SECURITY ENGINEERING

Security Isn't
a Layer. It's Everywhere.

Devistio engineers defense-in-depth security: from the identity plane to the container runtime. Zero Trust architecture, GovCloud-grade enforcement, and documented compliance controls throughout.

04
🔑
IAM / IRSA / Pod Identity
IDENTITY

Fine-grained IAM roles per service account via IRSA and EKS Pod Identity. Least-privilege enforced at every boundary. KMS separation of duties. No hardcoded credentials.

📋
Kyverno Policy Engine
RUNTIME

Cluster-wide admission enforcement on GovCloud EKS. Blocks privileged containers, enforces image registries, validates signatures with Cosign, restricts host access.

🌐
Zero-Trust Networking
NETWORK

Default-deny NetworkPolicies across all namespaces. Istio REGISTRY_ONLY egress control. Security group tightening. GitOps-only production access model.

🔍
Supply Chain Security
SUPPLY CHAIN

Cosign-based image signing integrated into CI/CD. Trivy vulnerability scanning with attestations. Private ECR mirroring for GovCloud-isolated environments.

🔐
KMS & Encryption
IDENTITY

Customer-managed KMS keys with separation of duties. CloudTrail-based usage analysis. EBS, EFS, RDS, S3, and etcd encryption catalogued and enforced.

🛡
GuardDuty & Compliance
RUNTIME

GuardDuty findings tracked through closure. FedRAMP-adjacent GovCloud compliance documentation. Audit-ready before/after gap analysis. Cluster verification test suites.

DETAILED BREAKDOWN

What Was Actually Done.

Click each domain to expand the full list of security controls designed, implemented, and verified in production.

