Senior Security Engineer with 10+ years delivering secure-by-default architectures at scale and coordinating cross-functional security programs.

Earlier in my career: threat modeling, application security, secure coding, and penetration testing. Today I'm on the platform security team at Block (Square, Cash App, Afterpay), focused on cloud, Kubernetes, and container security. Previously Twitter, Salesforce, and Synopsys. I write at hardik.info.

Recent platform-security work, mostly Kubernetes and cloud:

• kubesplaining Kubernetes security assessment CLI that maps multi-hop RBAC privilege-escalation paths to cluster takeover.
• rbac-why-can-i kubectl plugin that traces why an RBAC permission is granted, showing the exact Role/Binding chain.
• agentmoat: moves Kubernetes workloads from runc to gVisor to blunt container-escape, safely and reversibly.
• eks-identity-migrator: audits IRSA usage and migrates EKS clusters to Pod Identity with verification and rollback.
• eks-scp: highest-impact AWS Organizations SCPs for EKS, built on the new EKS IAM condition keys.

• Container image signature verification at admission across Square, Cash App, and Afterpay, with a digest cache to keep verification fast at deploy scale; co-authored Kube-Policies Binauthz: Closing the Supply Chain Gap in Kubernetes.
• Kubernetes admission guardrails (OPA/Rego) that block high-risk workloads before deploy: privileged pods, host networking, unsafe mounts, and insecure RBAC; co-authored Kube-Policies: Guardrails for Apps Running in Kubernetes.
• Closed a remote-code-execution gap in a foundational Terraform pipeline (terraform plan executes arbitrary code before review) with layered defenses: CODEOWNERS gating, provider allowlisting, and multi-person authorization (Rego).
• Enforced hardened golden-image (AMI) policy across ~10,000 AWS accounts via a versioned, staged SCP rollout (dev to prod, with bake time at each stage) that became the standard for SCP changes.
• Defined secure-by-default guardrails for an AWS VPC Lattice service-mesh adoption across four teams: hardened the Kubernetes controller, authored SCPs and data-perimeter controls, and shipped reusable Terraform modules.
• Security observability: turned silent policy violations into real-time alerts (OPA, Prometheus, Datadog), cutting incident response time 70%.

OSCP  |  Advanced Cloud Security Practitioner (CSA)

Go  |  Python  |  Rego  |  Terraform  |  Kubernetes  |  AWS  |  OPA/Gatekeeper