Salute 👋

I'm Elijah Shmakov, Information Security Officer and Application Security Team Lead. MA degree at BMSTU. Official website: geminishkv.tech. Participated in securing products for BI, E-commerce, Supply Chain, Cryptocurrency, and Mobile GameDev. Active participant in InfoSec conferences and forums.

I build and scale Application Security and DevSecOps practices for fintech, integrators and high‑load platforms – from zero to production‑ready services. Design and implement code supply security services, as well as AppSec Toolchain mechanisms.

• Secure SDLC & DevSecOps: Shift‑Left, automation of AppSec practices for web, mobile, APIs and microservices
• Secure architecture review (web, mobile, APIs, microservices), security design for payment and crypto systems
• Risk‑based security: risk assessment, vulnerability management, threat modeling
• Supply‑chain security: SBOM, artifact signing, dependency and container hygiene

• Leader with end‑to‑end experience building application security functions from scratch in enterprise and fintech environments (banking, crypto)
• Designs and implements Secure SDLC: integrating SAST, SCA, DAST, container and secrets scanning into CI/CD, driving Security Champions programs and risk‑based remediation
• Strong background in information security risk management and compliance (PCI DSS, critical infrastructure regulations, fintech standards), with proven ability to balance security and time‑to‑market

• Received a letter of appreciation from V. Selin for my substantial contribution to application security SAST activities in the FSTEC of Russia certification process under GOST 71207
• Founder and lead of the FinDevSecOps community for the Russian fintech market
• Organiser of the first DevSecOps hackathon in Russia and continuing the series in 2026
• Lecturer in secure software development and information security at leading technical universities:
  • Bauman Moscow State Technical University (BMSTU)
  • Moscow Institute of Physics and Technology (MIPT)
• Author of articles and talks on DevSecOps, secure development, and practical AppSec

Packages: GitHub · Docker Hub · PyPI

• Podcast about secure development on Podster and YouTube
• Interview with the BISA association on YouTube about secure software development
• Organized the first DevSecOps hackathon in Russia and how it went
• AppSec course and DevSecOps course at MIPT
• Security Champion training
• Open-source AppSec Toolchain map built in the FinDevSecOps community, with a focus on import‑substitution solutions
• Reference secure development process for fintech (GOST R 56939‑2024)

• Design and roll out DevSecOps processes
• Build AppSec Toolchain with focus on developer experience
• Run threat modeling, risk analysis and security workshops for teams

• Website: geminishkv.tech · blog
• Telegram: @geminishkv
• Blog (ru): AppSecTA
• Email: shmakovis@inbox.ru
• LinkedIn: geminishkvdev

Disclaimer

All information in this profile and the included repositories (according to GitHub’s applicable terminology), including any text and graphic works, is provided for informational purposes only. Any use of the information provided through this profile and/or any text or graphic works in the repositories in practice, without prior consent from the subject for conducting testing, falls under the scope of applicable law. The author is not responsible for any possible damage caused by the provided materials, including any text or graphic works. All text and graphic works, including links, are for informational purposes only and are intended solely to share knowledge in product security.