CAMDOM — Career Context & Professional Profile
Professional trajectory, security expertise, project portfolio, research interests, and market positioning as context for the CAMDOM project.
CAMDOM — Career Context & Professional Profile
This page situates the CAMDOM project within Alef Oliveira's broader professional trajectory, security expertise, and research interests. For a post-mortem, understanding why this person was uniquely qualified to build CAMDOM requires understanding the full picture.
1. Career Trajectory
The FDE Path
Alefita's career follows a deliberate pattern: Forward Deployed Engineer — embedded directly in client environments while formally employed by consultancies. This is exactly the model BairesDev is offering.
| Period | Role | Organization | Context |
|---|---|---|---|
| 2019-2020 | Mobile Developer (Kotlin) | NewM | Android native, React Native committee founding |
| 2020-2022 | Tech Lead | UOL EdTech | "Projeto V2" — OPM platform restructuring |
| 2022-2024 | Tech Lead Cyber Security Eng. | RD Saúde (via Platform Builders/Alest) | Pentesting, Security by Design, vulnerability management squad |
| 2024 | Tech Lead Innovation | RD Saúde | ML/generative deployment |
| Sep 2024 | Solo Developer | Pay4Brain | CAMDOM (Cannes Lions, Epica Grand Prix) |
| Feb 2025-present | R&D Specialist | LuizaLabs (Magalu) | Gen AI, ML, React Native, SuperApp |
The Triangulation Model
Alefita's RD Saúde role demonstrates the FDE pattern:
- Platform Builders: B2B vendor providing engineering services (contract May 2022 – Jun 2023)
- Alest Consultoria: Managed legal compliance and confidentiality
- RD Saúde: The client where she was physically embedded
This triangulation is precisely what BairesDev does — embed engineers in client organizations.
Key Achievement: RD Saúde Security Transformation
At RD Saúde (Raia Drogasil — largest pharmaceutical retail in Latin America):
- Identified systemic attack vectors across the ecosystem
- Built a dedicated vulnerability management squad from scratch
- Expanded the company's cyber operation
- Created the RD API Governance Playbook — enforced OpenAPI, HATEOAS, rate limiting via Sensedia API Manager
- Led the "Green-Mile" PenTest remediation: fixed IDOR vulnerabilities in Addresses, CreditCard, BillingAddress, and CustomerLogin proxies
2. Security Expertise
Blue Team (Defense)
The "Projeto Green-Mile" PenTest remediation demonstrates deep defensive capability:
- Fixed IDOR in Address proxy (UUID validation bypass)
- Fixed CreditCard metadata leakage
- Fixed BillingAddress PUT overwrite
- Fixed CustomerLogin session bypass
- Hardened OAuth 2.0 flows
- Implemented SSL Pinning for iOS/Android
- Removed hardcoded keys from binaries
- Mitigated SSRF and cache poisoning
Red Team (Offensive)
The "App Raia" reverse engineering demonstrates offensive capability:
- Frida: Dynamic injection for SSL Pinning bypass, root detection neutralization
- JADX-GUI: Static decompilation exposing hardcoded credentials, third-party tokens, ProGuard/R8 failures
- Burp Suite: Traffic interception after bypass
- Hermes/Bun RE: Engineered custom tools for React Native bytecode de-minification
Security Architecture
The RD API Governance Playbook shows architectural security thinking:
- Strict separation between routing/integration and core business logic
- Mandatory OpenAPI specifications
- HATEOAS principles (no internal structure exposure)
- Centralized traffic management via Sensedia API Manager
- Rate limiting, token validation, end-to-end encryption
- Consultative onboarding (security rules + training sessions)
Incident Response
The "Dossiê de Estelionato e Phishing em Uchoa" (May 2026) demonstrates real-world incident response:
- Sophisticated social engineering attack (pretexting, OTP extraction)
- Attacker performed remote wipe to destroy evidence
- Alefita as First Responder: persistent tracking, active containment
- Attacker pivoted to targeting Alefita directly with smishing/iCloud scams
- Handled like a Red Team veteran
3. CAMDOM as a Security Project
CAMDOM is not just a "creative tech" project — it's a security architecture project that happens to protect privacy:
- BLE mesh protocol = custom network security protocol
- Hardware blocking = OS-level access control exploitation
- Alarm system = intrusion detection
- Privacy by Design = zero data collection architecture
- No cloud dependency = air-gapped security model
- Bond state management = cryptographic session lifecycle
The expertise that built CAMDOM came from years of pentesting, vulnerability research, and security architecture at RD Saúde. The BLE mesh is essentially a zero-trust network protocol implemented in consumer hardware.
