about the true security risks of applications. Meetings are held to enable people to share knowledge, discuss, and learn about software security. The organization also has many active projects in which volunteers can participate to create code and documents for the global security community.
Claude Skills - Code Review and Threat Modeling
I created and now run two custom Claude Skills in production: threat-modelling and security-code-review. These are SKILL.md defined features that any engineer can use directly in their Claude Code session, without needing to go through a security engineer.
Awesome Kubernetes (K8s) Security
https://github.com/magnologan/awesome-k8s-securityA curated list of Kubernetes (K8S) Security resources, such as articles, books, tools, talks and videos. Everything related to the Security of Kubernetes (and its components, such as CoreDNS and etcd), whether for learning, breaking, or defending it.
Awesome SCA List
https://github.com/magnologan/awesome-scaThis is a comprehensive list of Software Composition Analysis (SCA) Tools.
The following repo contains a collection of SCA tools that can be used to analyze risks in third-party components used in the code.
The following repo contains a collection of SCA tools that can be used to analyze risks in third-party components used in the code.
Kubernetes Security Research
https://www.trendmicro.com/vinfo/us/security/news/virtualization-and-cloud/the-basics-of-keeping-your-kubernetes-cluster-secure-part-1The Basics of Keeping Kubernetes Clusters Secure (Part 1) and Part 2: Worker Nodes and Related Components — Oct 2020. Part 1 covers the master node, API server, etcd, RBAC, and network policies; Part 2 covers worker nodes, the kubelet, pods, and audit logs.
Trend Micro
Trend Micro
TeamTNT Targets Kubernetes, Nearly 50,000 IPs Compromised in Worm-like Attack — May 2021, with David Fiser.
The Fault in Our Kubelets — May 2022. Found over 243,000 publicly exposed Kubernetes clusters via Shodan, many with the kubelet port open.
Trend Micro
A Deep Dive Into Kubernetes Threat Modeling
Understanding the Kubernetes Security Triad: Image Scanning, Admission Controllers, and Runtime Security — Nov 2023.
Mitigating the Threat of Sidecar Container Injection — Apr 2024.
How to Secure Your Kubernetes Cluster — Cloud Native Now, Oct 2020.
Trend Micro
Trend Micro
TeamTNT Targets Kubernetes, Nearly 50,000 IPs Compromised in Worm-like Attack — May 2021, with David Fiser.
The Fault in Our Kubelets — May 2022. Found over 243,000 publicly exposed Kubernetes clusters via Shodan, many with the kubelet port open.
Trend Micro
A Deep Dive Into Kubernetes Threat Modeling
Understanding the Kubernetes Security Triad: Image Scanning, Admission Controllers, and Runtime Security — Nov 2023.
Mitigating the Threat of Sidecar Container Injection — Apr 2024.
How to Secure Your Kubernetes Cluster — Cloud Native Now, Oct 2020.
GitHub Actions Security Research
https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/github-action-runners-analyzing-the-environment-and-security-in-actionGitHub Action Runners: Analyzing the Environment and Security in Action — covers GHA components and runners, cryptomining abuse, runner reconnaissance, and setting up reverse shells from within a runner.
Unpacking Cloud-Based Cryptocurrency Miners That Abuse GitHub Actions and Azure Virtual Machines — Trend Micro Research, 2022.
Abusing a GitHub Codespaces Feature For Malware Delivery — Jan 2023, with Nitesh Surana. Examines how sharing forwarded ports publicly in GitHub Codespaces could be abused to stand up a malware file server on a legitimate account. Codespaces rather than Actions specifically, but closely adjacent
Unpacking Cloud-Based Cryptocurrency Miners That Abuse GitHub Actions and Azure Virtual Machines — Trend Micro Research, 2022.
