Software Engineer. Uruguay. Founder of BLABS.
Started coding at 12 on the family Pentium 2 with a Visual Basic tutorial CD. Still curious.
Self-taught, high bar, strong on autonomy and clear communication. I can land on backend, product, infra, observability, or security, learn the domain fast, and leave something that holds in production. AppSec is part of what I do today. It is not the only place I know how to operate.
- Now: Application Security Engineer at itti (Nov 2025 – present), with a growing focus on AI Security. Security Champions, threat modeling, secure code review, architecture risk reviews, internal security tooling, and training for engineering teams.
- Before: Software Engineer at Mercado Libre / Mercado Pago (Nov 2022 – Sep 2025), in a product serving on the order of ~60M users while I was there. Day to day mixed feature work, architecture, war rooms, postmortems, Datadog, and product collaboration. KYC / identity validation across LatAm: improved onboarding security across different tracks, reducing cost and tightening risk. Also Security Guardian across 20+ apps, New Relic / OTEL when needed, ML-assisted decisions in flows, Fury Buddy for onboarding.
- Before IT: Livestock, hospitality, gastronomy, and logistics, including leading teams of up to 10 in peak season. Useful context for how business, people, and cashflow actually behave.
- Start in IT: Software Developer at Repuestos YA (2022). Production eCommerce on NestJS, Docker, Terraform, AWS.
- Outside work: BLABS. Homelab and products I actually run.
- Languages: Spanish (native). Portuguese (advanced). English (intermediate).
| Project | Description | Status |
|---|---|---|
| WODBO Wars | Multiplayer game with real players. Self-hosted prototype moved to a VPS once uptime mattered to other people. Astro, PHP API, MariaDB, Turso sync, Grafana/Prometheus, Cloudflare. | 🟢 Live |
| BLABS | Personal lab for software, security, and infra products. | 🟢 Live |
| Blog | Notes on systems, networks, security, and small failures worth writing down. | 🟢 Live |
| Homelab | Proxmox, LXCs, MikroTik, Pi-hole, Grafana, Prometheus, Loki/Promtail, Alertmanager. Lab first, then promote what earns production. | 🟡 Ongoing |
| Mainhost | Collab on game server hosting. | 🟢 Live |
| Inventiax | B2B commercial credit (Uruguay). Vendors get paid on term sales; capital partners fund the float. Staging, not production yet. | ⏳ Hold |
- FrontendCafé — Ambassador (Dec 2021 – present)
- Argentina Developer — Moderator (Dec 2023 – present)
- LibreCourseUY — Collaborator (Sep 2026 – present). Uruguayan open source community.
| Status | Org | Talk |
|---|---|---|
| ✅ Done | ThreatX Security | Parental Control: the least friendly way to control the internet (writeup) |
| ⏳ Upcoming | OWASP Uruguay | Dragon Ball, PHP, and a backdoor (deck) |
AI Security Securing AI-assisted development and AI-powered systems: threat models for LLM usage, prompt/tool abuse, data leakage, supply chain of models and agents, and guardrails that engineering teams can actually adopt. Growing part of my AppSec work at itti.
Application security Secure Development with Security Champions. Threat modeling on new and existing apps. Secure code review. Architecture reviews from an AppSec lens. Internal tooling to automate controls. Training on offensive and defensive security for developers. Work across stacks; security over framework loyalty.
Software engineering KYC / identity flows at Mercado Pago scale. Microservices, APIs, and product collaboration to cut friction without hiding risk. TypeScript/Node, NestJS, Java/Spring Boot. SQL and NoSQL. Tests with JUnit, Mockito, Karate when the stack calls for it.
Operations and incidents War rooms, traces, logs, postmortems. Datadog dashboards for launches and stability. New Relic APM, Kibana, Opsgenie, OpenTelemetry when the problem needs them. Grafana / Prometheus / Loki in the homelab and on WODBO prod.
Infra and edge Docker, Terraform, AWS. Proxmox + LXC, MikroTik, DNS, VPN. Cloudflare is my default edge provider: DNS, tunnels, WAF, Workers when it fits. Promote from lab to prod without pretending a home setup is an SLA.
How I work Autonomous, direct communication, comfortable bridging engineers and stakeholders. Aiming at leadership roles in AppSec / AI Security where architecture, risk, and delivery meet.
- WODBO: Vercel with zero passwords
- Parental control: security is not the same as control
- When identity becomes infrastructure
- BLABS: https://blabsuy.com
- WODBO: https://wodbo-wars.blabsuy.com/
- Blog: https://blog.brahianpdev.com
- LinkedIn: https://www.linkedin.com/in/brahianpdev/ (build in public + blog posts)
- X/Twitter: https://x.com/brahianpdev (build in public)
- YouTube: https://www.youtube.com/@blabsuy
- Mail: contacto@brahianpdev.com
- BLABS mail: contacto@blabsuy.com
Public repos stay few and readable. I would rather open artifacts an engineer can inspect than push empty volume.