Lessons from Building Cybersecurity Products as a Solo Engineer

Building cybersecurity products as a solo engineer is simultaneously liberating and terrifying. You control every decision—and own every mistake.

Over the past several years, I've built multiple security platforms from scratch: RiskProfiler, CloudFrontier, and CIS CSAT. Here's what I learned.

Start with the Problem, Not the Technology

Mistake I made: Starting with "I want to build a serverless security platform" instead of "organizations can't see their attack surface."

The technology should serve the problem, not the other way around.

How I Course-Corrected

I spent weeks talking to security teams:

What tools do they currently use?
What gaps exist?
What frustrations do they face daily?
What would make their job easier?

The answers shaped the product.

Most didn't care about serverless architecture or DynamoDB performance. They cared about:

Seeing unknown assets
Reducing false positives
Integrating with existing tools
Getting actionable alerts

Choose Boring Technology (Mostly)

As a solo engineer, operational burden is your enemy.

Technologies I Chose

Boring (good):

AWS for infrastructure (mature, well-documented)
Python for backend (fast development, great libraries)
PostgreSQL for relational data (rock-solid, well-understood)
Docker for containerization (industry standard)

Exciting (risky):

AWS Lambda (serverless = less ops)
DynamoDB (NoSQL learning curve, but operational simplicity)

The Rule

Use exciting technology only where it provides clear operational advantages.

DynamoDB eliminated database management overhead. Worth it.

That new JavaScript framework with 12 GitHub stars? Skip it.

Build for Iteration Speed

Early-stage products require rapid experimentation.

Architecture Decisions for Speed

Monorepo over multiple repositories (less coordination)
API-first design (frontend can change independently)
Feature flags (deploy to production, enable gradually)
Automated testing (confidence to move fast)

Example: Feature Flag Pattern

from feature_flags import is_enabled

def scan_target(target, org_id):
    if is_enabled('advanced_scanning', org_id):
        return advanced_scan(target)
    return basic_scan(target)

This let me deploy features to production and test with select customers before general release.

Focus on One Channel Initially

Marketing as a solo engineer is overwhelming. Pick one channel and execute well.

For CloudFrontier, I chose:

GitHub as primary channel (open-source project)
Security conferences (DEFCON presentation)
Technical blog posts (SEO for organic discovery)

I ignored:

Social media marketing (too time-consuming)
Paid advertising (expensive, unclear ROI)
Cold outreach (poor conversion for technical products)

Result: Featured at DEFCON, steady GitHub stars, inbound interest from security teams.

Automate Operations Ruthlessly

Your time is the scarcest resource. Automate everything repetitive.

What I Automated

Deployment:

# GitHub Actions workflow
on:
  push:
    branches: [main]
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Deploy to AWS
        run: serverless deploy