/Blog

Jul 2026

Application Security Testing on EKS: SAST, DAST, and a Runtime Agent Blocking the Same Exploit

Trivy, OWASP ZAP, OpenRASP, and Amazon Inspector layered on an EKS pipeline, verified by a live SQL injection blocked twice: once by ZAP at scan time and once inside the running JVM.
Jul 2026

Software Supply Chain Security on AWS: Keyless Signing, SBOMs, and SLSA Provenance

A GitHub Actions pipeline that builds a container image, signs it with Cosign keyless, attaches SLSA provenance, and only marks it deployable if the signature and provenance verify against the exact repo that built it.
Jun 2026

Unified Threat Detection on AWS: Security Hub, GuardDuty, and Automated EC2 Isolation

Security Hub, GuardDuty Extended Threat Detection, and Step Functions wired so a HIGH finding auto-quarantines the affected EC2 instance in under a minute, with a one-command rollback.
Jun 2026

Runtime Security on EKS: Tetragon eBPF Enforcement, Falco Detection, and GuardDuty

Tetragon eBPF, Falco, and GuardDuty Runtime Monitoring stacked on EKS. Tetragon kills violating processes in-kernel, Falco keeps a queryable alert history, and GuardDuty catches attacks that dodge path-based blocking by running renamed binaries.
Jun 2026

Building an AWS Data Perimeter, Part 2: SCPs, RCPs, and Proving the Perimeter Holds

Attaching SCPs, RCPs, and the new aws:VpceOrgID VPC-endpoint condition to an AWS Organization, then proving the perimeter by denying an external account's requests and reading it back from CloudTrail.
May 2026

Building an AWS Data Perimeter, Part 1: Design, Org Bootstrap, and Infrastructure

Designing an AWS data perimeter from SCPs, RCPs, and VPC endpoint policies, and building the org, VPC, and encrypted S3 substrate needed to validate it end-to-end.
May 2026

EKS Workload Identity: IRSA, OIDC Token Exchange, and When to Use Pod Identity

OIDC and IRSA for EKS: scoping AWS access per workload without embedding credentials, plus when Pod Identity is the better trade-off.
Jan 2026

IAM Basics I Keep Coming Back To

IAM identity types, policy evaluation logic, and the fundamentals that matter for AWS security work.
Jan 2026

Building Resilience Through Chaos Engineering on AWS EKS

Chaos engineering practices using Chaos Mesh on Amazon EKS to build more resilient cloud-native applications
Dec 2025 (1)

AWS Secrets Management

AWS secrets management solution with Infrastructure as Code, cost optimization, automated rotation, and monitoring
Nov 2025 (1)

Inspector to SSM Vulnerability Patching Automation

That simple vulnerability patching pattern everyone shows? It doesn't work when you use it.
Oct 2025 (1)

AWS CLI Security Commands

I've used these commands to catch everything from wide-open S3 buckets to overprivileged IAM roles. Here's your practical guide to AWS security auditing that comes in handy.
Sep 2025 (2)

Multi-Tool Container Security Scanning with AWS Integration

Building a container security scanner using Trivy, Grype, and Snyk with AWS ECR and EKS deployment automation

Implementing and Securing OWASP Juice Shop with AWS WAF

AWS security engineering project implementing OWASP Juice Shop on ECS Fargate with AWS WAF protection, Terraform IaC, real-time Athena analytics, CI/CD security pipeline, and emergency response
Aug 2025 (1)

Secrets Management in Go Applications From Environment Variables to Vault

The irony is that Go makes building secure applications relatively straightforward, but its simplicity can be deceptive when it comes to secrets management.
Jul 2025 (1)

Building an IaC Security Scanner in Go

As a security engineer who's implemented security controls across cloud environments, I've always been curious about how policy engines work under the hood
Sep 2024 (1)

Monitoring Tells You It’s Broken; Observability Tells You Why

Most organizations think they have observability when they just have expensive monitoring. What is the difference and why it matters for both DevOps and security teams.
Jul 2024 (1)

Are You Dyslexic? A Security Engineer's Late Discovery

I spent years thinking I was just 'not a good reader' until a casual conversation led to a diagnosis that explained everything. Here's how dyslexia shapes my approach to learning and career in tech.
Feb 2024 (3)

When Containers Multiply Like Rabbits and You Need a System

We solved the 'works on my machine' problem by packaging applications in containers. But success creates its own challenges. What happens when you're running not just one container, but hundreds? Or thousands?

Containers Changed Everything and I Wish I'd Started Sooner

Remember when deploying software meant crossing your fingers and hoping it would work on the production server? When 'but it works on my machine' was the most dreaded phrase in tech? Those days are fading fast, thanks to a technology that's quietly revolutionizing how we build and ship software: containers

How a Bank Fixed Their Security Nightmare With Defense in Depth

Let's takes you inside real organizations implementing Defense in Depth strategies, revealing what works, what doesn't, and what you can apply to your own cloud journey
Jan 2024 (1)

Why One layered defense Never Works and What Does

The Defense in Depth is beautifully simple: never rely on just one defense. Instead, create multiple safeguards that work together. If one fails, others are ready to step in.
Archive (1)
Jul 2023

Separation of Concerns vs Least Privilege: Why They're Not the Same (and How to Use Both)

Two fundamental principles that sound similar but serve completely different purposes in cloud security. Here's why the distinction matters