Jesus Salcedo

• ● Designed and maintained a SaaS platform serving restaurants and residential users, developing responsive web and cross-platform mobile applications using React and AI integration, while architecting scalable, high-performance backend services with FastAPI and Firebase. Conducted comprehensive security audits leveraging SAST, DAST with Tools such as Bandit, SonarQube, Burpsuite, and targeted penetration testing to identify and remediate critical vulnerabilities.

• ● Develop and contribute to an open-source educational project focused on penetration testing and offensive security, featuring CTF-style challenges within intentionally vulnerable web applications and APIs. Using FastAPI and Jinja2 templates and DevOps on AWS cloud with Docker and CI/CD focused on security.

• ● Built and hardened a courier service mobile application (React Native Expo, Node.js), implementing input validation, authentication flows, and secure REST APIs to reduce injection risks and improve resilience against common OWASP Top 10 threats.

• ● Refactored and deployed a grief-support mobile app (React Native CLI, Express, Firebase), applying token-based authentication and backend hardening.

• ● Integrated third-party services (Google Maps API, Algolia) with controlled access, secure query handling, and input filtering to prevent data exposure and abuse of external APIs.

• ● Developed and maintained web platforms (Next.js, Vue.js, WordPress), enforcing HTTPS, secure HTTP headers, dependency and plugin reviews, and integrating basic security checks into CI/CD pipelines.

• ● Refactored and secured Catasig Geoserver web interfaces (Vue.js) and backend services (Python/Django), implementing input validation, data integrity controls, and safeguards against unsafe deserialization.

• ● Developed the Reconocimiento Catastral mobile application (React Native), implementing geolocation features and secure authentication flows.

• ● Built the Avalúo Catastral Admin Panel (Node.js, NestJS), applying secure file handling, data validation, and controls to mitigate injection and deserialization risks.

• ● Integrated DevSecOps practices across projects, including static and dynamic analysis, dependency scanning, CVE remediation, and security checks within CI/CD pipelines.