Kriptos

Kriptos Inc., based in Miami, makes a data security platform that uses AI to find and classify sensitive documents across endpoints, servers and cloud storage. From October 2024 to March 2026 I worked there remotely, on contract, as a frontend developer and cybersecurity analyst. The two roles fed each other: the security work showed where the code was weak, and the frontend work let me fix part of it myself.

Its Update Manager platform is used by enterprise clients, including Latin American banks, to deploy and monitor Windows security agents across thousands of endpoints.

A SOC 2 Type II report describes how a company's security controls operated over a period of time, which makes the state of its code part of the evidence. I supported the company's certification by triaging the findings that three tools reported across more than 220 repositories. The company's website now shows a SOC 2 Type 2 compliance badge for 2025.

• SonarCloud: static analysis of the source code
• Amazon Inspector: vulnerability scanning on AWS
• Hexstrike: AI-assisted security testing
• Triage: confirming whether a finding is real, judging its severity and finding the team that owns the code

A triaged finding is only useful once someone fixes it. I coordinated remediation with the development teams: each finding went to the team that owned the code, with enough context to act on it, and stayed open until it was fixed and confirmed. For a certification, that loop matters as much as the fixes themselves, because the auditor looks at how findings are handled over time.

In the main frontend I implemented security fixes myself, in authentication flows, dependency updates and input validation. They shipped alongside feature work, without delaying feature delivery, so security did not compete with the product roadmap for release dates.

I developed the frontend of the Update Manager platform as the main contributor to its core repository: more than 37,000 lines of production TypeScript and React.

• Real-time status of the security agents on each endpoint
• Automated deployment workflows for rolling agents out
• Role-based access control (RBAC), so each user sees and does only what their role allows

I cut the pre-commit hook's runtime by 50% by testing only the files that changed, with the full suite running on merge. I also restructured the Mock Service Worker (MSW) setup into a mock backend defined by schemas, so frontend work could move ahead of the APIs it depended on.