$ whoami lucas-oliveira-dantas $ cat profile.yaml role: DevOps · SRE · Cloud focus: DevSecOps and software supply chain security experience: 10+ years in IT based in: Rio Grande do Norte, Brazil blog: writing since 2019 lattes: lattes.cnpq.br/8767989273085683
Hi! 👋 I’m Lucas Oliveira, a technology professional with more than a decade of experience in DevOps, SRE and Cloud. My job is getting software to production fast, safely and reliably: pipelines, containers, Kubernetes, infrastructure as code and, more and more, security across all of those stages.
I started like many people in this field: spending hours in front of the computer, creating virtual machines and hosting simple pages just for the joy of seeing them work. That enthusiasm led me to AWS, Azure and GCP, to the cloud native ecosystem and, more recently, to DevSecOps, where most of my studies are focused today.
This blog is where I document what I learn in practice: real problems, tested solutions and the reasoning behind them. Most articles are written in Portuguese; you can read them through the machine translation links at the top of each post.
What I do
🛡️ DevSecOps
SAST with Semgrep and SonarQube, image scanning with Docker Scout, SBOM, SLSA and secrets management with Vault and Terraform.
🔁 CI/CD & GitOps
Pipelines on GitLab CI, GitHub Actions, Azure DevOps and Harness, with reusable templates and well-designed cache and artifacts.
☸️ Containers & Kubernetes
Docker from Dockerfile to production, autoscaling with HPA, pod priority and cluster troubleshooting.
☁️ Cloud & IaC
AWS (including serverless with SAM), GCP and Azure, with infrastructure versioned in Terraform and Ansible.
Everyday stack
- Languages
- PythonJavaScriptNode.jsShell
- Containers
- DockerDocker ComposeKubernetes
- CI/CD
- GitLab CIGitHub ActionsAzure DevOpsHarness
- Cloud & IaC
- AWSGCPAzureTerraformAnsible
- Security
- SemgrepSonarQubeDocker ScoutVault
- Observability
- PrometheusGrafanaElasticsearch
- Data
- PostgreSQLMongoDB
Where to start
A few articles that represent what I write about (in Portuguese):
- Onboarding AI-generated applications: the real cost for DevSecOps
- Scanning the code: automating SAST with Semgrep and GitLab CI
- Exploring Docker Scout: analyzing and hardening Docker image security
- Protecting secrets in Terraform
- Artifacts vs. cache in GitLab: optimizing your pipeline
In English: HPA based on CPU and memory utilization.
Academic background
Beyond hands-on practice, I value a solid academic foundation and formal learning. My education and career are recorded in my Lattes CV, the official platform of CNPq (Brazil’s National Council for Scientific and Technological Development) that gathers the academic and professional history of researchers and professionals in Brazil. It’s in Portuguese.
Lattes CV · CNPq lattes.cnpq.br/8767989273085683 ↗Projects and community
- AI-assisted software supply chain security: I’ve been building a tool for vulnerability scanning, SBOM generation and SLSA verification with AI-generated explanations. See a preview on X.
- Cloud native community in RN: I follow and take part in the events of Cloud Native RN, the CNCF community group in Rio Grande do Norte.
- Open source: examples and scripts from the articles live on GitHub and GitLab.
Let’s talk
Want to chat about DevOps, security or one of the articles here? Reach out (all channels are on the Links page):