A strong security portfolio contains a few items that a stranger can open and judge in ten minutes: a written threat model, a small tool with a readme, a clear write up of something you investigated, and evidence of safe, authorized practice. Quality and clarity beat volume.
What reviewers want to see
Hiring managers are short on time. They look for reasoning, accuracy and judgment. They also look for signs you stay within the rules.
Five items worth including
- A threat model. Pick a small app, such as a note taking service. Draw the data flows, list the threats, and say which you would fix first and why.
- A write up of a lab or capture the flag challenge. Explain your steps and dead ends, not just the answer.
- A small tool. For example, a script that checks a lockfile for unpinned dependencies. Include a readme, tests and honest limits.
- A code review sample. Take an open source pull request or a deliberately flawed sample and annotate the issues.
- A short explainer for a non expert. Shows communication, which matters a lot for security roles.
Keep it authorized
Only test systems you own or have written permission to test. Do not post details of unpatched flaws in other people's products. If you find one in the wild, report it through the vendor's disclosure channel. Hiring managers read disclosure behavior as character.
Do not include
- Secrets, even expired ones. Scan your repositories before publishing.
- Copied solutions presented as your own.
- Claims you cannot back with a link.
- Scores or numbers you cannot explain.
Make it easy
Put everything in one place with a short index page. For each item give one sentence: what it is, what you learned, how long it took. Keep names of employers and clients out unless you have permission.
Show growth
Dated entries show you keep learning. Update an old project to fix a mistake and say what you changed.
Use scanners as part of the story
Running a dependency scan on your own project and fixing the findings is a good small story. The free scan at https://gold.safeguard.sh/scan can serve as one input, and you can describe how you decided which findings to fix first.
Quick check
How many projects do I need?
Three to five solid items are enough. Depth beats a long list.
Is a portfolio needed if I have experience?
It helps less, but a public write up can still stand out, provided your employer allows sharing.
Last reviewed: 19 October 2026.
