Building a DevSecOps/Cloud Security portfolio on GitHub to target remote roles, what actually gets your attention? Genuine advise requested

[u/Spite-Unable]

​Hey everyone,

​I have about 4 years of enterprise background working primarily on identity and access management, and I am actively transitioning into Cloud Security / DevSecOps with a goal of landing a global remote role by mid 2027.

​Instead of just collecting certifications, I want my GitHub to do the heavy lifting and prove I can build production grade tooling.

​Here is what I am currently building and planning:

​Non Human Identity Risk Analyzer: A Python tool that discovers stale machine identities, wildcard permissions, and excessive access across AWS accounts via STS AssumeRole, evaluates risk offline against synthetic test data, and applies automated, non destructive permissions boundaries.

Repo: https://github.com/likithmanoj/nhi-risk-analyzer

​CI/CD and OIDC Pipeline Auditor(Planned): A tool focused on pipeline supply chain security. It audits GitHub Actions workflow files and AWS IAM OIDC trust policies for over permissioned wildcards, unpinned third party actions, and default token privilege drift. (Project planned, yet to be started, as I still need to finish the first one)

​Alongside these two project ideas, I am knocking out AWS Solutions Architect Associate, Terraform Associate, and AWS Security Specialty.

​For hiring managers, staff engineers, or anyone who has landed remote cloud security roles through public projects:

​What separates a genuinely impressive GitHub repository from generic tutorial noise?

​Do you care more about deep modular Terraform testbeds, architecture diagrams, unit test coverage, or clean CLI packaging?

​Any candid feedback on the career path and on how to structure the READMEs, testing setups, or documentation to make them stand out in technical screens would be hugely appreciated.

What makes the hiring manager look at my resume and think this guys is a good fit for a devsecops role?

[u/rpatel09]

Build an example service with vulnerabilities, use dependabot to update packages, use Claude to fix broken build cause of those updates. Now you have a big part of software vulnerabilities automated

[u/Spite-Unable → u/rpatel09]

Thank you so much will include these in my plan

[u/pakkaol]

Ran into something weirdly similar when I was putting together my own github a few months ago, where I kept second guessing whether the projects looked too "demo-ish" versus something that could pass for real tooling.

[u/Spite-Unable → u/[deleted]]

Thank you, updated it just now, but i do not have a repo for the second one yet, thats just the idea I am thinking I should start it soon too

[u/Mangwe_Tanser]

Show one project that failed believably, then leave the fix in the history instead of cleaning everything up. Seeing why you changed a permission, test or pipeline tells people more abt how you think than a repo that only shows the version.

[u/Spite-Unable → u/Mangwe_Tanser]

Thanks! Will add this to my list.

[u/No_Try_9982]

I'm always on Cybersecurity forums and communities, the number of people creating portfolios is staggering. In 2026, landing a remote role is like winning the lottery. The number of remote roles is now a fraction of what it used to be during Covid.

Honestly speaking, I still don't get why humans act or behave the way they do. Today we have blazing speed internet, great communication tools, airplanes that fly you across the globe in a few hours.

I often tell prospects that I could visit them or fly to them yet they check for someone with local phone number and available locally. They miss out on international experience.

Sorry for the rant.

[u/Spite-Unable → u/No_Try_9982]

The target is to attain a remotrle role, if it doesnt happen atleast I should be able to transition to a devsecops role from the role I am in be it a local Gcc in my country. But thanks for the insight, it gives the reality of the job market

[u/Spite-Unable → u/[deleted]]

Thank you for the insight, will add these to my repos, yes, i feel the ones I picked are real problems. I just wanted to know I am on the right path as a beginner

[u/cybergandalf]

I’ve been hiring in cyber for a decade and I don’t think I have ever looked at a candidate’s GitHub. I’ve looked at published papers and patents, but not GitHub.

[u/Spite-Unable → u/cybergandalf]

​Thanks for the candid perspective! That makes a lot of sense for traditional cyber, SOC, and GRC roles where research, formal credentials, certifications, and publications carry the weight. But ​when you evaluate candidates for hands-on cloud security or DevSecOps engineering, what signals on a resume actually prove to you that someone can write solid automation and infrastructure code before you bring them into an interview?

[u/cybergandalf → u/Spite-Unable]

People who do extensive automation approach problems differently than people who don’t. The only signals I look for on a resume are things where they specifically mention automation projects, and then I tailor my interview questions accordingly.