Software Engineer, DevOps at Moveworks — working on Kubernetes deployment automation and resource rightsizing. On the side, I hunt bugs, maintain open-source security tooling, and built devops-ctf.com.
DevOps is the day job — Kubernetes, ArgoCD, deployment automation. Security is how I think about the systems I build: defensible by default, with the tooling to prove it.
I'm a DevOps engineer with four years of production experience across site reliability and applied security research. Most of my work lives in Python, Go, and shell — infrastructure automation that turns slow, manual engineering workflows into fast, repeatable pipelines.
At Moveworks, I work on the DevOps team — deployment automation on Argo Workflows, CI guardrails for Kubernetes manifests, and Kubecost-driven resource rightsizing across production and gov environments. Before that, a year and a half as an SRE at ShopUp — cluster security hardening, Helm-based CI/CD, and Teleport-backed access infrastructure.
On the security side, I've been hunting bugs in production web systems since college — a mix of public bug-bounty programs and private engagements. That research tends to show up in open-source tooling I maintain: Reconator (automated reconnaissance for pentesters) and bugbounty-mcp-server (an MCP server that brings offensive-security tooling directly into LLM agents).
Outside work, I'm building devops-ctf.com — a Capture-The-Flag platform built for DevOps engineers, where each challenge drops you into a per-user sandbox to debug a realistic production incident. It's the closest thing I've shipped to a full product.
The stack I've used in production — opinions earned the hard way.
Every code change goes through six automated checks before it reaches users. If any step fails, the change stops — it never touches production. Here's what each step does.
Open-source tooling, a live platform, and security research — with live GitHub metrics.
Roles across DevOps and Site Reliability Engineering.
Work I'm proud of — and the numbers that back it.
Recognised for reporting a security vulnerability in Google Hangouts.
Responsibly disclosed across public and private bug-bounty programs — spanning auth bypass, IDOR, SSRF, and cloud misconfigurations.
Built and launched devops-ctf.com — production platform with per-user Kubernetes sandboxes and real DevOps tooling in-browser.
Automated reconnaissance framework used by bug-bounty hunters worldwide.
Identified Docker security flaws and cloud misconfigurations; shipped Trivy-based scanning & remediation automation.
Security, DevOps, and automation tooling — free, permissively licensed, and actively maintained.
Every DevOps engineer lives in a prompt. Type `help` to start.
Consulting, full-time roles, open-source collaboration, or security research — the inbox is open.