My apprenticeship at IT-Development

Overview

I did my apprenticeship at IT-Development as a DevSecOps Expert. My role: help secure the company's web and mobile applications by running security audits and penetration tests, and by putting lasting security solutions in place.

The company

IT-Development (ITD) is a software company that markets innovative solutions for mobile network operators and towercos.

The team is made up mostly of developers, DevOps engineers and business analysts, and numbers around 50 people.

What I did

Penetration testing

ITD brings in an external security auditor to run penetration tests on its applications. My role is to prepare these audits, guide the auditor through the product, and make sure the fixes are implemented.

I also run regular internal penetration tests: by spending more time than the external auditor, I can look for deeper flaws and follow their remediation over time.

DevSecOps

I help industrialise security across the development cycle: automated vulnerability scanning in the CI/CD pipeline (Jenkins), automated penetration testing, and container security (Kubernetes). The goal is for security to be built in continuously, not to depend on a one-off intervention.

Development

I also write code, mostly backend, to fix vulnerabilities myself when they fall within my scope. This introduced me to Java and the Spring Boot framework: I strengthened the validation of user-uploaded file types and fixed path traversal flaws, for example.

Understanding how flaws appear in code is, to me, the best way to detect them — and that's exactly what this dual pentest/development role lets me do.