Vernon Simões

Driving application security initiatives across multiple squads, embedding security into the software development lifecycle and partnering with product and engineering teams.

• Lead AppSec and SSDLC initiatives including threat modeling, secure development practices and continuous improvements to security processes.
• Guide developers on secure coding and remediation approaches, translating complex findings into practical, actionable steps.
• Improve SAST and DAST processes, reducing false positives and increasing signal-to-noise ratio in automated pipelines.
• Collaborate with cross-functional teams (risk, SRE, DevSecOps, infrastructure) to validate vulnerabilities and support secure design decisions.
• Contribute to vulnerability management workflows, risk analysis and mitigation plans for on-premise and cloud environments.
• Deliver workshops and internal training sessions to strengthen security awareness and build a security-first engineering culture.
• Align security requirements and controls with business goals, industry standards and regulatory expectations.

Worked on application and infrastructure security assessments combined with GRC and IT General Controls (ITGC) engagements for clients in different industries.

• Performed penetration tests and technical security assessments on applications and infrastructure, identifying risks and proposing remediation.
• Acted on GRC and ITGC projects, reviewing IT general controls, performing risk assessments and documenting evidence for audits.
• Developed and refined security policies, standards and procedures aligned with regulatory requirements and industry frameworks.
• Collaborated with engineering teams to implement secure coding practices, threat modeling and security risk evaluations.
• Used tools such as Burp Suite, Nmap and Metasploit to identify and validate common web and infrastructure vulnerabilities.
• Delivered clear, actionable security recommendations and supported clients in prioritizing security improvements.

Conducted penetration tests and security assessments for enterprise clients, supporting GRC and compliance efforts.

• Executed pentests and security assessments on applications and systems, focusing on risk and business impact.
• Contributed to security GRC initiatives by helping design and improve security policies, standards and controls.
• Produced technical and management reports, translating vulnerabilities into understandable risks for stakeholders.
• Worked closely with clients to address security issues and define realistic, improvement-focused action plans.

Legal consulting with an emphasis on digital crimes, financial crimes, due diligence and asset investigation.

• Supported clients in complex investigations involving technology, privacy and regulatory risk.

Focus on software architecture, microservices, distributed systems and secure-by-design patterns.

Program focused on cybersecurity, offensive security, defensive strategies and incident response.

Research on fundamental rights, privacy and legal aspects of risk.

Law degree with exposure to financial regulation and compliance.