Rodolfo Nunes Lopes

DevSecOps Engineer

Bridge351 | August 2026 - present

• Developing security-related modules for a SaaS, such as authentication, session management, RBAC and GDPR compliance
• Building and managing a self-hosted CI and dev infrastructure with Docker, GitLab Runner, GitLab Container Registry and Portainer. Each merge to the development branch ships automatically: images are built and pushed, the dev environment is redeployed and health-checked
• Building and managing a GitLab CI/CD pipeline from scratch for a NestJS/React monorepo. It runs lint, type checks, builds and about 1,000 unit, API end-to-end and Playwright browser tests on every merge request, and Renovate updates dependencies weekly
• Adding security scanning to every merge request: SAST (Semgrep), infrastructure-as-code scanning (KICS), secret detection and dependency audit. Scan results feed Grafana dashboards so findings can be tracked over time

Technical Consultant for DevOps & Cybersecurity

Bridge351 (client: NOS SGPS group) | February 2025 - August 2026

• Built an API-first, event-driven domain reconnaissance pipeline fanning work out through RabbitMQ to 5 containerized workers, producing structured reports on subdomain exposure, technology fingerprinting and known vulnerabilities. It was adopted for continued development.
• Delivered a breach-monitoring PoC against the Have I Been Pwned API with subscriber notification delivery. It was productized and launched commercially.
• Designed a three-layer malware detonation environment (bare metal > KVM > Kata nested virtualization) to measure recursive zip-bomb impact on CPU, memory and storage under isolation. It was used as internal tool to test vendor technologies.
• Replaced a manual XLSX-based OWASP SAMM v2 assessment process with a full pipeline (web survey > automated document generation), eliminating ~8 hours of manual write-up per assessment across 80 customers.
• Validated and documented dozens of vulnerabilities found by the NOS Offensive Security team against the project’s main application, discovering 6 additional issues during reproduction. Supervised the mitigation strategy implemented by the developers.
• Evaluated AI-driven offensive tooling (Cybersecurity AI, Strix) and briefed the team on applicability and limitations.
• Produced cybersecurity compliance assessments for the Portuguese QNRCS certification framework (both NIS 1 and NIS 2). It was adopted for continued development.

Teaching Assistant (Cybersecurity)

Code for All | September 2023 - February 2025

• Designed and deployed intentionally vulnerable AWS environments for the bootcamp’s offensive exercises that were adopted into the permanent cybersecurity operations curriculum
• Authored lecture content, slide decks and hands-on infrastructure/scripting exercises that were adopted into the permanent cybersecurity operations curriculum
• Delivered lectures on Linux, networking and security operations to 3 cohorts of 14 students
• Provided support for troubleshooting to 3 cohorts of 14 students

Teaching Assistant (Full-Stack Development)

Code for All | January 2023 - September 2023

• Delivered lectures on object-oriented programming and Java software development to 2 cohorts of 25 students
• Provided support for debugging and troubleshooting to 2 cohorts of 25 students

Professor of Philosophy

Universidade de Brasília | 2015 - 2022

• Taught Ancient Philosophy to 14 cohorts of 60 students
• Taught Ancient Greek to 14 cohorts of 60 students
• Supervised 3 master and 2 doctoral research projects
• Published 6 books and 14 scientific articles
• Edited a scientific journal
• Managed a post-graduate programme in Metaphysics
• Full scientific CV available at the Lattes platform

Doctoral Researcher

Universidade de Coimbra | 2009 - 2014

• Developed and implemented a research project on Plato’s philosophy
• Presented current research in conferences

Junior Researcher

Universidade de Coimbra | 2006 - 2009

• Assisted senior researchers
• Implemented a fully digital scientific publisher
• Implemented an e-learning master programme on Classics

Kubernetes Homelab

It is a self-hosted Kubernetes cluster (k3s) that serves 3 publicly exposed apps. It is fully managed through GitOps, and the code is publicly available in a GitHub repository. The main decisions are documented in a dedicated blog tag. It is built AI-native: specifications and design docs are written first, and coding agents implement them under human review.

Webapp fogos

It is a simple SPA, publicly exposed through the homelab, that represents the full path from commit to production. The app code is publicly available and the whole pipeline is explained in a dedicated blog post. It was developed spec-first: the docs define the behaviour, an agent writes the code, and the pipeline’s tests and scans validate it.

Webapp blog

It’s a blog that works as documentation base for the projects. The code is in a public repository and implementation details are available in the about page. It is also worth noting the pipeline to write and publish posts.