GianlucaCaruso

Lavoro nel mondo della cybersecurity con un approccio pratico: sicurezza applicata a codice, infrastruttura, automazioni DevSecOps e processi reali, anche quando farla bene è la parte più ostica.

Versione senza tecnicismi? Cosa faccio

0b001

Esperienze lavorative

giu 2023 - presente
ICT Security Specialist | DevSecOps Engineer | Full Stack Developer | AI Engineer
Altrama Italia
Sicurezza ICT, hardening applicativo, sviluppo full-stack, automazione DevSecOps e supporto al percorso aziendale di certificazione ISO 27001.

0b010

Formazione

continuo
Cybersecurity - formazione continua
HackTheBox Academy, PortSwigger Academy e piattaforme specialistiche
Percorso pratico di offensive security (penetration testing, web application testing, vulnerability assessment, OSINT, bug bounty), blue team (hardening, WAF, IDS/IPS, EDR, XDR, SOAR) e governance (NIS2).
2018 - 2023
Laurea triennale in Informatica
Università della Calabria
Percorso universitario in informatica, sviluppo software e basi di sicurezza.
2013 - 2018
Diploma in Sistemi Informativi Aziendali
ITAS ITC Rossano
Formazione tecnica su sistemi informativi, basi dati e processi aziendali.

0b011

Competenze

Software engineering

Linguaggi, UI, backend, dati, stato, motion, API e testing per prodotti completi.

Linguaggi e web

Stack web

langTS / JS

webHTML

webCSS

Linguaggi backend

langJava

langGo

langPython

Sistemi e scripting

langC/C++

langBash

langPerl

Linguaggio mobile

langDart

langJava

Frontend e motion

Architettura frontend

libraryReact

frameworkNext.js

frameworkAstro

Sistemi di stile

frameworkTailwind CSS

frameworkBootstrap

uishadcn/ui

Motion e 3D

motionGSAP

motionMotion (Framer Motion)

3dThree.js

UI multipiattaforma

frameworkFlutter

Backend e API

Stack backend

frameworkSpring Boot

frameworkNestJS

frameworkDjango

frameworkFastAPI

runtimeNode.js

runtimeBun

Progettazione API

apiREST

apiGraphQL

apitRPC

Realtime

apiWebSocket

Dati e stato

Dati relazionali

dataPostgreSQL

dataMySQL

NoSQL e ricerca

dataMongoDB

dataRedis

dataElasticsearch

Gestione dello stato

stateRedux / Redux Toolkit

stateZustand

Dati per la mobilità

standardGTFS

Qualità del software

Strategia di test

testUnit Testing

testIntegration Testing

testE2E Testing

Platform & DevSecOps

Linux, pipeline, container, infrastruttura e controlli automatici vicino al codice.

Sistemi ed edge

Linux

osDebian

osUbuntu

osRocky Linux

Routing ed edge

edgeNginx

edgeCaddy

Container e orchestrazione

Container

containerDocker

containerPodman

Orchestrazione

orchestrationKubernetes

orchestrationHelm

Infrastruttura e delivery

IaC e automazione

iacTerraform

iacOpenTofu

iacAnsible

CI/CD

ci/cdGitHub Actions

Gestione segreti

secretsVault

Osservabilità

Metriche e dashboard

observabilityPrometheus

observabilityGrafana

Gestione log

observabilityLoki

observabilityELK

AI engineering

Agent, RAG, MCP e automazioni che trasformano contesto tecnico in workflow utili.

Modelli, agent e contesto

Sistemi LLM

archLLM

archRAG

Sistemi agentici

archAI Agents

protocolMCP

Sviluppo e automazione

Stack applicativo AI

langPython

frameworkLangChain

Workflow AI applicati

automationAI Automation

practicePrompt Engineering

Sicurezza AI

AI Red Teaming

frameworkDeepTeam

Privacy dei dati

libraryPresidio

Cybersecurity

Tooling, offensive security, difesa, application security e governance.

Recon e discovery

Tool OSINT

toolMaltego

toolSpiderFoot

toolShodan

Threat intelligence

toolMISP

toolOpenCTI

Discovery sottodomini

toolChaos

toolSubfinder

Discovery asset

toolNmap

toolGoSearch

Discovery vulnerabilità

toolNuclei

toolOpenVAS

Discovery contenuti

toolffuf

toolGobuster

toolDirBuster

Offensive e security testing

Web e TLS testing

toolBurp Suite

toolsqlmap

toolsslscan

Simulazione avversaria

toolMetasploit

toolSliver

Sicurezza wireless

toolAircrack-ng

Difesa e detection

Hardening host

toolnftables

toolauditd

toolLynis

Difesa di rete

toolCoraza

toolModSecurity

toolSuricata

Monitoraggio sicurezza

toolWazuh

toolSysmon

toolElastic Security

Sicurezza endpoint

toolVelociraptor

toolosquery

Incident response e SOAR

toolWazuh

toolTheHive

toolShuffle

Architettura di sicurezza

toolWireGuard

toolOpenVPN

toolCloudflare Zero Trust

Application security

SAST

toolSemgrep

toolSnyk

SCA e supply chain

toolSnyk

toolTrivy

toolOWASP Dependency-Check

DAST

toolOWASP ZAP

toolNikto

toolWapiti

Governance e rischio

Compliance e ISMS

governanceNIS2

governanceISO 27001

0b100

Certificazioni e obiettivi raggiunti

Clicca per vedere tutti i badge

HTB Certified Web Exploitation Specialist

Path completato

Hacking in the wild

Hacking WordPress

The eye that sees all

Network Enumeration with Nmap

Do things the traditional way

Introduction to Bash Scripting

Every road leads back to root

File Inclusion

Airborne delivery

File Transfers

DROP your weapon

SQL Injection Fundamentals

Your request is my demand

Web Requests

Combine the modules

Using the Metasploit Framework

Playing with the mess

JavaScript Deobfuscation

Stairway to Heaven

Linux Privilege Escalation

Fuzzing is power

Attacking Web Applications with Ffuf

Crude but effective

JOIN the adventure

SQLMap Essentials

Developer

Introduction to Web Applications

Your first battle

Getting Started

Just a small crack, and you're in

Broken Authentication

Start building your arsenal

Setting Up

Tactical

Penetration Testing Process

Included in every report

Cross-Site Scripting (XSS)

Light in the dark

Vulnerability Assessment

Inject with caution

Command Injections

Dive into requests

Using Web Proxies

You need to trace before you can hunt

Footprinting

Ghost in the shell

Shells & Payloads

Scan and execute

Attacking Common Services

Arachnoid

Web Attacks

Prepare your payload and up you go

File Upload Attacks

Information is not knowledge, or is it?

Information Gathering - Web Edition

Straight to the server

Server-side Attacks

Passwords are not the only way forward

Session Security

You shall not (by)pass

Web Service & API Attacks

Hunt the bug

Bug Bounty Hunting Process

Flaw finder

Intro to Whitebox Pentesting

Endpoint Explorer

API Attacks

Fuzzing guru

Web Fuzzing

Graph invader

Attacking GraphQL

Protocol Breaker

Attacking AI - Application and System

PenguinTracer

Introduction to Linux Forensics

0b101

Scrivimi!

Un'idea, un dubbio, un problema che non sai come risolvere: partiamo da lì.

Scrivimi un'emailinfo@gianlucacaruso.me LinkedIn GitHub