Skip to content

whoami security program owner, cloud & Kubernetes hardener, offensive security specialist, agentic AI guardrail builder, compliance lead: NIST · SOC 2 · PCI

Kevin Alt

Principal Security Architect & Engineer

I own security strategy end to end and report directly to the CEO — from executive risk decisions to the Kubernetes manifest, with AI agents working inside hard guardrails.

See the AI workflowConnect on LinkedIn(opens in new tab)

Open to Chief Information Security Officer · Principal Security roles

years in cybersecurity
15+
active security certifications
13
repos in AppSec program scope
~830
CSP rules proven at parity
47/47

01 — about

Security leader. Hands-on engineer.

Since July 2021 I have run the entire security program at Travel Syndication Technology, a travel-booking platform company — strategy, architecture, compliance and implementation — reporting directly to the CEO.

Before that, eight years at Leidos securing AWS and Kubernetes for defense customers, and earlier information assurance roles supporting the Biometrics Identity Management Agency. I translate risk into decisions executives can act on, then build the controls myself.

Today I pair that depth with agentic AI: Claude Code does real infrastructure and security work for me, fenced in by audit hooks, in-loop scanning, least privilege and human approval.

education

  • Master’s Certificate, Computer Forensics · West Virginia University2009
  • M.S., Electrical Engineering · West Virginia University2007–2009
  • B.S., Electrical Engineering · West Virginia University2005–2007
  • B.S., Computer Engineering · West Virginia University2005–2007
  • A.S., Electrical Engineering · Potomac State College of WVU2003–2005

~ — whoami --verbose

whoami --verbose

role:
Principal Security Architect & Engineer
reports_to:
CEO
experience:
15+ years
certs:
13 active — CISSP, CSSLP, GXPN, GPEN, GCTD …
education:
M.S. Electrical Engineering, WVU
giac_board:
Advisory Board since 2012
location:
Pittsburgh, PA
open_to:
CISO · Principal Security

02 — ai-workflow

Agentic AI, governed like production

Claude Code is my daily driver across the repos I run. Every agent works under the same rules I would hold a new engineer to: documented context, least privilege, continuous scanning, a full audit trail and a pull request at the end.

Agent loop, six stages. Select a stage to jump the terminal replay to it.

~/csp-filter — claude

  1. Port the per-host CSP rules to the Envoy Gateway wasm filter and prove parity.
  2. Reading CLAUDE.md — GitOps only, no live prod edits, secrets stay in Vault.
  3. Bash(git grep -n "content-security-policy" policies/)
  4. hook PreToolUse → logged to audit.log (cmd=git grep, cwd=csp-filter)
  5. Found 47 source rules. Generating per-host policies from the source of truth.
  6. Write(filter/src/policy.rs)
  7. semgrep: scanning policy.rs — SAST · secrets · supply chain
  8. semgrep: 0 findings
  9. Write(test/capture.sh)
  10. semgrep BLOCK: hard-coded API token in test/capture.sh:12 (secrets)
  11. Replacing the literal with a Vault reference — secrets never live in code.
  12. Edit(test/capture.sh) → token=$(vault kv get -field=token …)
  13. semgrep: 0 findings
  14. Bash(kubectl --context production apply -f gateway/)
  15. DENY: production writes go through GitOps. Human approval required.
  16. Understood — switching to the offline parity gate instead of touching the cluster.
  17. Bash(cargo test --test parity)
  18. parity: 47/47 rules produce identical headers to the legacy plugin
  19. Bash(gh pr create --title "CSP: wasm filter at full parity")
  20. PR opened → review, then Flux reconciles on merge

Representative replay of a real workflow — hostnames and identifiers sanitized.

Guardrails

  • Context as policy

    A CLAUDE.md in every repo encodes the rules and the scar tissue: don’t hand-patch prod, secrets live in Vault, confirm scope on production.

    CLAUDE.md → loaded every session

  • Full audit trail

    A PreToolUse hook logs every shell command the agent runs, giving a durable record of agent actions for review and forensics.

    PreToolUse → audit.log

  • Scanning in the loop

    Semgrep scans every file the agent writes, as it writes it — SAST, secrets and supply chain caught before a commit exists.

    on write → semgrep · SAST · secrets · SCA

  • Least privilege per repo

    Permissions are scoped to the job. In an evidence-archive repo, the agent’s shell is restricted to a single read-only command.

    permissions.allow → Bash(wc:*)

  • Human in the loop

    Permission modes keep a person approving consequential actions. Production changes arrive as pull requests, never live edits.

    prod → pull request → GitOps

Operating principles

  1. Treat an agent like a privileged new hire: scoped access, written rules, everything logged.
  2. Trust deterministic gates, not model confidence — parity tests and scanners decide.
  3. Agents propose; Git and humans dispose. Production only moves through reviewed PRs.
  4. Guardrails belong in the loop, not in a post-incident review.

