PAPALIA(1)
contact

Name

cybersecurity engineer, the wildcard (*)

Synopsis

papalia [--comply iso27001|pci-dss|gdpr] [--devsecops sca|sast|dast|iac] [--gate ci-cd] [--troubleshoot infra|network]

get in touch read the case files download the pdf

status: applying for Security Engineer at Bending Spoons

Description

Cybersecurity engineer at Smartness, a hospitality technology company, where I cover what a startup CISO covers, without the title. Before that, three years at NTT DATA on system security for major Italian banks. MSc in Cybersecurity from Politecnico di Torino.

In every company I've worked for, I became the jolly, the wildcard people turn to when a problem doesn't belong to any single team. I adapt quickly and learn fast, and my knowledge runs horizontally across security, infrastructure and networking.

I'm an early adopter of AI and I adapt to its continuous innovation as it happens. My engineering is AI-augmented, mostly through Claude: it boosts my productivity and lets me run several workstreams in parallel. I stay open-minded about new tools and new ways of working.

Code shipped fast and iteratively will inevitably accumulate vulnerabilities if the process around it is not managed. I work and remediate at the same speed code is produced, building secure-by-default guardrails into the delivery pipeline so that velocity and security grow together.

  • security-leadership
  • governance-compliance
  • privacy-gdpr
  • application-security
  • devsecops
  • cloud-security
  • observability
  • infrastructure
  • networking
  • ai-augmented-engineering

Results

ISO/IEC 27001 13% → 94% of controls passing on Vanta, in 6 months not yet audited
DevSecOps ~31,000 SCA, SAST, DAST and IaC findings, in 5 weeks all triaged
CI/CD custom security gate: no new SAST or DAST vulnerabilities in its first month live
PCI DSS payment module security built from scratch, to a strict deadline certified
GDPR 21% → 96% compliance 96%
Self check-in PII and biometric data secured; 99.98% of check-ins decided automatically secured
L3 tickets, NTT DATA 60 → 5 a month, with Dynatrace, Splunk and Snyk -92%

Case files

Three pieces of work from my role at Smartness. The role section maps each of them to the position.

$ papalia --comply iso27001

ISO/IEC 27001: from 13% to 94% of controls passing

I ran the company's ISO/IEC 27001 program from a 13% baseline to 94% of controls passing, tracked on Vanta, in six months. The work covered the information security management system: risk assessment, the Statement of Applicability, policies, evidence collection and internal audit.

The controls are in place and monitored. The company has not been through a certification audit yet.

annex-a.txt

$ papalia --devsecops sca,sast,dast,iac

About 31,000 DevSecOps findings, triaged in five weeks

In five weeks I triaged about 31,000 findings from software composition analysis (SCA), static and dynamic application security testing (SAST, DAST) and infrastructure-as-code scanning (IaC), across software built and shipped at high velocity with AI coding assistants.

Not every finding has a fix, and not every fix is worth its cost, so each one received a risk-based decision: fixed where a fix existed, mitigated with compensating controls where none was available, risk-accepted where no solution existed or remediation wasn't proportionate to the risk, and deferred to the next monthly cycle where it could safely wait.

Then I built a custom security gate into the CI/CD pipeline, so new code is checked before it ships. In its first month, no new SAST or DAST vulnerabilities were introduced.

findings.log

all 31,000 triaged

triage policy

a fix exists
fixed
no fix available
mitigated with compensating controls
no solution, or not worth the cost
risk accepted
can safely wait
deferred to the next monthly cycle

recurring patterns in fast-shipped, AI-assisted code

  • hardcoded secrets
  • missing authorization checks
  • SQL, NoSQL and shell injection
  • permissive CORS
  • insecure defaults
  • hallucinated or outdated dependencies
  • unvalidated input and SSRF
  • secrets and stack traces in logs
  • weak session and token handling
  • misconfigured infrastructure as code

$ papalia --certify pci-dss

A PCI DSS–compliant module

I built the security of a PCI DSS–compliant payment module from scratch and implemented all of its security functionality myself, against a very strict deadline. The module was certified by a third-party assessor, whom I dealt with directly.

PCI DSS is the security standard for any system that stores, processes or transmits payment card data, and it spans 12 requirements, from network security controls to logging, testing and policy.

cardholder-data.flow

PCI DSS v4.0.1 requirements

hover, or tab in and use ↑ ↓ ← →, to see where each requirement appliestap a requirement to see where it applies

Role

Applying for Security Engineer at Bending Spoons. What the role asks for, and the work behind each point.

  1. Find security loopholes

    Across systems and infrastructure, with modern tools, automation and continuous testing.

    About 31,000 SCA, SAST, DAST and IaC findings triaged in five weeks, each one with a risk-based decision. See case file 2.

  2. Assess and protect company data

    Internal security assessments, and the countermeasures that follow from them.

    ISO/IEC 27001 risk assessment, controls and internal audit, from a 13% baseline to 94% of controls passing, and the PII and biometric data in the self check-in engine secured. See case file 1.

  3. Embed security in engineering workflows

    Security controls built into the infrastructure and into the way engineers ship.

    All the security functionality of a PCI DSS payment module, built myself and certified by a third-party assessor (case file 3), and a CI/CD security gate with no new SAST or DAST vulnerabilities in its first month (case file 2).

  4. Turn regulation into technical safeguards

    Working with privacy experts, from regulatory requirements to controls that hold up in production.

    PCI DSS and ISO/IEC 27001 implemented as working controls, and GDPR compliance raised from 21% to 96%.

  5. Track threats and share knowledge

    Emerging vulnerabilities and attack techniques, followed closely and explained to the rest of the company.

    At NTT DATA, frontman of the cybersecurity team and responsible for the human side of security; L3 tickets cut from 60 to 5 a month with Dynatrace, Splunk and Snyk. See the history.

  6. Work AI-first, in a small autonomous team

    A company that builds AI into its work and relies on small, talent-dense teams.

    An early adopter of AI, with engineering augmented through Claude that boosts my productivity. Open-minded, used to delivering with little guidance, and at home in small, talent-dense teams. See the description.

History

At NTT DATA I worked on system security for major Italian banks, as the team's wildcard for problems that crossed systems, infrastructure and security. I was the frontman of the cybersecurity team, also responsible for the human side of security, and I cut L3 tickets from 60 to 5 a month with Dynatrace, Splunk and Snyk.

2026 - now
cybersecurity engineer, Smartnesshospitality technology
2023 - 2026
cybersecurity system engineer, NTT DATAconsulting for major Italian banks
2018 - 2023
software developer
2025
MSc, Cybersecurity, Politecnico di Torino
2023
BSc, Computer Engineering, Politecnico di Torino
tools
Snyk, Vanta, Upwind, Falco, GCP, AWS, GitHub, Dynatrace, Splunk
languages
Italian, native. English, C1

Contact

I would welcome a conversation about the Security Engineer role, and I'm glad to go deeper into any of the case files. LinkedIn is the quickest way to reach me.

linkedin
linkedin.com/in/luigi-papalia

Or open the shell (ctrl+kthe >_ button) and type contact.