I architect resilient security control planes that combine adversarial thinking with systems engineering discipline. From zero-CVE runtime factories to automated identity lifecycle management—I build the defensive infrastructure that keeps critical systems secure.
The Problem: Public base images often carry stale vulnerabilities or lack provenance, creating an insecure foundation for high-volume financial APIs.
The Architecture: Engineered a "Shift-Left" factory using Wolfi (Undistro) and apko. I implemented a parallel GitHub Matrix strategy to independently build, scan (Trivy), and sign (Cosign) AMD64 and ARM64 images.
Impact: Achieved zero critical vulnerabilities in production base images while maintaining full supply chain transparency through cryptographic signatures.
graph TD
A[apko Build] --> B{Parallel Scan}
B -- AMD64 --> C[Trivy x86]
B -- ARM64 --> D[Trivy arm]
C & D -- Pass --> E[Push & Sign]
E --> F[Verified Gold Image]
style F fill:#064e3b,stroke:#34d399
The Challenge: Fragmented deployment processes led to unverified dependencies and base image staleness entering production across multiple teams.
The Solution: Standardized product delivery for a major financial group by architecting a unified control plane in Google Artifact Registry. Enforced dependency proxying, automated rebuild triggers, and image provenance via Cosign.
Impact: Reduced time-to-production by 60% while ensuring 100% artifact verification across all deployments.
graph TD
A[Development Teams] --> B[Source Control]
B --> C{Golden Pipeline}
C --> D[Dependency Proxy]
C --> E[Security Scanning]
C --> F[Image Signing]
D & E & F --> G[Artifact Registry]
G --> H[Verified Production]
style G fill:#064e3b,stroke:#34d399
style H fill:#064e3b,stroke:#34d399
graph TD
HR[Jira Service Mgmt] -->|Webhook| Okta[Okta Workflows]
Okta -->|Onboard| Prov[Provision AWS & JumpCloud]
Okta -->|Offboard| Kill[Revoke Sessions & Lock Device]
style Kill fill:#7f1d1d,stroke:#fff
The Challenge: Manual onboarding created "ghost accounts" and delayed access revocation by up to 48 hours, risking compliance failures and unauthorized access.
The Solution: Engineered a fully automated lifecycle using Jira Service Management, Okta Workflows, and JumpCloud. Access is granted based on Role (RBAC) and revoked instantly upon contract termination.
Impact: Eliminated ghost accounts and reduced offboarding time from 48 hours to under 5 minutes.
Hardened, 0-CVE multi-arch base images built with Wolfi/apko and cryptographically signed with Cosign for supply chain verification.
Combining Wazuh File Integrity Monitoring with Yara rules for proactive threat detection on Linux endpoints.
Read ArticleAutomated script for parsing authentication logs, detecting anomalies, and performing geolocation analysis on failed login attempts.
View CodeBash-based network mapper and service identifier for rapid security assessments and reconnaissance.
Watch DemoTechnical series on optimizing K8s log analysis, deployment management, and security hardening using modern tooling.
Delivered technical workshops on ECS Fargate, RDS security, and Docker Hub integration patterns for scalable workloads.
View Workshop