CSSLP · Software Engineer · Security with integrated AI (continuity, not a pivot)

Automate the repeatable; integrate AI where judgment matters.

Computer Engineer (UPV). I help teams ship with secure, auditable AI in the pipeline — hooks, CI, SBOM, local LLM gateways when sovereignty matters. Deterministic checks where traceability matters; agents and LLMs where judgment earns its place.

Proof: −37% dev · −27% ops · +20% tests · homelab BIP · Stack&Flow OSS

Now: Between roles · CCA-F ✓ · CSSLP (validation in progress) · homelab BIP + OSS

• Secure delivery in the pipeline — hooks, CI, SBOM, SDL; the bar lives in the system, not in someone's good day
• Secure & sovereign AI — CCA-F, local LLM gateways, agents where judgment matters; scripts and MCP where auditability matters
• Automation that holds the bar — Plop, standards, monorepo discipline, repeatable releases

Self-hosted sovereign lab: Forgejo, Traefik, Nextcloud, Vaultwarden, local LLMs — build-in-public on borjalofe.com.

• Own the stack end to end when cloud defaults are not the answer
• Forgejo as primary git; CI and mirror strategy as portfolio evidence
• Local inference and logging as a sandbox for secure AI integration

Stack & Flow workshop: i18n in Next.js with react-i18next.

• Hands-on path for teams that need i18n without reinventing the wiring each time
• Part of the Stack&Flow OSS thread (community + reusable tooling)
• TypeScript-first, aligned with real product constraints

Plop pack for repeatable, reviewed git commits.

• Codegen with gates instead of one-off commit messages
• Fits the same "lazy toolset" idea: structure beats motivation
• Small surface, easy to audit — good fit for portfolio signal

• Hello, content repo — 2026-09-14

• Stack & Flow — organizer (Jul 2025–present). Real-world projects, AI in dev workflows, shared learning.
• ISC2 Spain Chapter — active member (Sep 2024–present). Security community, CPEs, events.

Recent roles, security + AI angle. Titles reflect what I did — not "Product Engineer."

Apr 2025 – Jun 2026 · Remote

• Split front and back for least-privilege and need-to-know; less exposure of sensitive logic and data
• Frontend monorepo architecture aligned with user stories; PlopJS + CI for repeatable codegen
• Multi-stage Dockerfiles (hardening + code signing); Cursor for speed with architectural review

Nov 2024 – Mar 2025 · Valencia · On-site

• Bitwarden Enterprise password-security protocol rollout
• Monorepo migration (four Next.js apps + WordPress): Git hooks, complex CI, automated deploys
• +20% unit test coverage; AI-assisted changelogs and release notification flows

Sep 2022 – Nov 2024

• CI standard: ESLint, SonarQube, Trivy, Grype, DefectDojo; observability in DefectDojo, Sentry, Jira
• Unified Git hooks, integration approach, Makefile, template repos; real SDL (CVEs tied to HTTP methods, API/front redesigns when needed)
• Docker rootless; React/Next.js, NestJS/FastAPI, PostgreSQL, OpenSearch across the stack

Languages & frameworks

Security & DevSecOps

AI & tooling

Infra

Valencia, Spain · ES / EN

borjalofe.com · LinkedIn · im@borjalofe.com