Multi-Tenant BYOK Architecture
Customer-scoped key management with envelope encryption, automated rotation, and tenant isolation across 25+ cloud accounts.
- AWS KMS
- Envelope Encryption
- Terraform
HELLO đź‘‹
I'm a Software Security Engineer focused on securing Platforms and Products
Security isn't a side quest—it's part of how we build. I lean on code and IaC as the ground truth, use sensible defaults, and track a few meaningful signals. The aim: make the right thing easy and drift impossible to miss.
What I Do
I'm a software security engineer who builds security into how cloud-native systems are designed, built, shipped, and run. My bias: security should feel like part of engineering—not a separate lane. I treat application code and IaC as the source of truth, set sane defaults, and measure the few signals that actually show whether we're safe and compliant.
I design systems that are secure by default—where good security practices are built into the platform itself. Think secure constructs and invariants that developers can't easily break, even when they're moving fast. When something does go wrong, you know about it immediately and can fix it quickly.
How I approach security
Security problems are engineering problems. Build it into the system from the start, measure what matters, and make the right choices obvious.
1 Code as Source of Truth
Your application code and infrastructure definitions are the only reliable source of what's actually running. Configuration management tools lie, documentation goes stale, but the code doesn't.
2 Secure Paved Paths
If the secure approach is harder than the insecure one, people will take shortcuts. Build security into the tools and workflows engineers already use every day.
3 Build Systems with Runtime Security
Things will break and attacks will happen. Design systems that fail safely, detect problems quickly, and give you the data you need to understand what went wrong.
Core Competencies
Design & Threat Modeling
Map data flows early, call out material risks, choose controls that match the feature. Encode decisions in CI/CD (required checks, signatures, policies) so "approved" == "passing."
Code Security
Keep secrets out of source; run Gitleaks/secret rotation, SAST where it pays off, SCA with license policy; container image scanning; protect against dependency confusion/typosquatting via scoped registries, verified publishers, and pinning.
Delivery & Supply Chain
Reproducible builds, artifact signing/attestations, minimal images, SBOMs, and policy gates on merge and deploy. Clear, repeatable promotion between environments.
IaC & Cloud Posture
Terraform/Helm as truth, policy-as-code guardrails, drift detection, and CNAPP coverage that turns findings into issues—not dashboards.
Distributed Systems
Service identity and scoped communication (mTLS/mesh), network segmentation, timeouts/backpressure, idempotency, multi-tenant defaults, and observability that traces calls across the platform.
Tech Stack
Languages
C++, Python, Go, Node.js
Cloud
AWS, Azure, GCP
Orchestration
Containers & Kubernetes (EKS/AKS/GKE)
Pipelines & IaC
GitHub Actions, GitLab CI, Terraform, Helm, Ansible
Data & Messaging
PostgreSQL, Redis, MongoDB, Kafka
Observability
Prometheus, Grafana, OpenTelemetry
Security (practical)
Secrets management, image signing & SBOMs, policy-as-code in CI, least-privilege by default
Systems
Linux, eBPF, debugging in prod
MLOps
Python, PyTorch, LLMs, Math
Technical work
Crypto-Shredding Pipeline
RTBF-compliant data deletion with ephemeral keys and verifiable destruction for millions of user records.
- Kubernetes
- Vault Transit
- Event-driven
eBPF Runtime Security
Production syscall monitoring with SIEM integration for real-time threat detection and incident response.
- eBPF
- Go
- SIEM Integration
DevSecOps Automation
CI/CD security pipeline reducing build times 45→23 mins while increasing automated security coverage.
- GitLab CI
- SAST/SCA
- Policy as Code
Zero-Trust Architecture
Multi-cloud network security with service mesh, identity verification, and microsegmentation controls.
- Istio
- mTLS
- AWS/Azure/GCP
Security Posture Management
Automated compliance monitoring, drift detection, and remediation workflows for enterprise environments.
- CloudFormation
- Config Rules
- Lambda
Latest from blog
Designing Security into Distributed Systems
A comprehensive guide to threat modeling, trust boundaries, and implementing zero-trust architectures in cloud-native environments.
Read →BYOK and Crypto-Shredding Architecture
Deep dive into customer-managed encryption keys, data lifecycle controls, and verifiable deletion patterns.
Read →eBPF for Security Use Cases
Practical applications of eBPF for runtime security monitoring, observability, and threat detection.
Read →Secure SDLC by Design
Building security into development workflows with automated policy enforcement and developer-friendly tooling.
Read →Portfolio & showcase
Architecture diagrams, implementation details, and technical case studies from distributed systems security work.
Books & continuous learning
Technical references, security research papers, and systems design resources. Focus on distributed systems, security architecture, and platform engineering.
Get in touch
Email shivamvviiita@gmail.com or connect on LinkedIn for technical discussions.
Interested in platform security, infrastructure architecture, and distributed systems security roles.