Abusing a GitHub Codespaces Feature For Malware Delivery — Jan 2023, with Nitesh Surana. Examines how sharing forwarded ports publicly in GitHub Codespaces could be abused to stand up a malware file server on a legitimate account. Codespaces rather than Actions specifically, but closely adjacent
Education
2010 - 2011
Master of Business Administration (MBA) in Information Security
Faculdade De Tecnologia De João Pessoa - Brazil
2005 - 2010
Bachelor's Degree in Information Technology
Instituto Federal Da Paraíba - Brazil
2008 - 2009
Associate of Arts and Sciences Degree in Computer Forensics
Tompkins Cortland Community College - Dryden, NY, USA
Certifications
MARCH 2023 - APRIL 2027
EC-Council ECDE (Certified DevSecOps Engineer)
EC-Council
AUGUST 2022 - AUGUST 2025
AWS Certified Cloud Practitioner
AWS
AUGUST 2022 - AUGUST 2025
AWS Certified Solutions Architect
AWS
DECEMBER 2021 - PRESENT
Microsoft Azure Fundamentals
Microsoft
DECEMBER 2021 - DECEMBER 2029
GIAC GCSA (Cloud Security Automation)
GIAC
JUNE 2021 - JUNE 2024
CompTIA PenTest+
CompTIA
AUGUST 2018 - AUGUST 2024
CompTIA CySA+
CompTIA
MAY 2018 - PRESENT
EXIN Ethical Hacking Foundation
EXIN
APRIL 2018 - PRESENT
CompTIA Cloud Essentials
CompTIA
NOVEMBER 2016 - PRESENT
EXIN Secure Programming Foundation
EXIN
MARCH 2015 - MARCH 2018
CompTIA Security+
CompTIA
Skills
Libraries/APIs
React
Tools
Claude Code, Claude, Splunk, Nessus, Jira, Metasploit, OWASP Zed Attack Proxy (ZAP), Docker Hub, Docker Compose, Docker Swarm, Kubernetes Operators, Amazon EKS, Jenkins, Azure Kubernetes Service (AKS), GitHub, Amazon CloudWatch, AWS CloudTrail, Google Kubernetes Engine (GKE)
Paradigms
Penetration Testing, DevSecOps, Agile Software Development, Automation, Security Orchestration, Automation, and Response (SOAR)
Industry Expertise
Cybersecurity, Healthcare, Insurance
Languages
Python, TypeScript
Platforms
Imperva Incapsula, AWS IoT, Kubernetes, Docker, Burp Suite, Azure, Amazon EC2, Amazon Web Services (AWS), AWS Lambda
Storage
Docker Cloud, PostgreSQL
Other
Threat Modeling, Vulnerability Management, Incident Response, Ethical Hacking, IT Security, Web Applications, Security, SOC 2, Certified Ethical Hacker (CEH), MITRE ATT&CK, Endpoint Security, Artificial Intelligence (AI), Cursor AI, AI Security, Cloud Security, Container Security, Kubernetes Security, PHI, Compliance, Large Language Models (LLMs), SIEM, NIST, AI Agents, Agentic AI, Prompt Injection, APIs, Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), SCA, Secure Coding, Web Application Firewall (WAF), OWASP, Information Security, GitHub Actions, Secure Containers, Computer Forensics, Docker Security, OWASP Top 10, Self-managed Kubernetes, GitHub Actions Security, Open Source, Open Source Security, JFrog, Software Composition Analysis (SCA), Snyk, Dependabot, Veracode, Black Duck, Renovate, Semgrep, Pipelines, CI/CD Pipelines, CI/CD Security, Supply Chain, Supply Chain Security, Software Supply Chain, Security Architecture, SOC Compliance, Relational Database Services (RDS), Amazon RDS, ISO 27001, Detection Engineering, Incident Handling, Incident Management, Containers, Rancher Kubernetes Engine (RKE), Cloud Native Computing Foundation (CNCF), PCI, PCI DSS, Security Incident Triage, ISO/IEC 27017, ISO/IEC 27018, HIPAA, Application Security, Vulnerability Assessment, Security Engineering, Security Policies & Procedures, Documentation, Policies & Procedures Compliance, Security Policy Analysis, Application Security Posture Management (ASPM), AI Trust, Risk and Security Management (AI TRiSM)
Collaboration That Works
How to Work with Toptal
Toptal matches you directly with global industry experts from our network in hours—not weeks or months.
1
Share your needs
Discuss your requirements and refine your scope in a call with a Toptal domain expert.
2
Choose your talent
Get a short list of expertly matched talent within 24 hours to review, interview, and choose from.
3
Start your risk-free talent trial
Work with your chosen talent on a trial basis for up to two weeks. Pay only if you decide to hire them.
Top talent is in high demand.
Start hiring