Generalized professional case study
Security Automation Platform
A professional application-security program translated into repeatable DAST workflows for different protocols, application shapes, and Kubernetes-based delivery environments.
- Role
- Sr. Application Security Engineer
- Context
- The work covered enterprise application-security automation, cloud-security integration, operational design, finding review, and rollout planning. Employer-sensitive implementation details are intentionally generalized.
- Current status
- Professional engagement completed in June 2026; the public case study records the engineering decisions without internal topology, findings, or proprietary code.
Challenge
A useful DAST program had to move beyond one scanner and one application shape. Monolithic and service-oriented applications required different preparation and protocol handling, while security teams needed repeatable execution, review, documentation, and adoption paths.
Architecture
Boundaries before implementation detail.
The system is organized around explicit responsibility, durable state, and observable handoffs.
Application readiness
Prepare the application and its test environment according to its architecture and protocol surface.
Tool routing
Select Burp Suite, OWASP ZAP, or grpcurl based on the interface and test objective rather than forcing one scanner everywhere.
Coordinated execution
Run repeatable workflows around the application lifecycle and Skaffold-based environments.
Finding review
Route results into a controlled analysis and triage workflow, including Strix-assisted review.
Operational adoption
Support the technical system with rollout plans, documentation, ownership, and mobile-testing readiness.
Key decisions
Decisions that shape the product.
Each choice defines a boundary the system can explain, test, and evolve.
Protocol-specific tooling
Burp Suite and OWASP ZAP addressed web application surfaces, while grpcurl supported explicit gRPC testing workflows.
Application-aware workflows
Execution design accounted for monolithic and service-oriented systems instead of treating every application as the same target shape.
Review as part of the pipeline
Finding analysis and triage were modeled as operational stages, with Strix supporting review rather than replacing security judgment.
Adoption is an engineering deliverable
Operational designs, rollout plans, documentation, environment preparation, and vendor coordination were part of the system—not afterthoughts.
Security considerations
Security is part of the system model.
Controls sit at data, identity, execution, evidence, and disclosure boundaries.
Controlled environments
Scanning depends on prepared, authorized environments and does not expose internal endpoints or sensitive configuration publicly.
Protected findings
Vulnerability evidence and triage context remain inside approved review paths; this case study contains no confidential finding data.
Tool boundaries
Each scanner is used for the protocol and workflow it supports instead of broadening execution beyond the stated test objective.
Cloud integration hygiene
Wiz connectors and sensors were deployed across Kubernetes infrastructure without publishing private cloud topology or credentials.
Result / current status
The engagement produced automated scanning workflows, an operational DAST design, technical documentation, rollout plans, cloud-security integrations, and mobile application security testing readiness work.
Current limitations
- The public case study omits employer infrastructure, repositories, hostnames, proprietary implementation details, and vulnerability data.
- No quantitative adoption, finding, coverage, or performance claims are published.
- Detailed discovery and seed-extraction mechanics are not described because the supplied source does not confirm them.
Lessons
What carries forward.
- DAST orchestration must account for application architecture and protocol differences.
- Finding review, documentation, and rollout planning are part of the platform boundary.
- Automation is useful when it makes security work repeatable without hiding operator judgment.