Where agents do real work

  • infrastructure investigations

    Agents trace live platform behaviour back to its GitOps source before anyone proposes a fix.

  • runbooks

    Operational knowledge captured as runbooks, then fed back into CLAUDE.md so the next session starts smarter.

  • forensics write-ups

    CloudTrail-driven investigations turned into clear, evidence-backed reports.

  • csp policy tooling

    Policy generation, parity testing and per-directive provenance tracing for the Envoy Gateway migration.

  • reporting

    Recurring security and identity reports, scripted and reproducible instead of hand-assembled.

  • gitops reconciliation

    Comparing declared state in Git against what clusters run, and closing drift through pull requests.

03 — projects

Selected work

Security engineering shipped in production — each one scoped as problem, approach and outcome.

Showing 8 projects

  • Agentic AI Security

    featured

    Guardrails for agentic AI engineering

    A governed operating model for Claude Code: agents do real infrastructure and security work — every shell command logged, every written file scanned, production gated behind review.

    problem
    AI agents that can run shell commands and write code are a new privileged identity. Without controls they can leak secrets, ship vulnerable code or change production directly.
    approach
    Per-repo CLAUDE.md files encode guardrails; a PreToolUse hook logs every command; Semgrep scans each file as the agent writes it; permissions are scoped per repo; human approval gates consequential actions.
    outcome
    Agents now handle investigations, runbooks, forensics write-ups, policy tooling and reports — with a durable audit trail and production changes delivered only as pull requests.
    • Claude Code
    • PreToolUse hooks
    • Semgrep MCP
    • CLAUDE.md
    • GitHub PRs

  • Application Security

    featured

    Content-Security-Policy migration to Envoy Gateway

    Replaced a legacy ingress-nginx Lua CSP plugin with a Rust proxy-wasm filter, proven identical before a single header changed in production.

    problem
    Browser security headers lived in a legacy Lua plugin tied to an ingress controller being retired. Any drift in the migration would either break the site or silently weaken protection.
    approach
    Built a Rust proxy-wasm filter with per-host policies generated from the source of truth, an offline parity gate, a live capture-and-compare gate before and after deploy, and per-directive provenance tracing.
    outcome
    All 47 rules verified to produce identical output, with every directive traceable to its origin.
    • Rust
    • proxy-wasm
    • Envoy Gateway
    • Kubernetes
    • CSP

  • Infrastructure Hardening

    featured

    Kubernetes modernization & GitOps

    Moved legacy KOPS clusters to AWS EKS and made FluxCD GitOps the single source of truth for production.

    problem
    Self-managed clusters and imperative changes made production hard to audit and easy to drift.
    approach
    Migrated to AWS EKS, ran production blue/green, routed every change through FluxCD, and audited Pod Disruption Budgets against a standard pattern (multi-replica → maxUnavailable: 1).
    outcome
    Production state is declared in Git and reviewable instead of edited by hand, with a documented disruption-budget standard for multi-replica workloads.
    • AWS EKS
    • FluxCD
    • Kubernetes
    • Blue/green

  • Application Security

    featured

    AppSec across an 830-repo org

    Rolled out SAST and SCA across a GitHub Enterprise organization of roughly 830 repositories, with guardrails enforced as code.

    problem
    Hundreds of repositories meant inconsistent review, unknown dependency risk and branch rules that varied by team.
    approach
    Deployed Semgrep for SAST/SCA org-wide, enforced branch-protection rulesets through Terraform, ran OWASP ZAP DAST on every release candidate, and added brand-protection and anti-phishing coverage.
    outcome
    Uniform, codified AppSec controls from commit to release candidate, auditable in Git.
    • Semgrep
    • GitHub Enterprise
    • Terraform
    • OWASP ZAP

  • Cloud Security

    Edge & WAF hardening

    Hardened the edge against automated abuse with fingerprint- and network-based AWS WAF rules.

    problem
    Automated traffic targets booking platforms, and WAF changes made carelessly can take legitimate customers offline.
    approach
    Managed AWS WAF with a snapshot before every change, and added TLS fingerprint (JA3) and ASN-based rules.
    outcome
    Targeted blocking of automated abuse, with every rule change reversible from a known-good snapshot.
    • AWS WAF
    • JA3
    • ASN rules

