Case study · Security operations

Security Operations Manager

A security operations team was triaging thousands of scanner findings in a spreadsheet and creating every remediation ticket in Jira by hand. I built the web app that replaced both, alone, from the parsers to the AWS infrastructure.

Role: Sole engineer: design, frontend, backend, infrastructure, tests
Users: A security operations team
Stack: React 19, TypeScript, AWS Lambda, DynamoDB, Cognito, S3, CloudFront, CDK
Replaced: A shared spreadsheet and manual Jira ticket creation

Issue list showing site, issue, severity, age, SLA status, Jira ticket and status for each finding — ISD issues in one list, with each SLA and Jira ticket. All screenshots use demo data; client names, hosts and account details are placeholders.

The problem

Findings arrived from different tools: Nessus vulnerability scans, CIS benchmark checks (through Prowler) and ISD reports. Each tool exports a different format. They were tracked in a spreadsheet with thousands of rows, so it was hard to see which findings were past their SLA, which ones were duplicates across sites, and which ones already had a ticket. Every ticket was then typed into Jira by hand.

What I built

Import from every tool. CSV and S3 imports for Nessus, Prowler/CIS and ISD, with a column-mapping editor when an export changes shape.
One normalized model. A shared TypeScript package parses and normalizes each format, and both the web app and the API use it, so the parsing rules live and get tested in one place.
SLA tracking. Due dates by severity, a warning before they're due, and an overdue view the team can work from.
Grouped Jira tickets. Related findings are grouped into one ticket and created in Jira from the app, with a sync job that brings ticket status back.
Reports. Excel and PowerPoint exports for the summaries the team used to build by hand.
Exceptions, patching and scan comparison. Accepted risks tracked as exceptions, patching status per account, and a diff between two Nessus scans.

One module per scanner

Each source has its own module with a dashboard, a findings list, SLA flags and Jira ticket generation: ISD security issues, Nessus vulnerability scans, and CIS benchmark checks from Prowler. Patching schedules, monthly reports and security exceptions sit next to them.

Nessus module findings list with risk, host, port, vulnerability and CVE, age with SLA flag, ticket and status — Nessus: findings by host and port with the CVE, age against the SLA, Jira ticket and whether the finding is new or persisting across scan cycles.

CIS Prowler module overview with failed and passed checks, critical and high counts, findings with tickets and accepted risks — CIS (Prowler): failed and passed benchmark checks per client, AWS profile and region, with ticket coverage and accepted risks.

SLA tracker with counts for overdue, due soon, on track and completed, and an SLA compliance bar — The SLA tracker: what's overdue, what's due soon, and overall compliance.

Key decisions

Serverless, so there's nothing to patch

A security team shouldn't have to maintain servers for its own tooling. The API runs on Lambda behind API Gateway, data is in DynamoDB, and the frontend is served from S3 through CloudFront.

Validate at the edge, log every change

Every API handler checks its input against shared Zod schemas before touching the database. Logins go through Cognito with role groups, and changes are written to an audit log.

Infrastructure as code, with a brake on production

The whole stack is AWS CDK, with separate staging and production. Production deploys stop for approval when a change widens permissions.

Ticket summary grouping findings into tickets, with Sync to Jira and Export buttons — Ticket summary: findings grouped into tickets, synced with Jira, exported for reporting.

How I know it works

Unit tests for the import parsers, every API handler and the CIS ticket grouping (Vitest).
13 end-to-end test suites in a real browser (Playwright), covering login, imports and each module.
CI in GitHub Actions: type checks, lint, tests and a full build of all three packages.

Outcome

The spreadsheet and the manual ticket work are gone. Triage, SLA tracking and ticket creation now happen in one place, which saves the team a lot of time on every scan cycle.

This page and its screenshots come from a sanitized copy of the project. Company and client names, domains, emails and AWS account details are replaced with placeholders.

Need something like this?

I build internal tools and serverless backends on AWS, and I'm open to full-time roles.

Email me Next: Medical records →