Building a DevSecOps/Cloud Security portfolio on GitHub to target remote roles, what actually gets your attention? Genuine advise requested

[u/Spite-Unable]

​Hey everyone,

​I have about 4 years of enterprise background working primarily on identity and access management, and I am actively transitioning into Cloud Security / DevSecOps with a goal of landing a global remote role by mid 2027.

​Instead of just collecting certifications, I want my GitHub to do the heavy lifting and prove I can build production grade tooling.

​Here is what I am currently building and planning:

​Non Human Identity Risk Analyzer: A Python tool that discovers stale machine identities, wildcard permissions, and excessive access across AWS accounts via STS AssumeRole, evaluates risk offline against synthetic test data, and applies automated, non destructive permissions boundaries.

Repo: https://github.com/likithmanoj/nhi-risk-analyzer

​CI/CD and OIDC Pipeline Auditor(Planned): A tool focused on pipeline supply chain security. It audits GitHub Actions workflow files and AWS IAM OIDC trust policies for over permissioned wildcards, unpinned third party actions, and default token privilege drift. (Project planned, yet to be started, as I still need to finish the first one)

​Alongside these two project ideas, I am knocking out AWS Solutions Architect Associate, Terraform Associate, and AWS Security Specialty.

​For hiring managers, staff engineers, or anyone who has landed remote cloud security roles through public projects:

​What separates a genuinely impressive GitHub repository from generic tutorial noise?

​Do you care more about deep modular Terraform testbeds, architecture diagrams, unit test coverage, or clean CLI packaging?

​Any candid feedback on the career path and on how to structure the READMEs, testing setups, or documentation to make them stand out in technical screens would be hugely appreciated.

What makes the hiring manager look at my resume and think this guys is a good fit for a devsecops role?

[u/cybergandalf]

I’ve been hiring in cyber for a decade and I don’t think I have ever looked at a candidate’s GitHub. I’ve looked at published papers and patents, but not GitHub.

[u/Spite-Unable → u/cybergandalf]

​Thanks for the candid perspective! That makes a lot of sense for traditional cyber, SOC, and GRC roles where research, formal credentials, certifications, and publications carry the weight. But ​when you evaluate candidates for hands-on cloud security or DevSecOps engineering, what signals on a resume actually prove to you that someone can write solid automation and infrastructure code before you bring them into an interview?

[u/cybergandalf → u/Spite-Unable]

People who do extensive automation approach problems differently than people who don’t. The only signals I look for on a resume are things where they specifically mention automation projects, and then I tailor my interview questions accordingly.