A six-project automotive product-security portfolio — secure boot, AUTOSAR SecOC, ECU key lifecycle, ISO/SAE 21434 TARA, in-vehicle network defence, and firmware-security validation — where each project is specified against a written definition of done before any of it is built.
Automotive product security is a lifecycle, not a feature: threat analysis, secure boot, key management, message authentication, network defence, and firmware validation each need their own answer, and an interviewer wants to see that the pieces fit together rather than six unrelated demos.
One repository holding six composable projects, each shipped as a complete engineering package before a line of code exists — a technical specification, a phased build plan, and an acceptance list that has to pass before the project counts as done. Writing the definition of done first is the point: it separates building a thing from engineering a thing to a requirement and being able to show it met one.
Six project directories — secure boot chain simulator, CAN SecOC demo, ECU key lifecycle manager, ISO/SAE 21434 TARA workbench, in-vehicle network security lab, and a firmware-security validation pipeline — designed to plug into each other. A lab.toml manifest records every capability the portfolio claims, and a labctl CLI validates it in CI.
Resisting the urge to start coding. Six half-built demos would look busier than six specified ones, but only the second kind can be checked against anything.
How much of automotive security work is written down before it is built — and that a definition of done is what makes a portfolio project answerable rather than just demonstrable.
Source repository
Back to the portfolio