Cloud Security Architect / Security Engineer (AWS, GCP, Azure)

Multi-Cloud Security Architecture
Design and assessment of cloud security architecture across 100+ AWS, GCP, Azure, OCI and CoreWeave accounts, including landing zones, network segmentation, secure-by-default Terraform, GCP service perimeters and Cloud Custodian guardrails aligned to HIPAA, ISO 27001 and ISO 42001.

Identity & Access Management (IAM)
Implementation of least-privilege principles, Workload Identity Federation, OIDC for CI/CD, just-in-time access, and migration from classic PATs to GitHub Apps with fine-grained token policies and automatic privilege revocation.

Continuous Compliance & Guardrails
Operation of production continuous-compliance capabilities monitoring 100+ cloud accounts using Cloud Custodian, Wiz CSPM and a custom 24-control OPA/Rego library, with machine-readable control evidence and policy delivery through GitHub Actions with OIDC and staged approvals.

Threat Modeling & Application Security
Execution of architecture reviews, threat modeling, privilege-escalation reviews (GCPN), and application security risk assessments; establishment of DAST programs using Qualys WAS and Burp Suite across 20+ applications.

Supply-Chain Security
Building of real-time zero-day detection platforms correlating OSV, GHSA, NVD and CISA KEV feeds against org-wide SBOMs to auto-page on-call and surface live CVEs across 68 repositories.

Detection & Incident Response
Deployment of CrowdStrike Falcon SOAR workflows triaging 100% of High and Critical EDR detections the same day with zero escalations; authoring of 100+ custom YARA rules; Chronicle detection engineering; incident response time reduction of 70%.

AI/LLM Security Operations
Engineering of an LLM-driven security-automation platform integrating 9 MCP servers and 62 tools with Wiz and Google Chronicle, consolidating 7+ scanners into one triaged feed governed by 18 incident-response runbooks, saving 145 analyst-hours per week.

Infrastructure as Code & Automation
Use of Terraform, Cloud Custodian, OPA/Rego and Wiz CSPM to automate security guardrails, compliance monitoring and CI/CD pipeline security; scripting in Python, Go, TypeScript/JavaScript, Bash, PowerShell and SQL.

Kubernetes & Container Security
Ownership of Kubernetes security across GKE, OKE and CoreWeave including CSPM, rootless containers and egress controls; prior experience securing microservices on Kubernetes at 99.99% reliability with 2M+ daily API requests.

Data Security & Malware Detection
Co-building of a ClamAV and Wiz malware-scanning program spanning 5 PB and 250M+ objects, detecting novel malware missed by signature scanning using keyless authentication and sandboxed execution.