Web developer & Security lead

About the platform:

Sites.beta.gouv.fr is a government platform providing a standardized CMS solution for French public administrations. Built on Wagtail/Django, it enables government agencies to quickly deploy accessible, secure, and compliant websites without reinventing the wheel for each project.

Key Responsibilities:

  • Security Leadership: Lead security initiatives including vulnerability assessments, security audits, and implementation of security best practices
  • Platform Architecture: Develop and maintain the multi-tenant CMS platform serving multiple government websites
  • Security by Design: Integrate security measures from the ground up in all platform features
  • Feature Development: Build reusable components and templates with security-first approach
  • Compliance Management: Ensure platform meets government security standards, RGAA accessibility, and OWASP guidelines

Major Achievements:

  • Security Framework: Established comprehensive security framework for the platform, protecting multiple government websites
  • DINUM Migration Success: Led the successful migration of numerique.gouv.fr as a flagship implementation
  • Vulnerability Management: Implemented automated security scanning and vulnerability remediation processes
  • Platform Standardization: Contributed to establishing security and development best practices
  • Zero Security Incidents: Maintained platform security integrity across all hosted government sites

Technical Expertise:

Python, Django, Wagtail CMS, PostgreSQL, Multi-tenant architecture, Application security, OWASP Top 10, Security auditing, Vulnerability assessment, Scalingo deployment, RGAA accessibility, Government security standards, API security, Secure coding practices

Business Impact:

Enabling rapid deployment of government websites while ensuring consistency, accessibility, and security across all public digital services. The platform reduces development time from months to weeks for new government sites.

Key Features Developed:

  • Secure multi-tenant CMS architecture with isolated data and permissions per site
  • Security-hardened authentication system with MFA for government editors
  • Automated security scanning integration in CI/CD pipeline
  • Input validation and sanitization framework across all user inputs
  • Secure file upload system with content type validation
  • Audit logging for security compliance and incident response