Software Engineering Intern @ Securest
Securest is a SOC 2 compliance platform. I built the third-party application connectors (Secureframe, GitHub, HubSpot, and more) and the access-request workflow behind it (Python, PostgreSQL/Supabase), continuously syncing employee access data and automating away ~228 hours of manual access reviews across 29 onboarded clients.
Connector framework
Instead of six separate one-off integration scripts, I built a single connector framework: a shared interface, a registry, and one sync dispatcher every connector runs through, with per-tenant locking and a staleness notice so admins know when data might be out of date.
Main approach
Six platforms connect directly over their own APIs, each with its own quirks to handle.
The flagship connector: full personnel sync, dedup, a source-aware delete that preserves audit history, and retry/backoff hardening against rate limits.
Org-level sync, the full GitHub App OAuth flow, and outside-collaborator detection, a common SOC 2 access-review finding.
Built the connector and caught a false-negative bug where deactivated users were showing up as still active.
Domain-Wide Delegation auth and terminated-user detection.
Built end-to-end, including the setup guide.
Replaced a generic bolt-on integration with a real, purpose-built connector.
No-API approach
Some platforms don't expose an API, or a client won't grant one. For those, I built a headless, session-based evidence-capture flow with working 2FA handling, so those tools can still produce audit evidence instead of being excluded from review entirely.
Security & isolation
Every customer table runs Postgres FORCE ROW LEVEL SECURITY, gated by a function tied to account ID. That means isolation is enforced at the database layer, not left to application code remembering to filter by tenant on every query.
Access workflow
A three-tier approval workflow: Owners administer who can request a system, Approvers decide open tickets, and Provisioners grant access once approved. Every state change is stamped with who and when, so the audit trail is a first-class fact, not something inferred after the fact. Provisioning and closing a ticket are separate explicit steps, so granting access doesn't silently mark a request done.
Shadow IT
A smaller feature: a scanner surfacing third-party OAuth apps connected to a client's environment, vendors a company might not know are plugged into their systems. Less about time saved, more about risk nobody was looking for.
