Tempor nesciunt consectetur quia elit sint
07
Stephen Faulkner
Tasha Crawford- Jolie Stephenson
- Caesar Cox
- Jameson Charles
Porter Weber- Brianna Madden
Software engineer, fullstack and DevSecOps. I design, secure and deploy web products end to end, from the business need to production under monitoring.
Conan Chavez
Quaerat possimus libero commodi aut et quae est rerum ullam animi ea expedita dolores quam
About
About
Conan Chavez, software engineer. Dolor in enim nesciu
- Quaerat possimus libero commodi aut et quae est rerum ullam animi ea expedita dolores quam
- Experience
- 1980 years
- Based in
- Incidunt aperiam ipsa incididunt esse veniam maiores
- Design
- Build
- Secure
- Deploy
I like systems that keep their promises: a readable architecture, reviewed code, automated delivery and security built in from the design stage, from the first workshop with the business to monitoring in production.
02Approach
From need to production
Eight steps, a single loop: the one in the monogram. Each step points to what proves it on this site.
-
01
Understand
Analyse the business need and its constraints, then restate it as verifiable requirements.
See the proof -
02
Design
Model the data, split the architecture into modules, justify every technical choice.
See the proof -
03
Build
From secure APIs to responsive interfaces: Django, NestJS, React, Flutter.
See the proof -
04
Test
Use tests to lock down access control and every regression already encountered.
See the proof -
05
Secure
Authentication, role-based access control, rate limiting, secrets out of the code.
See the proof -
06
Automate
CI/CD pipelines: checks, image build and deployment with no manual step.
See the proof -
07
Deploy
Docker containers, Kubernetes orchestration, GitOps deployment with ArgoCD.
See the proof -
08
Operate
Health checks, actionable logs and continuous maintenance in production.
See the proof
03Expertise
From code to infrastructure
A cross-cutting skill set: designing the application, industrialising it and securing it, with a single point of contact.
Tools I master
List kept up to date from the dashboard; it also feeds the CV.
04DevSecOps
Security is a stage, not a final audit.
13 stages, from the first line of code to monitoring. For each: the practice and where I actually applied it.
Stage 01 of 13
Source code
Readable, well-structured, reviewed code is the first barrier against bugs and vulnerabilities alike.
What I do
- Modules with clear responsibilities, explicit naming
- Strict server-side input validation
- Code review and mentoring
Proof
No tool for this stage is cited in a published experience yet.
On this siteDjango code organised into services, selectors and views; validation and permissions enforced server-side.
Stage 02 of 13
Git
History is the source of truth: every change is traceable, reviewed and reversible.
What I do
- One branch per feature, merged through merge requests
- Explicit commit messages
- No secrets under version control
Proof
No tool for this stage is cited in a published experience yet.
On this sitedevelop (staging) and main (production) branches: every push triggers the GitLab pipeline.
Stage 03 of 13
CI/CD
Every change goes through the same automated chain before reaching an environment.
What I do
- Declarative pipelines, versioned with the code
- Fail fast: checks before the build
- Automatic deployment per branch
Proof
No tool for this stage is cited in a published experience yet.
On this siteGitLab CI pipeline: Python code checks, static file integrity, FR/EN/AR translation completeness, then deployment.
Stage 04 of 13
Build
A reproducible artefact, built once and promoted from one environment to the next.
What I do
- Multi-stage images, no build tools in production
- Locked dependencies
- Assets compiled when the image is built
Proof
No tool for this stage is cited in a published experience yet.
On this siteMulti-stage Docker image: translations compiled and static files collected at build time.
Stage 05 of 13
Tests
Tests lock in critical behaviour and every regression already encountered.
What I do
- Access control verified on every sensitive route
- Targeted regression tests
- Tests run before shipping
Proof
No tool for this stage is cited in a published experience yet.
On this siteDjango test suite: dashboard access control, SEO, translations, media relay, rate limiting.
Stage 06 of 13
Static analysis
Catch early what a review lets through: errors, broken references, dangerous patterns.
What I do
- Systematic syntax checks
- Automated integrity checks
Proof
No tool for this stage is cited in a published experience yet.
On this siteEvery pipeline compiles all the Python code and detects broken asset references.
