Salut 👋,
I'm Elijah Shmakov, Information Security Officer and Application Security Teamlead. MA degree at BMSTU. Participated in securing products for BI, E-commerce, Supply Chain, Cryptocurrency, and Mobile GameDev. Active participant in InfoSec conferences and forums.

I build and scale Application Security and DevSecOps practices for fintech, integrators and high‑load platforms – from zero to production‑ready services. Design and implement code supply security services, as well as AppSec Toolchain mechanisms.

• Secure SDLC & DevSecOps: Shift‑Left, automation AppSec practise on web, mobile, APIs, microservices and vulnerability management
• Secure architecture review (web, mobile, APIs, microservices), security design for payment and crypto systems
• Risk‑based security (risk assessment & vulnerability management) and secure architecture, threat modeling, supply‑chain security
• Vulnerability Management, application architecture design, supply‑chain security

• Leader with end‑to‑end experience building application security functions from scratch in enterprise and fintech environments
• Designs and implements Secure SDLC with integrating SAST, SCA, DAST, container and secrets scanning into CI/CD pipeline, drives security champions programs and risk‑based remediation
• Strong background in information security risk management and compliance (PCI DSS, critical infrastructure regulations, fintech standards, etc.), with proven ability to balance security and time‑to‑market

• Received a letter of appreciation from V. Selin for my substantial contribution to application security SAST activities in the FSTEC of Russia certification process under GOST 71207
• Founder and lead of the FinDevSecOps community for the Russian fintech market
• Organiser of the first DevSecOps hackathon in Russia and continuing the series in 2026
• Lecturer in secure software development and information security at leading technical universities:
  • Bauman Moscow State University
  • Moscow Institute of Physics and Technology
• Author of articles and talks on DevSecOps, secure development, and practical AppSec

• Podcast about secure development Podster and YouTube
• Interview with BISA association on YouTube about secure software development
• Organized the first DevSecOps hackathon in Russia and how it went
• Developing an open-source map of AppSec Toolchain tools in the FinDevSecOps community, considering import substitution solutions

• Design and roll out DevSecOps processes
• Build AppSec Toolchain with focus on developer experience
• Run threat modeling, risk analysis and security workshops for teams

• Telegram: @geminishkv
• Blog (ru): AppSecTA

Disclaimer

All information in this profile and the included repositories (according to GitHub’s applicable terminology), including any text and graphic works, is provided for informational purposes only. Any use of the information provided through this profile and/or any text or graphic works in the repositories in practice, without prior consent from the subject for conducting testing, falls under the scope of applicable law. The author is not responsible for any possible damage caused by the provided materials, including any text or graphic works. All text and graphic works, including links, are for informational purposes only and are intended solely to share knowledge in product security.