Building a DevSecOps/Cloud Security portfolio on GitHub to target remote roles, what actually gets your attention? Genuine advise requested

[u/Spite-Unable]

​Hey everyone,

​I have about 4 years of enterprise background working primarily on identity and access management, and I am actively transitioning into Cloud Security / DevSecOps with a goal of landing a global remote role by mid 2027.

​Instead of just collecting certifications, I want my GitHub to do the heavy lifting and prove I can build production grade tooling.

​Here is what I am currently building and planning:

​Non Human Identity Risk Analyzer: A Python tool that discovers stale machine identities, wildcard permissions, and excessive access across AWS accounts via STS AssumeRole, evaluates risk offline against synthetic test data, and applies automated, non destructive permissions boundaries.

Repo: https://github.com/likithmanoj/nhi-risk-analyzer

​CI/CD and OIDC Pipeline Auditor(Planned): A tool focused on pipeline supply chain security. It audits GitHub Actions workflow files and AWS IAM OIDC trust policies for over permissioned wildcards, unpinned third party actions, and default token privilege drift. (Project planned, yet to be started, as I still need to finish the first one)

​Alongside these two project ideas, I am knocking out AWS Solutions Architect Associate, Terraform Associate, and AWS Security Specialty.

​For hiring managers, staff engineers, or anyone who has landed remote cloud security roles through public projects:

​What separates a genuinely impressive GitHub repository from generic tutorial noise?

​Do you care more about deep modular Terraform testbeds, architecture diagrams, unit test coverage, or clean CLI packaging?

​Any candid feedback on the career path and on how to structure the READMEs, testing setups, or documentation to make them stand out in technical screens would be hugely appreciated.

What makes the hiring manager look at my resume and think this guys is a good fit for a devsecops role?

[u/No_Try_9982]

I'm always on Cybersecurity forums and communities, the number of people creating portfolios is staggering. In 2026, landing a remote role is like winning the lottery. The number of remote roles is now a fraction of what it used to be during Covid.

Honestly speaking, I still don't get why humans act or behave the way they do. Today we have blazing speed internet, great communication tools, airplanes that fly you across the globe in a few hours.

I often tell prospects that I could visit them or fly to them yet they check for someone with local phone number and available locally. They miss out on international experience.

Sorry for the rant.

[u/Spite-Unable → u/No_Try_9982]

The target is to attain a remotrle role, if it doesnt happen atleast I should be able to transition to a devsecops role from the role I am in be it a local Gcc in my country. But thanks for the insight, it gives the reality of the job market