akhil@portfolio: ~

$ whoami

Akhil CH

$ cat role.txt

Cloud Security Engineer

$ ./intro.sh

AWS Security IAM DevSecOps Threat Hunting Pen Testing
view projects github ↗ contact

> Princeton, NJ · open to cloud security & DevSecOps roles

$ cat about.md

Cloud Security Engineer with 3+ years securing AWS environments across financial services and enterprise. I operationalize AWS-native security services and design segmented, least-privilege architectures. I work from the offensive side, finding attack paths, through to the defensive side: detection, response, and remediation.

I'm comfortable on both sides of that line, and the tools below show how I think: small, auditable, and built to drop into a pipeline rather than sit in a slide deck. Master's in Cybersecurity from NJIT; CEH, ECSA, and dual AWS certifications; currently pursuing an MBA.

$ ls -la skills/

aws-security/

GuardDutySecurity HubInspectorWAF Secrets ManagerIAMKMSCloudTrail ConfigOrganizationsSCPsMacie

cloud-infra/

EC2S3LambdaVPC CloudFormationTerraformCodeDeploy GCPAzure

devsecops/

JenkinsGitHub ActionsDockerKubernetes SnykOWASP ZAPCI/CD gates

offensive/

Kali LinuxMetasploitBurp Suite OWASP Top 10AD attacksAttack surface

security-ops/

Incident ResponseThreat HuntingMITRE ATT&CK SplunkCloudTrail analysisRoot-cause

governance/

PCI DSSNIST 800-53CIS Benchmarks Zero TrustLeast PrivilegeThreat Modeling

languages/

PythonBashPowerShell JavaJavaScriptRuby

$ git log --projects

aws-iam-privesc-finder

↗

Static analyzer for AWS IAM privilege-escalation paths. 16 techniques mapped to MITRE ATT&CK, each with Sigma detection rules, remediation guidance, and a full test suite over mock policy fixtures.

PythonIAMMITRE ATT&CKSigma

cloudtrail-hunter

↗

Threat-hunting pass over AWS CloudTrail logs. Flags root usage, logins without MFA, IAM tampering, security-group exposure, and attempts to disable logging, each mapped to a MITRE ATT&CK technique.

PythonCloudTrailMITRE ATT&CKThreat Hunting

sg-auditor

↗

Audits EC2 security groups for ingress open to the internet (0.0.0.0/0 or ::/0), ranked by how sensitive the exposed port is, so SSH, RDP, and databases surface first and benign ports last.

PythonEC2Networkstdlib

s3-auditor

↗

Checks S3 buckets for public ACLs and policies, gaps in Block Public Access, and missing encryption, logging, and versioning. Runs offline against an export, so it drops straight into CI.

PythonS3DevSecOpsstdlib

portscan

↗

Threaded TCP connect scanner with banner grabbing, service-name resolution, and CIDR expansion. Standard library only. Phase 1 of an incremental network-tooling project.

PythonNetworkingReconstdlib

secretscan

↗

Dependency-free secrets scanner: named regex rules plus a Shannon-entropy pass, with redaction and CI-friendly exit codes. Pairs with the IAM analyzer: one keeps credentials out of the repo, the other checks what they can do.

PythonDevSecOpsCI/CDstdlib

$ cat experience.log

  1. Cloud Security & DevSecOps Engineer at Ayras Technologies

    May 2024 - Mar 2025 · Princeton, NJ

    Designed a segmented multi-account AWS architecture and stood up GuardDuty and Security Hub org-wide, tuning findings down to actionable signal. Ran least-privilege IAM reviews, enforced preventive SCPs, shifted security left with Snyk and OWASP ZAP in CI, and held the estate to the CIS AWS Foundations Benchmark with automated remediation.

  2. Cloud Security & Automation Engineer at Citi

    Feb 2022 - Feb 2023 · Tampa, FL

    Internal penetration testing against Active Directory and threat hunting across CloudTrail and Splunk, mapping activity to MITRE ATT&CK. Built Jenkins gates that hard-failed CVSS 7+ builds, ran threat modeling for critical applications, and worked within PCI DSS controls on KMS-encrypted market-data pipelines.

  3. DevSecOps Engineer at Capgemini

    Jun 2021 - Dec 2021 · Chicago, IL

    Added OWASP ZAP as a CI/CD quality gate, containerized legacy apps on Docker and Kubernetes with Pod Security and network policies, and separated environment access via IAM permission boundaries. Baked security baselines into CloudFormation templates so deployments started hardened.

  4. Cloud Security Analyst at Intalent

    Jun 2020 - Jun 2021 · Texas

    Audited and hardened S3 and EC2 (server-side encryption, public-access removal), built the team's first automated Jenkins security stage with OWASP dependency checks, and caught authentication-bypass issues in security regression testing before release.

$ cat education.txt

  1. M.S., Cybersecurity & Privacy at NJIT

    Jan 2019 - May 2020 · Newark, NJ

  2. Master of Business Administration at Lindsey Wilson University

    Mar 2025 - Present

$ ls writing/

in progress

Hosting My Portfolio on Hardened AWS

A security engineer hosting their own portfolio the right way: private S3, CloudFront with OAC, TLS via ACM, and the whole thing in Terraform. What I'd flag in a review of it.

launch post · coming soon

> Posts publish here and on Medium. This list wires up automatically once the blog ships.

$ ./contact.sh

Best way to reach me is through GitHub.