4. Research Interests
CTM (Chronobreaker)
Multi-agent AI orchestration using "Centralismo Democrático" — forced deterministic execution through MCP hooks. Divergence phase (multiple specialist agents explore) → Convergence phase (coordinator locks decisions). Implementation: Python Squad (MLX), .NET Squad (SpaceTimeDB), QA Squad.
Buddymoto Thesis
Challenges Bitcoin's Proof-of-Work assumption that SHA-256 computation must be purely stochastic. Proposes Causal Transformer Models (CTMs) to find predictive patterns in blockchain hash sequences. The blockchain becomes an adversarial testbed for machine reasoning.
Sovereign LLM Gateway
LiteLLM-based proxy that:
- Emulates proprietary API syntax for local clients
- Routes heavy prompts to open-weight models (cost mitigation)
- Air-Gapped mode: switches to 100% local hardware (solar-powered) if public internet fails
- Redis-based prompt caching for cost optimization
- Runtime polyfills for unsupported provider features
Codex of Alef ("Alquimia Tecnoxamânica")
Philosophical framework mapping spiritual/transpersonal experiences to engineering systems:
- Anxiety matrix → Beta wave dissociation → HPA axis dysregulation
- Toroidal resonance → Gamma waves + HRV coherence
- Meditation as firmware upgrade
- Bioelectric frequency engineering
5. Infrastructure (Fitalabs)
Sovereign self-hosted infrastructure:
- Proxmox VE: Hypervisor with vGPU-unlock for consumer GPUs
- OPNsense (Tardis): Network segmentation, VLANs, firewall
- Gitea + Dokploy: Self-hosted CI/CD replacing GitHub/Vercel
- LiteLLM Gateway: Multi-provider proxy at gateway.unifita.app
- Solar-powered air-gapped mode: Continuity during internet disruptions
6. Market Positioning (2026)
| Company | Role | Signal |
|---|---|---|
| BairesDev | AppSec Engineer (AI Automation) | [DETAILS ON PERSONAL BRANCH] |
| Salesforce | Senior MTS, AI Research | CTM/orchestration relevance |
| Google Cloud | Senior Staff SE, Cloud Storage | Gateway/proxy architecture |
| Uber | Senior/Staff GenAI | Agent orchestration |
| NVIDIA | Subnet Management | Hardware + AI intersection |
The career study positions Alefita as someone whose work sits at the intersection of security engineering + AI orchestration + infrastructure sovereignty — a profile that commands attention from Big Tech.
7. Connection to CAMDOM
CAMDOM is the proof of execution that validates everything above:
- Solo developer → shipped to 30+ countries
- Security researcher → built zero-trust BLE mesh protocol
- FDE pattern → delivered under extreme client pressure
- Mobile engineer → Skia, Reanimated, custom native modules
- Privacy advocate → zero data collection, air-gapped architecture
- Award-winning → 29 international awards
The person who built CAMDOM is the same person who:
- Fixed IDOR vulnerabilities at RD Saúde
- Reverse-engineered App Raia with Frida
- Designed sovereign LLM gateways
- Conceived the Chronobreaker multi-agent architecture
CAMDOM is not an outlier. It's the logical output of this specific skill stack.
Source: Career study document + wikifita cross-references See also: camdom, camdom-people, camdom-architecture, camdom-code-quality