CV PDF
DevSecOps & Enterprise Architecture Aug – Sep 2026

Marjane Enterprise IT & DevSecOps Platform

End-to-End Enterprise Hardware Management System with Automated Multi-Stage GitLab DevSecOps CI/CD Pipeline

Organization: Marjane Menara (Marjane Groupe)
My Role: DevSecOps Engineer & Backend Developer
View Source Code
4 Automated Gates Security Scanners
0 Critical Findings Vulnerability Target
Automated Docker Rollout Deployment Strategy
Strict RBAC Access Control

Project Overview

With my team, I helped build an internal platform to digitalize IT equipment management (requests, approvals, purchase orders, deliveries).

I worked on the Spring Boot API side, adding authentication and role-based access (so each user only sees and does what their role allows).

I also set up the DevSecOps part: a GitLab CI/CD pipeline with SAST (Semgrep), dependency scanning (OWASP Dependency-Check), secret detection (Gitleaks), and container scanning (Trivy) — deployed with Docker on an Ubuntu server with zero-downtime rollout.

System & Infrastructure Architecture

  • Developer Workstation: Git flow pushing commits to the GitLab repository.
  • GitLab SaaS Runner: Executes automated multi-stage pipeline (Build -> Test -> Semgrep -> OWASP -> Gitleaks -> Trivy).
  • Target Production Server (Ubuntu 24.04 LTS): GitLab Shell Runner pulls images and deploys hardened containers.
  • Docker Services: marjane-front (Nginx:8081), marjane-back (Spring Boot:8080), marjane-db (PostgreSQL:5432).

DevSecOps & Security Enforcement

  • Shift-Left Security: Code cannot reach the staging/production environment without passing all security gates.
  • Secret Detection: Gitleaks verifies no hardcoded JWT secrets, API tokens, or database credentials exist in git history.
  • Container Hardening: Trivy audits OS layer libraries and package dependencies inside the generated Docker image.
  • RBAC Enforcement: Endpoints protected by @PreAuthorize annotations tied to validated JWT claims.

Measurable Outcomes & Key Takeaways

  • 100% automated CI/CD pipeline enforcement: zero unauthorized or unscanned commits reach production.
  • Achieved 0 high/critical vulnerabilities across container images prior to production runtime rollout.
  • Implemented immutable chronological audit logging for all equipment transitions and approval events.
  • Seamless deployment on Ubuntu Server 24.04 with Docker health check verification.