🛡
DOMAIN 01
Kubernetes Security & Policy Enforcement
17 controls
Policy Engine Setup
Deployed Kyverno as cluster-wide policy engine on AWS GovCloud EKS with HA admission controllers and background / cleanup / reporting controllers.
Mirrored Kyverno container images to private ECR because GHCR was unreachable in GovCloud.
Designed and enforced container image registry allow-list policies restricting images to private ECR only.
Fixed Kyverno image-registry matching logic for multi-level registry paths.
Image Signing & Supply Chain
Implemented Cosign-based container image signature verification using key-based verification for GovCloud environments.
Integrated image-signing steps into CI/CD pipelines across multiple application repositories.
Resolved GovCloud IRSA/STS regional endpoint and ECR authentication issues affecting signature verification.
Built an automated Kubernetes CronJob to refresh short-lived ECR authentication tokens every 6 hours using IRSA. Applied minimal container privileges to the workflow.
Designed a container vulnerability-scanning pipeline using Trivy + Cosign vulnerability attestations + Kyverno admission verification (implementation placed on hold).
Cluster-Wide Admission Policies
Authored cluster-wide Kyverno policies restricting:
Privileged containers
Host networking
Host PID / IPC namespaces
HostPath volume mounts
Defined a namespace-exception process for legitimate infrastructure workloads (CNI, storage, monitoring, security agents).
Enforced Pod Security Standards (Restricted equivalent) for PHI/PII namespaces using PSA + Kyverno. Worked around Istio sidecar and PSS compatibility issues.
Troubleshooting & Migrations
Resolved Kyverno/Helm templating conflicts involving JMESPath syntax.
Fixed Kyverno policy type-mismatch issues involving array/string comparisons.
Migrated Kyverno CRDs between two independent EKS clusters, including metadata sanitization.
Network Policies & RBAC
Designed and rolled out default-deny Kubernetes NetworkPolicies across all application namespaces.
Created a reusable Helm-based NetworkPolicy template driven by per-namespace dependency mappings.
Restricted east-west pod-to-pod communication to explicitly declared dependencies only.
Implemented RBAC-based namespace isolation between platform tooling and application workloads.
Created custom ClusterRoles and ~80 auto-generated RoleBindings. Implemented IAM-to-Kubernetes group mapping.
Used node taints and scheduling isolation to separate platform and application workloads.
Istio Egress Control
Investigated centralized Istio egress control: proved via PoC that NetworkPolicies and Istio Sidecar scoping were insufficient to block outbound traffic. Implemented REGISTRY_ONLY via Istio ServiceEntries.
Built an evidence-based egress allow-list using:
VPC Flow Logs analysis
ArgoCD configuration and source review
Application configuration audits
Covered approved destinations: source control, container registries, alerting, cloud APIs, and data warehouses.
Performed live egress validation across two environments, verifying both blocked and approved destinations. Identified and fixed a missing allow-list entry during validation.
AWS Security Groups & Operating Model
Tightened AWS Security Groups across EKS, node groups, management infrastructure, and EFS.
Removed unnecessary SSH ingress from the managed control plane. Reduced an overly broad /8 CIDR rule to the actual VPC range.
Replaced unrestricted outbound access with four explicitly justified port-level rules.
Designed a GitOps-only production operating model prohibiting direct kubectl changes, including a documented emergency break-glass process.
VPC CNI & Pod Identity Migration
Migrated AWS VPC CNI from shared EC2 node IAM role to a dedicated EKS Pod Identity role. Removed redundant CNI IAM permissions from node-group roles.
Eliminated a silent credential-fallback path and improved CloudTrail attribution for CNI API calls.
IRSA Design & Terraform Modules
Designed and implemented a dedicated IRSA role for Kyverno ECR image verification. Scoped OIDC trust conditions to the exact Kubernetes service account.
Diagnosed an IAM tagging-permission failure in the deployment pipeline.
Built a reusable Terraform module supporting both IRSA and EKS Pod Identity trust patterns.
KMS & Least-Privilege IAM
Investigated and implemented KMS separation of duties between key administration and data access.
Performed CloudTrail-based KMS usage analysis to determine the real-world access and blast radius before making changes.
Removed an orphaned, overly permissive IAM policy containing wildcard EC2 volume permissions.
Created and validated scoped read-only IAM roles for developer and admin use. Verified IAM restrictions through live AWS API calls, confirming reads succeeded and writes were denied.
Helm & Multi-Cluster Compatibility
Diagnosed hardcoded Kubernetes node-group names across multiple Helm charts. Refactored to use dynamic node-group selection with per-application overrides and environment-level defaults.
Enabled the same Helm charts to deploy across two independent EKS clusters.
Resolved a Helm whitespace-stripping issue that converted a boolean into a string, causing silent config failures.
Fixed an incorrect StorageClass reference preventing database persistent-volume binding.
Admission & Sidecar Issues
Root-caused Kyverno admission failures caused by OpenTelemetry/CloudWatch auto-instrumentation sidecar injection.
Identified missing IAM trust-policy configuration for a second cluster's OIDC provider.
Added a required Kyverno namespace exception for a test workload to restore admission.
Production Incidents & Security Response
Investigated and resolved a major production incident involving simultaneous node failures affecting:
GitOps controller
Kyverno admission webhooks
Restored cluster operability and implemented permanent node-affinity + IaC corrections.
Investigated an active security incident involving compromised pipeline credentials and unauthorized cluster-admin privilege escalation. Identified the malicious RBAC binding, coordinated credential rotation, and tracked GuardDuty findings through closure.
Integration & Config Fixes
Diagnosed a client-side TLS/SSL inspection/proxy interception issue affecting a production data-warehouse integration. Isolated to the browser/client side after ruling out cluster, certificates, and application code.
Removed hardcoded sensitive third-party service URLs from application source code. Integrated third-party configuration through a secrets-management platform → Kubernetes deployments.
Investigated and resolved missing credentials affecting an alerting/notification pipeline.
Investigated and began implementing Okta SSO/Auth integration for internal developer tools.
Diagnosed and fixed a secondary-cluster database issue caused by an incorrect node-group name.
Policies & Process Documentation
Authored an Infrastructure-as-Code enforcement policy defining Terraform-managed vs. AWS/vendor-managed infrastructure boundaries.
Documented an emergency-change exception / break-glass process for production access outside GitOps.
Investigated and documented the EKS patching process covering:
EKS control plane upgrades
Managed add-on lifecycle
EC2 management infrastructure patching
Identified an observability add-on configuration-preservation risk before future upgrades: flagged and documented before changes were made.
Backup, Encryption & Compliance Audit
Investigated backup-encryption posture across EBS, EFS, and RDS. Catalogued current KMS key usage.
Identified the absence of an automated backup vault/plan. Scoped a safe implementation approach without making unapproved production changes.
Produced before/after gap-analysis documentation for all implemented security controls.
Created cluster-verification test suites for security controls: automated validation of policy enforcement.
Maintained ticket-ready documentation supporting audit and compliance review in a regulated GovCloud / FedRAMP-adjacent environment.