  • Cloud Security

    Secrets & key hygiene

    Rotated and restricted API keys with zero downtime and removed hard-coded tokens from scripts.

    problem
    Long-lived, unrestricted keys and tokens embedded in scripts widen the blast radius of any leak.
    approach
    Rotated API keys with API and referrer restrictions, migrated them through HashiCorp Vault using additive, reproducible scripts, and stripped hard-coded tokens from tooling.
    outcome
    Rotation designed for zero-downtime cutover, and a clear model for identity-provider tokens: stateless JWTs mean rotating a secret does not revoke a leaked token, so tokens never belong in files.
    • HashiCorp Vault
    • API key restrictions
    • JWT

  • Cloud Security

    Cloud forensics & attack-surface reduction

    Used CloudTrail evidence to clean up IAM roles and network footprint, and documented logging posture.

    problem
    Unused roles, legacy network resources and stale endpoints expand the attack surface and blur accountability.
    approach
    Ran CloudTrail-driven IAM role forensics and cleanup, removed unneeded AWS network resources, documented logging posture, and reported stale EDR endpoints.
    outcome
    A smaller, evidence-backed attack surface and a documented logging posture.
    • AWS CloudTrail
    • AWS IAM
    • EDR

  • Identity

    Identity federation for partners

    Federated partner organizations into Auth0 via SAML, with activity reporting scoped by connection.

    problem
    Partner users need single sign-on, and reporting has to reflect how they actually authenticate.
    approach
    Configured SAML federation per partner organization on Auth0 and scoped activity reporting by connection rather than email domain.
    outcome
    Partner SSO with accurate, reproducible activity reporting.
    • Auth0
    • SAML

04 — skills

Skills & expertise

Depth across leadership, offense, cloud and automation — each backed by certifications or years of hands-on delivery.

Security Leadership & GRC

  • Security strategy & program ownership
  • Executive reporting to the CEO
  • Risk assessment
  • NIST 800-53 / 800-171
  • SOC 2 Type 1 & 2
  • PCI DSS
  • Vendor risk & security questionnaires

evidence: CISSP · sole security program owner since 2021

Offensive & AppSec

  • Penetration testing
  • Web application testing
  • Exploit research
  • SAST / SCA
  • DAST (OWASP ZAP)
  • Incident handling
  • Intrusion analysis

evidence: GXPN · GPEN · GWAPT · GCIH · GCIA · CSSLP

Cloud & Container Security

  • AWS security architecture
  • Kubernetes / EKS
  • DISA STIG & CIS Benchmarks
  • AWS WAF & edge defense
  • Envoy Gateway
  • PKI & MFA
  • Cloud forensics (CloudTrail)

evidence: GCTD · GCSA · 8 years securing AWS for defense customers

DevSecOps & Automation

  • GitOps (FluxCD)
  • Terraform
  • HashiCorp Vault
  • Jenkins
  • Ansible & SCAP / OpenSCAP
  • Python
  • PowerShell
  • Rust (proxy-wasm)

evidence: GPYC · GCSA · hardening automation at Leidos and TST

AI-Assisted Engineering

  • Claude Code
  • Agent guardrails & permissions
  • Hooks & agent audit trails
  • MCP tooling (Semgrep)
  • Context engineering (CLAUDE.md)

evidence: Daily driver in production security work — see the AI workflow above

Certifications

13 active certifications, each verifiable on Credly.

Verify on Credly ↗ (opens in new tab)

