• 🔐 I design and build security & identity infrastructure for multi-tenant, multi-cloud systems — secrets management, KMS, workload identity federation, and zero-trust architectures
• 🛠️ Currently: Software Engineer @ Baseten, previously Uber and VMware Tanzu
• 🕸️ Deep in SPIFFE/SPIRE, Vault, JWT/PKI, and Okta — I led Uber's migration from OneLogin to Okta, introducing passwordless auth and JIT/PAM access patterns
• ☁️ Cloud-native engineering across GCP & AWS, Kubernetes, Docker, Terraform, and GitOps (ArgoCD)
• 🧭 Building resilient, distributed systems — cross-region replication, Raft consensus, high-availability design
• 📦 Long-time interest in runtime & workload isolation — from CRIU-based container live migration and ARM TrustZone early in my career, to container/sandbox isolation today
• 🧠 Currently exploring identity observability with knowledge graphs for AI agents, policy-as-code (OPA), eBPF, and WebAssembly — see my BSides Seattle 2026 talk below
• ⛓️ Also into blockchain & cryptography — co-authored the Kite whitepaper on trustless payment infrastructure for agentic AI
• ✍️ I write about security & distributed systems on my blog
• 💬 Open to chatting about open source, security architecture, or infra design — feel free to reach out

Languages

Cloud & Infra

Identity & Security

Emerging Interests

🔑 Secrets & Key Management Building and hardening secrets infrastructure — encryption, key derivation, and policy-driven access.

• hcl-to-spicedb — converts Vault HCL policy into SpiceDB (Zanzibar-style) fine-grained authorization
• kdf-golang — key derivation function reference implementation in Go
• golang_openssl_private_encrypt_rsa ⭐3 — RSA PKCS1.5 private encryption in Go
• secrets-sharing-poc — a design for sharing secrets safely in/outside a company

🌐 Multi-Cloud & Workload Identity Federation

• kube-oidc-fed — lets pods on any number of Kubernetes clusters get AWS/GCP credentials from a single OIDC identity provider, without per-cluster OIDC registration
• kube-iam-assume ⭐5 — secretless cloud access for any Kubernetes cluster; brings EKS-style IRSA to self-hosted clusters
• kubeAssume-quick-poc — companion proof-of-concept for the above

🪪 Identity, Okta Migration & JIT/PAM

• Led Uber's migration from OneLogin → Okta, rolling out passwordless authentication and just-in-time (JIT) privileged access management (PAM) patterns to cut down standing access
• okta-jwt-cli — CLI for Okta JWT operations using the Private Key JWT auth method
• sshgateway / sshproxy — SSH CA-based authentication termination proxy with Kubernetes service-account validation

📦 Runtime Isolation: CRIU & ARM TrustZone Early in my career, before it was called "sandboxing" — checkpoint/restore container live migration and hardware-backed isolation.

• docker_based_cloudlet ⭐19 — container-based cloudlet with live migration using CRIU
• CRIU_docker ⭐4 — Docker live-migration testing with CRIU
• Hands-on work with ARM TrustZone for hardware-backed trusted execution and isolation

BSides Seattle 2026 — "Identity Observability with Knowledge Graph: Beyond Monitoring to Enforcement" ▶️ Watch on YouTube · 📄 Write-up on Security Boulevard

Kubernetes Secrets Handbook — Packt Publishing, 2024, co-author (with Emmanouil Gkatziouras and Rom Adams) Design, implement, and maintain production-grade Kubernetes Secrets management solutions.

Trustless Payment Infrastructure for Agentic AI — Kite whitepaper, co-author An identity and payment solution for AI agents — my entry point into blockchain and applied cryptography.

• 🔑 OIDC authentication — lets Baseten deployments authenticate to cloud resources (S3, container registries) with short-lived OIDC tokens instead of long-lived credentials
• 🖥️ SSH access to training jobs — full terminal access into running training containers on Baseten-managed GPU hardware for debugging and inspection