Hi! I'm Kfir Gisman. I tackle software engineering challenges as if solving complex puzzles, leveraging my engineering mindset. My forte lies in translating human language requirements into high-level, robust projects, drawing on extensive experience in data analysis, security research, and software engineering. Having worked in successful startup and large corporations, I seamlessly integrate diverse approaches into modern project workflows. Moreover, I share insights on various topics through my Medium blog.

Technical

• Backend: Python, SQL (on MS-SQL and MongoDB, Mongoose), ASP.NET, CCEC. JavaScript and Node.js. Bash.
• OOP: C# and Java (both include GUI). C.
• Cloud: AWS, GCP, Azure, AliCloud. IaC: Terraform, Ansible. CICD Hardening: Github Actions. Docker, K8S.
• Data: Python (pandas), social network analysis (SNA), Knowledge at data analytics life cycle, data preparation, linear and logistic regression, classification and evaluation, random forests, decision trees, KNN, SVM, unsupervised algorithms. Social Network Analysis using ORA and Gephy.
• Frontend: React, HTML, CSS, AJAX, API rest, Firebase, bootstrap, JavaScript.
• Operating Systems: Linux, MacOS, Windows.
  
  

Docker and K8S: Docker Mastery: with Kubernetes +Swarm from a Docker Captain
Node.js: Udemy- The Complete Node.js Developer Course

How to Write an Effective README File — A Guide for Software Engineers- Published in Stackademic. This blog emphasizes the importance of creating clear and comprehensive README files for software projects, highlighting their role in enhancing collaboration, communication, and long-term project sustainability.

Enhancing Software Architecture through Comprehensive Testing in Backend Development- Published in Python in Plain English.Discusses the importance of incorporating comprehensive testing into backend development to ensure code quality and resilience. He explains a three-layered architectural approach (Controller, Service, Data Access) and outlines different types of tests (True Positive, False Positive, Error Handling) to cover a wide range of use cases and scenarios.

Solving Logs Woes: A Small Dive into Singleton Design Pattern- Published in Python in Plain English. Describes my experience incorporating logging into a Python software project, initially encountering difficulties with writing logs from files but overcoming the issue by implementing the Singleton Design Pattern, ensuring a single instance of the Logger class exists throughout the program's execution. They explain the Singleton pattern's concept, implementation in Python, benefits, considerations, and its role in resolving their logging issue, emphasizing streamlined and centralized logging.

Shell injection in GitHub Actions CI/CD- The article describes the security risks of using pull_request_target event in GitHub Actions, and how an attacker can exploit shell injection to run malicious commands or scripts in the workflow.

Motivating the average developer to engage in DevSecOps - Lecture- Presentation at the DevSecOps Spain Community on Docker Security. I offered a hands-on experience for the audience, during which we coded together and investigated vulnerabilities in containers.

Why IMDSv1 is a Security Risk for Cloud Infrastructure- The article discusses the security risks of using IMDsv1, a metadata service for cloud infrastructure, and how an attacker can exploit it to gain access to sensitive information or execute commands on the cloud instances.

Why You Should Disable Cloud Storage Bucket Versioning- The article explains why cloud storage bucket versioning can be a security risk and a performance bottleneck, and suggests some alternatives to achieve data durability and availability.

PyPI Suspends New Registrations After Malicious Python Script Attack- Published in Checkpoint. Supply chain attacks targeting PyPi packages, exemplified by a recent incident involving 44 malicious packages uploaded, underscore the importance of verifying Python code sources to prevent system compromise and data exposure, emphasizing the need for robust security measures like CloudGuard Spectral to safeguard against such threats.