Stage 07 of 13
Dependencies
Every dependency is an attack surface: it must be known, pinned and justified.
What I do
- Pinned versions
- A dependency is only added when it is justified
- Updates reviewed before merging
Proof
No tool for this stage is cited in a published experience yet.
On this siteAll Python dependencies are pinned to an exact version.
Stage 08 of 13
Security controls
Authentication, authorisation and API endpoint protection are designed into the architecture, not added at the end.
What I do
- Role-based access control and defence in depth
- Rate limiting on sensitive endpoints
- Encryption, audit log, secrets kept out of the code
Proof
No tool for this stage is cited in a published experience yet.
On this siteNonce-based Content-Security-Policy, lockout after failed logins, contact form rate limiting, HSTS, secure cookies and sanitised rich content.
Stage 09 of 13
Containerisation
The same environment, from the developer’s machine to production.
What I do
- Minimal images running without root privileges
- Container health checks
- Secrets injected at runtime, never baked into the image
Proof
No tool for this stage is cited in a published experience yet.
On this siteContainer run without root privileges, HTTP health check, no secrets in the image.
Stage 10 of 13
Registry
Images are stored, versioned and traced before any deployment.
What I do
- Images tagged by version
- Restricted registry access
Proof
No tool for this stage is cited in a published experience yet.
Stage 11 of 13
Deployment
Deploying should be boring: automated, repeatable and reversible.
What I do
- GitOps: the desired state is versioned
- Staging before production
- Version-based rollback
Proof
No tool for this stage is cited in a published experience yet.
On this siteAutomatic deployment over SSH then Docker Compose: develop to staging, main to production.
Stage 12 of 13
Orchestration
The platform guarantees service availability and scaling.
What I do
- Declarative deployments
- High availability
- Separate configuration per environment
Proof
No tool for this stage is cited in a published experience yet.
Stage 13 of 13
Observability
You can only fix well what you can see: service health, logs, alerts.
What I do
- Application health checks
- Actionable logs, free of sensitive data
Proof
No tool for this stage is cited in a published experience yet.
On this siteDocker health checks and application logs on standard output.
Architecture of this site
Browser
Reverse proxy · TLS
Gunicorn · Django
PostgreSQL
MinIO · private bucket
The reverse proxy handles TLS termination. Django enforces HSTS and a nonce-based CSP, and rate-limits the forms.
Media stay in a private bucket: Django streams them, with immutable caching and support for partial requests.
Every push triggers GitLab CI: it checks the code, then deploys the Docker image to the server.
On the command line
Annotated excerpts of this site’s operations. Static demonstration: nothing is executed from this page.
Scroll: the tabs follow one another.
# Update the server to the pushed branch
ssh -p "$SERVER_PORT" "$SERVER_USER@$SERVER_IP" \
"cd $APP_DIR && git fetch origin && git reset --hard origin/$CI_COMMIT_REF_NAME"
# Rebuild the image and replace the container
docker compose build --no-cache
docker compose up -d --force-recreate --remove-orphans
# The container health check queries the application
curl -fsS http://localhost:8000/ > /dev/null && echo ok
# Service status and recent logs
docker compose ps
docker compose logs --since 10m django
# Configuration audit before going live
python manage.py check --deploy
# Security headers actually served
curl -sI "$SITE_URL/fr/" | grep -iE '^(strict-transport|content-security|x-content-type)'
Variables ($SERVER_IP, $APP_DIR…) are provided by the CI: no secret appears in the repository.
05Projects
Selected projects
Work presented as case studies: context, architecture, security and delivery.
No projects found for this category.
Published projects will appear here.
06Career
Career
Each mission details the context, the responsibilities and the technologies actually used.
Degrees and certifications
07Gallery
In the field
Conferences, workshops, mentoring: the moments when work is shared.
Published activities will appear here.
08Journal
Journal
Articles, theses and documents: what I learn and document along the way.
No publication yet.
09Contact
Let's talk about your project
Permanent role, freelance mission, technical partnership or a simple question: I reply personally to every message.
qytycam@mailinator.com
+1 (292) 589-1584Phone
LinkedIn
GitHub
GitLab
Download CVPDF
Incidunt aperiam ipsa incididunt esse veniam maioresLocation