My research focuses on improving software security at various stages. From the early development stages, I focus on secure software design within requirements engineering. My work integrates formal methods with machine learning and natural language processing to support rigorous and scalable security analysis. At the later stages, I work on the empirical evaluation of vulnerability management systems and their impact on risk-informed decision-making. Through this interdisciplinary work, I aim to reduce the gap between software engineering and cybersecurity by enabling better secure-by-design and vulnerability management practices.