CV

GianlucaCaruso

I work in cybersecurity with a hands-on approach: security applied to code, infrastructure, DevSecOps automation and real processes, even when doing it right is the hard part.

Want the jargon-free version? What I do

0b001

Work experience

  1. Jun 2023 - present

    ICT Security Specialist | DevSecOps Engineer | Full Stack Developer | AI Engineer

    Altrama Italia

    ICT security, application hardening, full-stack development, DevSecOps automation and support for the company's ISO 27001 certification path.

0b010

Education

  1. ongoing

    CyberSecurity - continuous learning

    HackTheBox Academy, PortSwigger Academy and specialist platforms

    Hands-on training in offensive security (penetration testing, web application testing, vulnerability assessment, OSINT, bug bounty), blue team practices (hardening, WAF, IDS/IPS, EDR, XDR, SOAR) and governance (NIS2).

  2. 2018 - 2023

    BSc in Computer Science

    University of Calabria

    University studies in computer science, software development and security fundamentals.

  3. 2013 - 2018

    Diploma in Business Information Systems

    ITAS ITC Rossano

    Technical education in information systems, databases and business processes.

0b011

Skills

Software engineering

Languages, UI, backend, data, state, motion, APIs and testing for complete products.

Languages and web

Web stack

langTS / JS
webHTML
webCSS

Backend languages

langJava
langGo
langPython

Systems & scripting

langC/C++
langBash
langPerl

Mobile language

langDart
langJava

Frontend and motion

Frontend architecture

libraryReact
frameworkNext.js
frameworkAstro

Styling systems

frameworkTailwind CSS
frameworkBootstrap
uishadcn/ui

Motion & 3D

motionGSAP
motionMotion (Framer Motion)
3dThree.js

Cross-platform UI

frameworkFlutter

Backend and APIs

Backend stack

frameworkSpring Boot
frameworkNestJS
frameworkDjango
frameworkFastAPI
runtimeNode.js
runtimeBun

API design

apiREST
apiGraphQL
apitRPC

Realtime

apiWebSocket

Data and state

Relational data

dataPostgreSQL
dataMySQL

NoSQL & search

dataMongoDB
dataRedis
dataElasticsearch

State management

stateRedux / Redux Toolkit
stateZustand

Mobility data

standardGTFS

Software quality

Testing strategy

testUnit Testing
testIntegration Testing
testE2E Testing

Platform & DevSecOps

Linux, pipelines, containers, infrastructure and automated checks close to the code.

Systems and edge

Linux

osDebian
osUbuntu
osRocky Linux

Edge routing

edgeNginx
edgeCaddy

Containers and orchestration

Containers

containerDocker
containerPodman

Orchestration

orchestrationKubernetes
orchestrationHelm

Infrastructure and delivery

IaC & automation

iacTerraform
iacOpenTofu
iacAnsible

CI/CD

ci/cdGitHub Actions

Secrets management

secretsVault

Observability

Metrics & dashboards

observabilityPrometheus
observabilityGrafana

Log management

observabilityLoki
observabilityELK

AI engineering

Agents, RAG, MCP and automations that turn technical context into useful workflows.

Models, agents and context

LLM systems

archLLM
archRAG

Agentic systems

archAI Agents
protocolMCP

Engineering and automation

AI application stack

langPython
frameworkLangChain

Applied AI workflows

automationAI Automation
practicePrompt Engineering

AI security

AI Red Teaming

frameworkDeepTeam

Data privacy

libraryPresidio

Cybersecurity

Tooling, offensive security, defense, application security and governance.

Recon and discovery

OSINT tools

toolMaltego
toolSpiderFoot
toolShodan

Threat intelligence

toolMISP
toolOpenCTI

Subdomain discovery

toolChaos
toolSubfinder

Asset discovery

toolNmap
toolGoSearch

Vulnerability discovery

toolNuclei
toolOpenVAS

Content discovery

toolffuf
toolGobuster
toolDirBuster

Offensive and security testing

Web & TLS testing

toolBurp Suite
toolsqlmap
toolsslscan

Adversary simulation

toolMetasploit
toolSliver

Wireless security

toolAircrack-ng

Defense and detection

Host hardening

toolnftables
toolauditd
toolLynis

Network defense

toolCoraza
toolModSecurity
toolSuricata

Security monitoring

toolWazuh
toolSysmon
toolElastic Security

Endpoint security

toolVelociraptor
toolosquery

Incident response & SOAR

toolWazuh
toolTheHive
toolShuffle

Security architecture

toolWireGuard
toolOpenVPN
toolCloudflare Zero Trust

Application security

SAST

toolSemgrep
toolSnyk

SCA & supply chain

toolSnyk
toolTrivy
toolOWASP Dependency-Check

DAST

toolOWASP ZAP
toolNikto
toolWapiti

Governance and risk

Compliance & ISMS

governanceNIS2
governanceISO 27001

0b100

Certifications & achievements

Click to see all badges

HTB Certified Web Exploitation Specialist

Path completato

Hacking in the wild

Hacking WordPress

The eye that sees all

Network Enumeration with Nmap

Do things the traditional way

Introduction to Bash Scripting

Every road leads back to root

File Inclusion

Airborne delivery

File Transfers

DROP your weapon

SQL Injection Fundamentals

Your request is my demand

Web Requests

Combine the modules

Using the Metasploit Framework

Playing with the mess

JavaScript Deobfuscation

Stairway to Heaven

Linux Privilege Escalation

Fuzzing is power

Attacking Web Applications with Ffuf

Crude but effective

Login Brute Forcing

JOIN the adventure

SQLMap Essentials

Developer

Introduction to Web Applications

Your first battle

Getting Started

Just a small crack, and you're in

Broken Authentication

Start building your arsenal

Setting Up

Tactical

Penetration Testing Process

Included in every report

Cross-Site Scripting (XSS)

Light in the dark

Vulnerability Assessment

Inject with caution

Command Injections

Dive into requests

Using Web Proxies

You need to trace before you can hunt

Footprinting

Ghost in the shell

Shells & Payloads

Scan and execute

Attacking Common Services

Arachnoid

Web Attacks

Prepare your payload and up you go

File Upload Attacks

Information is not knowledge, or is it?

Information Gathering - Web Edition

Straight to the server

Server-side Attacks

Passwords are not the only way forward

Session Security

You shall not (by)pass

Web Service & API Attacks

Hunt the bug

Bug Bounty Hunting Process

Flaw finder

Intro to Whitebox Pentesting

Endpoint Explorer

API Attacks

Fuzzing guru

Web Fuzzing

Graph invader

Attacking GraphQL

Protocol Breaker

Attacking AI - Application and System

PenguinTracer

Introduction to Linux Forensics

0b101

Say hi!

An idea, a doubt, a problem you're not sure how to solve: let's start there.

Type at least two characters.