Home

Ansar Shaikh

Cloud security engineer: secure defaults in Terraform, checked in CI

I write infrastructure as code with security controls on from the start, then prove it with scanners, policy tests and posture checks.

Projects

  • tfsec 30 passed, 0 open

    hardened-aws-web-tier

    Terraform for an AWS web tier where only the load balancer is public: private EC2, IMDSv2, SSM instead of SSH, CloudTrail, GuardDuty, KMS and a repo-scoped GitHub OIDC role. Trivy reports 0 misconfigurations. Static checks only, not applied.

    • Terraform
    • AWS
    • tfsec
    • Trivy
  • 20 CIS AWS checks

    mini-cspm-aws

    Posture checks in boto3 mapped to CIS AWS Foundations controls, run against a moto-mocked account. Every planted misconfiguration was caught and every good control passed. 8 tests pass.

    • Python
    • boto3
    • moto
  • 48/48 Kyverno tests pass

    k8s-policy-pack

    Six Pod Security controls written in both Kyverno and OPA/Rego with a parity test. It found that a common Kyverno image-tag pattern accepts an untagged image from a registry with a port.

    • Kyverno
    • OPA/Rego
    • conftest
  • Checkov 10/11 planted

    iac-scan-bench

    Plants 11 Terraform misconfigurations and measures what Checkov, tfsec and my own Rego rules actually catch. tfsec caught 9 of 11.

    • Terraform
    • Checkov
    • tfsec
    • Rego
  • Only signed images admitted

    signed-by-default

    cosign signing, SBOM attestation and SLSA provenance for a small Go service, with Kyverno admitting only signed images. The offline end-to-end run passes; the keyless CI path has not run yet.

    • cosign
    • SLSA
    • Kyverno
    • Go

More on GitHub

secrets-leak-guard · vulnops · ansible-cis-ubuntu · gitops-homelab · AWS-S3-Storage-Client

Skills

  • Cloud: AWS (EC2, ALB, IAM, KMS, S3, CloudTrail, GuardDuty), CIS AWS Foundations, Microsoft Azure fundamentals
  • IaC and policy: Terraform, tfsec, Checkov, Trivy, Kyverno, OPA/Rego, conftest
  • Pipeline security: GitHub Actions with OIDC, cosign, SBOMs, SLSA provenance, Jenkins, SonarQube, gitleaks

2025 B.E. Information Technology, Sinhgad Institute of Technology & Science (SPPU), Pune, with Honours in Cybersecurity.

Experience

  • Aug 2025 – Present

    CTF Player and Security Researcher · Hack The Box and TryHackMe

    Attack Linux and Windows hosts on Hack The Box and TryHackMe, including privilege escalation and Active Directory, which shapes which cloud misconfigurations I check for first. Placed 13th in the CloudSEK CTF (Aug 2025).

    • Privilege escalation
    • Reporting
  • May – Jun 2024

    ServiceNow System Administrator, Virtual Intern · AICTE program

    Built ITSM reports and dashboards and worked through the service catalog and change-related labs on the ServiceNow platform.

    • ServiceNow
    • ITSM

Certifications

  • Feb 2024

    Microsoft Azure Fundamentals (AZ-900)

    Microsoft

  • Oct 2025

    Certified Ethical Hacker (CEH) Practical

    EC-Council · Credential ID ECC9356741028

  • Mar 2024

    Certified AppSec Practitioner (CAP)

    The SecOps Group · Credential ID 8481909

Other roles: SOC analyst · DevOps / SRE / NOC · AI security · VAPT & AppSec · Software & QA · Security (SOC, VAPT and AI security) · Writing