Software Developer

Cybersecurity

Javier
Rojas

> Writing code was never the hard part.
Deciding, planning, delegating, reviewing and verifying: that's where it gets hard.

Software built with care, where good practices and testing aren't an afterthought.

View Projects Contact

> About

~/about.ts

I'm a software developer. I've spent about three years building web applications: I started at a startup, moved to a consultancy, and today I work on my own project to stay current with modern development, learning architecture, testing, and agentic coding.

My strength is frontend, especially Vue 3 and React, and I have a good eye for implementing a design exactly as it was intended. I also work in backend with Laravel and NestJS.

Code quality has always mattered to me: how a project is structured, making proper use of what the framework offers, applying good practices. It's the part I enjoy most. It's also the part that tends to get postponed, because it isn't visible from the outside and it competes with deadlines. What AI changed wasn't my judgement but the cost of acting on it: I can now audit an entire project in a day, write the tests that used to be left for later, and catch problems while they're still cheap to fix. Quality and testing no longer depend on having time to spare.

// TECH_STACK

Frontend
Vue.js React TypeScript JavaScript Tailwind CSS HTML/CSS Astro
Backend
Laravel NestJS PostgreSQL MySQL Prisma REST APIs
Quality & architecture
Jest GitHub Actions (CI/CD) Git / Git Flow Scrum / Jira Layered architecture
AI-assisted development
Claude Code Spec-Driven Development LLM agents OpenCode

> Projects

~/projects/vetary/
$ git clone vetary
▸ Cloning repository...
▸ Done.

Vetary

Personal project May 2026 - present

Booking system for veterinary clinics, built as a multi-tenant SaaS: several clinics share the same platform, but each one only ever sees its own data. Tenant isolation isn't repeated in every query; it's centralised in a single place, so it doesn't depend on nobody ever forgetting it. JWT authentication with revocable refresh tokens, a REST API, and a suite of unit, integration and E2E tests with Jest that runs in CI with GitHub Actions alongside the linter, type checking and migrations, on every merge into develop or main. I build it with AI agents, but I define the architecture and the specification myself before a single line gets written.

NestJS TypeScript PostgreSQL Prisma React Tailwind CSS Jest GitHub Actions
Code

> Experience

  1. Colegio Adventista

    Apr 2025 - Feb 2026 (11 months)

    IT Administrator

    Administration and support of the school's technology infrastructure: network, computer lab, and audiovisual equipment. Management of the Lirmi and SIGE educational platforms (enrollment, grades, and academic records) and support for teachers and administrative staff. Photo and video coverage of institutional events, including editing and publishing content on the school's website and social media.

    Lirmi SIGE

  2. Neering SpA

    Mar 2023 - Jun 2024 (1 year 4 months)

    Software Developer

    Software consultancy. I worked mainly on frontend with Vue 3 (Composition API) and Pinia, consuming REST APIs from Laravel backends. I built most of the frontend for a coworking booking platform, where users created accounts, bought credits via Transbank, and booked rooms. On some projects I led the frontend end to end, joining the project manager in client meetings to define scope and technical decisions. I fixed feature issues in a Flutter mobile app and handled publishing it to the App Store and Google Play. I also maintained legacy Vue 2 (Options API) projects, wrote SQL queries, and supported clients.

    Vue 3 Pinia TypeScript Laravel Flutter Vue 2 SQL

  3. Neering SpA

    Jan 2023 - Feb 2023 (2 months)

    University Intern

    I joined as a professional intern. The first weeks were onboarding into Vue, Tailwind, and Laravel, plus fixes on an existing Vue 2 (Options API) application. I then built the frontend for a CRM from scratch with Vue 3 and Tailwind: login, dashboard, and client management, based on mockups from the design team and consuming a Laravel REST API.

    Vue 3 Vue 2 Tailwind CSS Laravel

  4. Universidad Técnica Federico Santa María

    Mar 2022 - Jul 2022 (5 months)

    Teaching Assistant, Web-Oriented Design and Programming

    Teaching assistant for the Web-Oriented Design and Programming course in the IT Technician program, guiding and supporting students in technologies like HTML, CSS, JavaScript, and PHP.

    HTML CSS JavaScript PHP

  5. Matchbook Chile SpA

    Apr 2021 - Jan 2022 (10 months)

    Front-end Developer

    Startup for buying, selling, and trading books, funded by CORFO. I helped build the platform's frontend from scratch with React (functional components and hooks), JavaScript, and Sass, working on responsive views faithful to the design. My first exposure to a professional workflow: Git Flow, pull requests, and Jira.

    React JavaScript Sass

> Testimonials

Photo of María José Pavez Figueroa

María José Pavez Figueroa

Communications Professional

"Javier works in a rigorous way, always focused on finding a way to resolve requests from different work areas. Collaboration, empathy, and excellence are some of the concepts that undoubtedly capture his abilities. As a communications professional, I also have to highlight his warmth and willingness to help. Thank you for your support!"

Via LinkedIn

> Why security

I come from software development, but curiosity about cybersecurity always called to me. I started dedicating real time to it, following my own path (courses, wargames, and practice), while building my projects. Along the way I reviewed code from old projects to improve as a developer, and that's where I ran into security flaws I hadn't seen at the time. That opened up two paths. One is building with the mindset that no one should break what I make, which is now part of how I develop. The other, the one I'm actually pursuing, is pentesting: learning to break things to truly understand how they're protected. I'm just starting down that path, with the eJPTv2 as my first goal.

> Path

  1. Linux customization

    2026

    Done

    Hack4u course. Configuring and customizing the Linux work environment. 3 hours, 14 lessons.

  2. Introduction to Linux

    2026

    In progress

    Hack4u course. SUID and SGID permissions, sticky bit, descriptors, Bash scripting, and Linux networking. 15 hours, 82 lessons. In parallel: the networking fundamentals module on TryHackMe.

  3. Introduction to Hacking

    2026

    Planned

    Hack4u course. The core of pentesting: reconnaissance, enumeration, exploitation, and post-exploitation, following PTES methodology. 53 hours, 124 lessons. Once finished, assess whether there's enough preparation to sit the certification.

Practice

  • OverTheWire Bandit Level 13 of 34
  • TryHackMe Linux Fundamentals Part 1, Pre-Security modules 1 and 2

Last updated: Sep 8, 2026

> Certifications

CSFPC
CertiProf
Apr 2021 - Apr 2023
Expired
Cyber Security Foundation Professional Certificate
eJPTv2
INE Security
goal: Dec 2026
In progress
eLearnSecurity Junior Penetration Tester v2
About the exam →
eCPPTv2
INE Security
2027
Planned
eLearnSecurity Certified Professional Penetration Tester v2
About the exam →

> Applied security

Multi-tenant isolation: why the filter belongs in one place

If the tenant filter is repeated in every query, it only takes one to fail for a client to see another client's data. In Vetary I centralized it in the base repository: a single point to audit.

Multi-tenancy NestJS Prisma

Baseline security before the first feature

Rate limiting, security headers, CORS, and password hashing were configured in phase 1, not after there were already users.

NestJS Helmet Rate limiting

JWT with revocable refresh tokens

Short-lived access token and a database-stored refresh token that can be revoked. What problem each piece solves, and why one alone isn't enough.

JWT Authentication Sessions

The risk of not having RLS, and why I documented it

When isolation depends only on the application layer, one failing guard is a data leak. It's conscious technical debt, which is why it's written down.

PostgreSQL RLS Technical debt

> Contact

Have a project in mind or want to talk tech? Write to me.

GitHub LinkedIn

Privacy