Atharv Vadehra

Cloud Security

Enterprise Cloud Security & SSL Automation Architecture

Engineered and automated secure multi-cloud infrastructure across GCP and AWS for enterprise AI services. Implemented least-privilege IAM roles, automated zero-downtime SSL certificate lifecycle management for 40+ AI services, and optimized CI/CD security pipelines to reduce deployment times by 70%.

GCPAWSKubernetesTerraformCI/CDSSL / TLSIAMPython

View on GitHub

Project Context & Enterprise Scope

Operating enterprise-scale conversational AI applications demands rock-solid uptime, strict cryptographic transport encryption, and adherence to rigorous regulatory standards (such as SEBI - Securities and Exchange Board of India guidelines).

[ Enterprise Client ] ──(HTTPS / TLS 1.3)──► [ Cloud Armor / Edge Firewall ]
                                                         │
                                                         ▼
                                            [ GCP Load Balancer ]
                                                         │
                               (Automated Let's Encrypt / Google-Managed SSL)
                                                         │
                                                         ▼
                                            [ 40+ AI Microservices ]
                                                         │
                                           [ Least-Privilege IAM Roles ]

Technical Accomplishments & Security Hardening

  1. Automated SSL Lifecycle Management for 40+ AI Services:
    • Designed automated DNS-01 and HTTP-01 certificate renewal bots, eliminating manual certificate rotations and avoiding zero-day expiration downtime across all production subdomains.
  2. SEBI Compliance & Risk Analysis:
    • Audited infrastructure configurations against regulatory data localization and access control requirements.
    • Enforced customer data encryption at rest (CMEK) and strict perimeter network segregation.
  3. IAM Least-Privilege Role Design:
    • Decomposed monolithic service accounts into discrete, scoped IAM roles bound to specific Kubernetes service accounts via Workload Identity.
  4. CI/CD Security Optimization:
    • Restructured GitHub Actions and GitLab CI runners, introducing parallelized vulnerability scanning, image caching, and linting.
    • Slashed deployment time by 70% while adding automated static analysis and container image signing.

Cost-Security Tradeoff Analysis

Conducted cross-cloud architectural evaluations across AWS, GCP, and DigitalOcean, identifying over-provisioned compute and idle ingress gateways to achieve significant cloud cost reductions without compromising security posture.