Anshumaan Singh

CI/CD Security Control Plane

• Multi-stage DevSecOps pipelines: build → scan → deploy → post-deploy validate.
• PR-only merges + CODEOWNERS + branch protections to eliminate bypass paths.
• Dependency ordering: verify → build → tag → scan → push → deploy → notify.
• Slack release telemetry with commit/build metadata + scan artifact retention.

Supply Chain Integrity + SBOM

• Immutable image versioning — removed latest tags to eliminate deployment drift.
• Build once → promote: Dev → UAT → Prod without rebuilds in production.
• Evidence chain: scan outputs + approvals + image digest tracking per release.
• Only scanned + approved digests via registry path enforcement.

Kubernetes Runtime Guardrails

• kubeaudit to detect risky workload patterns and enforce baseline hygiene.
• Secure deployment baseline: healthchecks, limits, safe defaults, namespace patterns.
• Prevented privileged workloads and unsafe configurations at admission time.

AppSec + Secrets Remediation

• Led response for hardcoded Azure storage keys, OAuth secrets, leaked tokens.
• Coordinated safe rotation workflows with zero production impact.
• Web / API / Mobile penetration testing with actionable remediation guidance.

Core Security Invariants

• Identity is the control plane — short-lived, least privilege.
• Verification is deterministic — non-bypassable CI gates + evidence.
• Artifacts are immutable — digests + controlled promotion paths.
• Runtime is constrained — policy + RBAC + secure contexts.
• Everything is auditable — logs + scan outputs + approvals.

Design Principles

• Guardrails over manual reviews — automate the safety net.
• Secure paved roads enable engineering velocity.
• Risk-based gating — severity + exploitability + probability.
• Policy as code, evidence as artifacts, everything traceable.
• Commit → build → digest → deployment end-to-end traceability.

Primary Threat Vectors

• Credential theft — tokens, OAuth secrets, cloud keys
• Pipeline compromise — runner persistence, secret exposure
• Dependency compromise — typosquatting, malicious packages
• Container base image vulnerabilities + drift via mutable tags
• Kubernetes privilege escalation — privileged pods, host mounts
• Lateral movement — east-west traffic abuse
• Data exfiltration — egress misuse, weak PII boundaries

Kill Chain Defense Mapping

• Recon → WAF + rate limiting + minimal exposure
• Initial Access → secrets scanning + SAST + admission deny
• Privilege Escalation → RBAC + securityContext hardening
• Lateral Movement → segmentation + NetworkPolicy + mTLS
• Exfiltration → egress restrictions + PII boundaries
• Impact → SIEM detections + IR containment playbooks

Evidence Pack Includes

• SAST, SCA, Secrets, IaC, Image scan, DAST reports per build
• Build metadata: workflow run ID, commit SHA, branch, actor
• Artifact metadata: image digest, tags, registry path
• Promotion approvals: QA gates / policy decisions per stage
• All artifacts retained per pipeline for compliance and RCA

SBOM Snapshot — Real Output

Real pipeline artifact attached to a release. Not mocked.

Risk Scoring Inputs

• CVSS → technical severity baseline
• EPSS → likelihood of exploitation in the wild
• Exploit maturity → public exploit availability
• Reachability → exposed surface + runtime path analysis
• Compensating controls → RBAC, WAF, egress restrictions

Policy Gate Outcomes

• Block — exploitable criticals or active policy violations
• Allow + evidence — low risk with full traceability
• Exception + expiry — tracked risk acceptance
• Auto-promote — clean evidence + approved digest

Netflix Clone — Secure CI/CD from Scratch

• CI/CD: SAST, SCA, secrets scanning, Trivy image scan, controlled deployment.
• Slack notifications with build + commit metadata for full visibility.
• Immutable image tags (v1.0) + evidence retention per pipeline run.

Trivy SAST SCA Secrets Scan

Kubernetes Security Validation Toolkit

• kubeaudit + cluster checks for misconfiguration detection.
• Baseline enforcement for risky workload patterns across namespaces.
• Findings mapped to remediation playbooks for engineering teams.

kubeaudit RBAC OPA NetworkPolicy

Secure Build Provenance

• Extending provenance metadata to include environment and runner identity.
• Attestation improvements for artifact traceability Dev→UAT→Prod.

Policy as Code Expansion

• Strengthening policy gates for Kubernetes workload hardening at scale.
• Registry path enforcement + digest allowlisting per environment.

Risk-based Security Gates

• Reducing false positives by aligning severity with exploitability + EPSS.
• Tracked risk acceptance with expiry-based policy exceptions.

Security Metrics + KPIs

• Gate pass rate, MTTR, recurrence tracking for secrets leakage.
• Dashboards for release integrity and evidence coverage across teams.

Recognition & Honours

• Promoted to IC-2 with Top Performance Rating 5-A — FY 2024–25.
• ZeeOlympics Best Performer Award — FY 2023–24 and FY 2024–25 (back-to-back winner).
• Winner — GitHub Tech After Dark Security Quiz.
• Multiple Google Cloud Skills Boost achievements across security and architecture tracks.
• 221 Medium followers · 700+ claps across 10+ published security engineering articles.

Engineering Outcomes

• Security enforcement framework across 350+ microservices — code → pipeline → registry → runtime.
• 100% CIS Kubernetes Benchmark (v1.5.1) compliance across production clusters.
• 93% OWASP Top 10 (2022) coverage across application security scope.
• Zero production downtime across all secret rotation and incident response events.
• Built Golden Image pipeline for CIS-compliant Linux images with automated OS hardening.