Christopher Cortes-Sanchez
Open to AppSec & DevSecOps roles
NYU Tandon · BS Computer Science '26
CompTIA Security+ certified

Christopher
Cortes-Sanchez

Application Security and DevSecOps Engineer

I build Python security automation for apps, cloud, and CI/CD, and I test it against live systems and real attack data. NYU CS graduate, Security+ certified, looking for Application Security and DevSecOps Engineer roles.

View Projects Contact Me GitHub ↗
chris@sec: ~
interactive
chris@sec:~$ whoami
christopher-cortes-sanchez
Role : Application Security / DevSecOps
School : NYU Tandon, BS Computer Science
Cert : CompTIA Security+ (SY0-701)
Status : Open to opportunities
  • 193,139
    real attack events analyzed
  • 37→2
    app risk score, out of 100
  • 26
    CIS Benchmark controls automated
  • 6
    OWASP Top 10 classes found and fixed

chris@sec:~$ ls projects/

Projects

01Dec 2025 – Jan 2026

SafeBuyr E-commerce Security Platform

Python · Flask · Docker · GitHub Actions
  • Built an 8-phase automated security scanner for a live Flask/Docker e-commerce app that identified and fixed 6 OWASP Top 10 vulnerability classes, reducing risk score from 37/100 to 2/100.
  • Proved each vulnerability was exploitable before fixing it, then verified each fix held, producing an audit trail across SQL injection, XSS, CSRF, session management, input validation, and password storage.
  • Embedded all 6 checks into GitHub Actions so no deployment passes without clearing every test, enforcing encrypted password storage, SQL injection prevention, and CSRF protection at the CI layer.
View on GitHub →
02Mar 2026

AWS Cloud Security Posture Management (CSPM) Tool

Python · AWS · boto3 · GitHub Actions
  • Built a CSPM tool that checks 26 CIS Benchmark v1.5.0 controls across AWS (IAM, S3, CloudTrail, EC2, password policy) and generates a prioritized remediation report, replacing manual configuration review.
  • Caught 4 real security gaps in a live AWS account, including disabled audit logging and a password policy below industry minimums, using a 0-100 risk score to prioritize fixes.
  • Verified every update against 36 moto-mocked test cases in CI without a live cloud environment, keeping credentials out of the pipeline while maintaining full coverage on every push.
View on GitHub →
03Mar 2026

Honeypot Threat Intelligence Pipeline

Python · Elasticsearch · DigitalOcean
  • Deployed a multi-sensor honeypot and built a pipeline that analyzed 193,139 real attack events and identified two active threat campaigns without manual triage: a Solana credential harvesting operation and a Mirai-variant botnet.
  • Logged attacks from 6,713 unique IPs across Cowrie (SSH), Dionaea (malware), and Honeytrap (service emulation) sensors, producing structured threat reports a security team could act on directly.
  • Pinpointed Netherlands-based VPS infrastructure as the source of 37% of observed attacks, catalogued 62,201 distinct malware samples, and grouped attacker activity into 8 clusters, surfaced in HTML and JSON reports.
View on GitHub →

chris@sec:~$ cat experience.log

Experience

Peer Tutor
NYU Opportunity Programs · Brooklyn, NY
Jul 2023 – May 2026
  • Achieved a 100% course pass rate across 20+ students over multiple semesters by delivering individualized Python, Precalculus, and Calculus tutoring with targeted debugging walkthroughs.
  • Translated complex programming defects into structured root-cause analyses, developing written clarity directly applicable to vulnerability disclosure reports and security incident documentation.
  • Designed 50+ practice exercises across Python debugging and mathematical problem-solving, applying iterative feedback to identify and close individual skill gaps.

chris@sec:~$ cat skills.txt

Skills

Application Security

OWASP Top 10 SQL Injection XSS CSRF Fuzzing (libFuzzer, AFL++)

Security Tools

Burp Suite Wireshark Splunk Elasticsearch Nmap

Languages & Frameworks

Python C/C++ JavaScript Bash SQL Flask Django

DevOps & Cloud

Git GitHub Actions Docker AWS Linux

chris@sec:~$ cat background.md

Education, Certs & Community

Education
New York University Tandon School of Engineering
B.S. in Computer Science · Minor in Cybersecurity and Mathematics
May 2026 · Brooklyn, NY

Relevant coursework: Application Security, Offensive Security, Network Security, Operating Systems

Certification
CompTIA Security+
SY0-701
Issued June 2026
Active
CTF Competitions
  • SHPE 2025 National Convention Cybersecurity Challenge 8th place
  • Buckeye CTF
  • NYU Offensive Security Weekly Challenges
Community
SHPE NYU Tandon, External Relations Committee
Jan 2026 – May 2026

Contacted about 15 companies to build the chapter's first external relations function; secured Turner Construction for a resume workshop and organized a joint event at Columbia drawing 20–30 members.

chris@sec:~$ ./connect.sh

Let's Connect

I'm looking for Application Security and DevSecOps Engineer roles. If you're hiring, or just want to talk through one of these projects, reach out.

email [email protected]
linkedin linkedin.com/in/christopher-cortes-sanchez github github.com/ChrisCortesSanchez