SonarQube

Automated Code Quality and Security

To empower developers and shift security left, I have experience implementing static analysis tools into the development workflow.

At Carousell Group, I was responsible for deploying and configuring SonarQube as the primary Static Application Security Testing (SAST) tool for our engineering teams.

The goal was to provide developers with fast, automated feedback on code quality, security vulnerabilities, and code smells directly within their development lifecycle. By integrating SonarQube into our CI/CD pipelines, we enabled the early detection of potential issues, reducing the likelihood of vulnerabilities making it to production and fostering a culture of code quality and security ownership among developers.

Key Competencies

• SAST Implementation: Deploying and managing a SonarQube instance.
• CI/CD Integration: Integrating static analysis into automated build and test pipelines.
• Developer Enablement: Providing tools that help developers write more secure and higher-quality code.
• Code Security: Understanding of common vulnerabilities and how they can be detected with static analysis.