Spencer Salisbury

Threat Modeling

An OWASP recommended process, threat modeling helps me identify and mitigate security risks associated with my work. Common threats include software supply chain vulnerabilities and injection attacks. Threat modeling should be a part of every software development lifecycle.

Risk Management

Other than outside threats to a project, internal circumstances can sometimes affect a project's success. Being able to identify and manage these risks is critical to anyone in a leadership position.

Technology Integration & Implementation

It's rare that different technology vendors integrate well with one another. Finding solutions to minimize administrative overhead due to technology mismatch can help organizations reduce cost and speed up technology adoption.

Cybersecurity Policies & Enforcement

I am familiar with ISO 800-171 and CMMC requirements. These have both operational and technological requirements that need company policies to be drafted and enforced well to be effective.

People Management

The success of a team depends on making its members successful. I've developed skills to facilitate successful teamwork between people with a spectrum of backgrounds and experiences.

Process Improvement

Agile processes can keep overhead low and throughput high. There isn't one single agile process that is right for every team. Choosing the right processes and continuously improving those processes can make an average team great, and a great team exceptional.

CI/CD

CI/CD is crucial for shifting left, making bugs and vulnerabilities easier to discover earlier in the development process when they are cheaper to remediate. Any CI/CD setup is better than none, but I'm a big fan of GitLab pipelines.

Kubernetes

Containerizing applications makes them portable, scalable, and testable. Having the right Kubernetes setup can make managing and scaling an application much easier to automate.

Sentry

Properly managing an application requires the ability to clearly see what is going on in the application. Sentry (and other similar tools) makes this much easier to manage than scouring log files.

Favorite Frameworks

• NestJS: A robust, opinionated, and well-mainained server-side framework. I've used it to develop many complex applications and microservices.
• Fastify: A performant and responsive server-side HTTP library for Node.js with a powerful plugin system.
• Angular: An excellent opinionated framework for large applications and large teams. Great for situations where you don't want the overhead of developing code standards from scratch. Angular will always be on my short-list when evaluating frameworks for a project.
• Vue: A great middle-ground between the large-scale frameworks like Angular and libraries like React or jQuery. It has been a few years since I've worked in Vue on a daily basis, but I've heard it's only gotten better.
• Plain ol' HTML/CSS: Sometimes you don't need anything fancy. This website has no frameworks or libraries, and very minimal Javascript.

Development Toolchain

• Vite: Modern frontend development tooling.
• ESLint/Prettier: I love a readable code base, and linters and formatters like these make this so easy to enforce in a team setting.

Miscellaneous Tools

• Markdown: I know everyone uses it, but Markdown is a boon to coders and tech-adjacent people alike. It's the LaTeX of software engineering.
• Coolors.co: I'm not exactly a designer, but often find myself having to make design decisions. Coolors is a fantastic website to help me hone in a color palatte when starting a new project.