  • ISC2 · governance

    CISSP

    Certified Information Systems Security Professional

    since 2013

  • GIAC · offensive

    GXPN

    Exploit Researcher & Advanced Penetration Tester

    since 2017 · ID 1163

  • GIAC · offensive

    GPEN

    Penetration Tester

    since 2016 · ID 10307

  • GIAC · offensive

    GWAPT

    Web Application Penetration Tester

    since 2014 · ID 4432

  • GIAC · defensive

    GCIA

    Certified Intrusion Analyst

    since 2018 · ID 12849

  • GIAC · defensive

    GCIH

    Certified Incident Handler

    since 2012 · ID 21563

  • GIAC · defensive

    GCWN

    Certified Windows Security Administrator

    since 2019

  • GIAC · defensive

    GWEB

    Certified Web Application Defender

    since 2024

  • CompTIA · defensive

    Security+

    CompTIA Security+ ce

    since 2011

  • GIAC · cloud

    GCTD

    Cloud Threat Detection

    since 2026

  • GIAC · cloud

    GCSA

    Cloud Security Automation

    since 2022

  • ISC2 · development

    CSSLP

    Certified Secure Software Lifecycle Professional

    since 2015

  • GIAC · development

    GPYC

    Python Coder

    since 2025

previously held

  • Certified Kubernetes Administrator · The Linux Foundation · 2022–2025
  • AWS Certified Security – Specialty · AWS · 2021–2024
  • Certified ScrumMaster · Scrum Alliance · 2021–2023
  • Certified UNIX Security Administrator (retired by GIAC) · GIAC · 2019–2023
  • AWS Certified Solutions Architect – Associate · AWS · 2019–2022

05 — experience

Career timeline

From defense information assurance to owning a company’s entire security program.

  1. Jul 2021Present

    Principal Security Architect & Engineer

    Travel Syndication Technology (TST)Sole owner of the security program for a travel-booking platform company, reporting directly to the CEO.
    • Own security strategy, architecture, compliance and implementation across application, cloud and container security.
    • Lead risk assessment and support NIST 800-53, NIST 800-171, SOC 2 Type 1 & 2 and PCI audits, with the administrative procedures behind them.
    • Selected and implemented web app pen testing, brand protection, SAST and MDM on cost-versus-benefit analysis.
    • Answer vendor risk assessments and PII/security questionnaires for customers and partners.
    • Automate and harden Kubernetes, AWS, HashiCorp Vault, Git, Terraform and Jenkins, and advise DevOps and internal teams.
    • Security program owner
    • AWS
    • Kubernetes
    • SOC 2
    • PCI
    • NIST
    • Agentic AI
  2. Oct 2012Present

    Advisory Board Member

    GIACMember of the forum of GIAC-certified professionals, with opportunities to shape courseware and exam questions.
    • Exchange ideas and guidance in a peer forum of GIAC-certified practitioners.
    • Eligible for courseware and exam-question development.
    • Community
    • Certification
  3. Jun 2013Jul 2021· Morgantown, WV

    Senior Information Assurance Security Engineer & Principal Security Architect

    LeidosSecured cloud and container platforms for government defense customers over eight years.
    • Built and secured AWS architecture across EC2, IAM and EKS, and supported development teams migrating to AWS, MilCloud and Red Hat OpenShift.
    • Interpreted DISA STIGs and CIS Benchmarks for Docker, Kubernetes and AWS.
    • Automated hardening with Ansible, verified by SCAP Compliance Checker and OpenSCAP; automated Windows compliance with PowerShell.
    • Delivered PKI for apps, servers and clients, rolled out MFA, and unified CAC, tokens and certificates on one authentication system.
    • Ran ACAS/Nessus patch compliance and SAST with Findbugs, Coverity, HP Fortify and OWASP Dependency-Check; performed security audits and assessments.
    • AWS
    • EKS
    • OpenShift
    • STIG
    • PKI
    • Defense
  4. Mar 2013Jun 2013· Clarksburg, WV

    Information Assurance Manager (IAM)

    Biometrics Identity Management Agency (BIMA)Managed information assurance under Army G-3/5/7 and CIO/G-6 direction.
    • Served as the IA voting member of the Configuration Control Board.
    • Supported DIACAP accreditation packages and reported IAVA compliance.
    • Investigated computer security incidents and assessed risk on system changes.
    • DIACAP
    • IAVA
    • Governance
  5. Jan 2012Mar 2013· Clarksburg, WV

    Information Assurance Security Officer (IASO)

    Biometrics Identity Management Agency (BIMA)Handled incident response and security operations for a defense biometrics agency.
    • Responded to data spillage incidents.
    • Operated HBSS and vulnerability scanning.
    • Served as PKI token agent.
    • Incident response
    • HBSS
    • PKI
  6. Nov 2010Dec 2011· Clarksburg, WV

    Computer Systems Engineer

    Computer Sciences CorporationHandled information assurance incidents in support of BIMA.
    • Triaged IA incidents and coordinated with CERT.
    • Worked with nFX Cinxi, Bluecoat, eEye Retina and Army Gold Disk.
    • Incident handling
    • Vulnerability scanning

~ — ./contact --role ciso

06 — contact

Let’s talk about your security program

I’m open to CISO and Principal Security roles. If you need someone who can brief the CEO and harden the platform in the same week, reach out on LinkedIn.

Connect on LinkedIn(opens in new tab)

Open to Chief Information Security Officer · Principal Security roles · Pittsburgh, Pennsylvania