Projects

Government portal and secure SDLC

An Indonesian ministry needed to coordinate social workers across the whole country, including places with very slow connections. I built the portal. A year later I helped the ministry secure how it builds software.

Role
Full Stack Developer, then Digital Transformation Consultant
Period
2022 to 2023
Client
Indonesian ministry

What was needed?

A way to see a whole country. The ministry’s social workers (TKSK) are spread across every region of Indonesia, and many of them work where the connection is slow and the screens are small. The ministry needed to know what was happening where, and the workers needed a tool that would not punish them for living far from Jakarta.

One ministry node linked to many regions, some over slow dashed links; at the right, the five-step development loop.
  1. The ministry's portal
  2. Regions and their social workers
  3. Slow connections, which the portal is built for
  4. A year later: security in every step of the development cycle

What did I build?

In 2022 I designed and built a nationwide web portal for managing the social workers. It was built for slow connections first: caching, compression and light pages, so it stays usable in remote areas where other systems simply time out. It was built to grow with the number of users across the country. And it gave the ministry central tracking and live reporting, a view of social worker activity in every region, on one screen.

A year later the ministry asked a different question: not what to build, but how to build safely. In 2023 I ran a gap analysis across standards, processes and technology to find where security and compliance fell short. Then I wove application security controls into the development lifecycle the ministry already had, so security became part of every phase rather than a check at the end. And I advised on governance and process, so the ministry could run and grow a secure lifecycle on its own, without me.

Why did the second part work?

Because of the first. Having built a system for the same organisation, I knew how its teams actually worked, which meetings happened and which did not, where a rule would be followed and where it would be quietly ignored. The controls were designed for that reality. Security that fits the way people already work is the only kind that lasts.