About Hien Nguyen
Hien Nguyen is a security engineer and consultant with hands-on experience in offensive security, cloud security (AWS/GCP), SIEM and detection engineering, and security audits and compliance. She works with SaaS startups and fintech companies to strengthen their security posture through penetration testing, cloud audits, and governance, risk, and compliance (GRC) support.
Skills
Core competencies and depth of experience.
How I Work
A clear, repeatable process for every engagement.
Discovery
Initial call to understand your environment, compliance needs, and risk profile. We align on objectives and constraints.
Scope definition
Formal scope and rules of engagement. You provide read-only or test access; I confirm in-scope assets and out-of-scope items.
Security testing
Testing or audit per agreed methodology (OWASP, CIS, etc.). Findings are documented with evidence and severity.
Reporting
Executive summary and technical report with risk ratings, proof-of-concept where relevant, and clear remediation steps.
Remediation support
Optional re-test after fixes, or ongoing support for implementing recommendations and compliance follow-up.
Security Philosophy
How I approach every engagement.
Practical security
Focus on risks that matter to your business. Prioritize findings by impact and likelihood, not by checklist volume.
Developer-friendly remediation
Clear, actionable guidance that your team can implement. No jargon-heavy reports—concrete steps and code-level advice where useful.
Risk-based prioritization
Not every finding is equal. I help you decide what to fix first and what to accept or defer, aligned with your risk appetite.
Automation-first mindset
Recommendations that scale: secure defaults, CI/CD checks, and repeatable processes so security improves with every release.
Tools & Technologies
Industry-standard tools organized by capability—from cloud posture to offensive testing and automation.
Cloud Security & Posture
AWS/GCP security posture, CSPM, Kubernetes and container security, compliance scanning.
DevSecOps & Supply Chain
CI/CD security, SAST/DAST/SCA, and image signing.
Vulnerability Management
Vuln scanning, prioritization, and CVSS workflows.
Offensive / Testing
Web and API testing, recon, and exploitation tooling.
Detection Engineering & Monitoring
SIEM, ATT&CK mapping, and threat intel enrichment.
Automation
Scripting and tooling for security automation.
Work together
For application security consulting, cloud security audit, or DevSecOps review—get in touch for a no-obligation consultation.
Book consultation