Focus area
AI and agentic security
ISO 42001-aligned governance, approval gates and MCP gateway security.
How the gate worksSecurity architect & leader · Bengaluru
Securing AI agents
at enterprise scale.
Hands-on security leader. Ten years from pentesting products to running AppSec, cloud and AI security for a global fintech.
Bottomline/S&P Global/NotSoSecure/Claranet/VMware/
ISO 27001/ISO 42001/SOC 2/FFIEC/NIST CSF/GDPR/
01About
I started as a software engineer at VMware, building the UI for NSX. Then I learned to break things, pentesting products before attackers could. Today I design the security programmes, governance and AI guardrails a global payments company runs on. Offence taught me where systems fail. Leadership is making sure they don't.
I've stood up two security functions from nothing, an enterprise threat-modelling programme and a product security team, and led 17+ architects and engineers. I still work hands-on: threat models and design reviews, security in CI/CD, cloud and Kubernetes hardening, and the MCP gateway controls that keep agentic AI in its lane.
ACCESS · ALL AREAS
Akash Anand
Security Architect & Leader
AA-2016-SECdrag me
02Impact
Ten years, in numbers.
0
Years in engineering and security
0
Security functions built from zero
0+
Architects and engineers led
0%
Fewer production security defects in a year
03Expertise
What I own.
Threat modelling
A programme teams run themselves.
AppSec and SDLC
Security gates built into CI/CD.
Cloud and containers
CSPM and Kubernetes hardening on AWS, Azure, GCP.
Vulnerability management
Risk-based, SLA-driven, reported to execs.
GRC and audit
Continuous control monitoring, AI management systems included.
Customer assurance
Evidence that speeds up deals.
Offensive security
Controls anchored to real attack paths.
Team and enablement
Hiring, mentoring, CTFs and training.
04Projects
Selected work.
-
P/01Cloud security Cloud security strategy
Posture, baselines and governance across AWS, Azure and GCP.
-
P/02Cloud architecture Azure landing zone
A secure-by-default Azure foundation with policy guardrails built in.
-
P/03DevSecOps Hardening CI/CD
SAST, SCA, DAST and secrets scanning on every change.
-
P/04AI security AI gateway IBM ContextForge
AuthN, tool-level access control and tenant isolation for agentic AI.
-
P/05Offensive security Security pentest AI & automation
Prompt injection, tool abuse and agent privilege, tested with automation.
-
P/06Enablement CTF & cyber awareness
CTFs, hackathons and training that teach engineers to think like attackers.
05AI security
Every AI use case clears one gate.
01 / 05
Register every use case
Purpose, data, model and autonomy. Shadow AI can't be governed until it's visible.
02 / 05
Tier by risk
A chatbot over public docs and an agent that moves money get different treatment.
03 / 05
Apply the baseline
Injection defences, output handling, human-in-the-loop and evals, scaled to the tier.
04 / 05
Route through the gateway
AuthN, per-tool access, tenant isolation and full logging. Agents get least privilege too.
05 / 05
Approve, then watch
A recorded decision, runtime monitoring and re-review as models and tools change.
Designed against
- Prompt injection
- Tool poisoning
- Excessive agency
- Cross-tenant leakage
- Data exfiltration
06Journey
Build. Break. Architect. Lead.
-
Senior Security Architect
Bottomline · Global payments and financial technology
- Hold design authority on the Architecture Steering Committee for product, platform and AI decisions.
- Advise executives on risk posture, framing security spend against delivery velocity and regulatory exposure.
- Built and scaled the enterprise threat-modelling programme so product teams find design risk themselves.
- Embedded SAST, DAST, SCA and secure code review in CI/CD, with security-owned gates and risk-based exceptions.
- Built a reusable control-evidence library that made security questionnaires repeatable and shortened enterprise deal cycles.
-
Principal Security Architect
NotSoSecure · Claranet for S&P Global
- Built and led a 9+ person product security team, embedding shift-left practices across the SDLC.
- Ran cloud architecture reviews, threat models and code reviews, then defined the secure design patterns that closed the gaps.
- Owned security tooling strategy and integration across a multi-cloud estate.
-
Security Engineer II
VMware
- Led penetration testing and attack-vector analysis across the product portfolio, driving fixes before release.
- Threat modelling and design reviews cut customer-facing security defects by 18% year over year.
- Built secure-coding training, CTF challenges and company-wide hackathons for global engineering.
-
Member of Technical Staff
VMware
- Full-stack engineering on NSX-V, including the migration from Flex to Angular.
- Built a shared Global Search component library adopted across NSBU products.
07How I work
- 01
Think like an attacker, build like an owner.
Every control maps to a real attack path, not a checkbox.
- 02
Optimise for time to value.
Ship controls that cut real risk in weeks, not quarters, then iterate.
- 03
Build teams that run without me.
Two security functions built from nothing now run on their own.
- 04
Make security speed up the business.
Reusable evidence turns customer due diligence into a sales asset.
- 05
Evidence over effort.
Continuous control monitoring beats point-in-time audit theatre.
08Credentials
The paper trail.
ISC²
CISSP
In progress · Dec 2026
AWS
Security Specialty
AWS
Developer Associate
Microsoft
Azure Security Engineer
Microsoft
Azure Solutions Architect
Microsoft
Azure Administrator
CNCF
CKS
CNCF
CKA
Proofpoint
AI Security Specialist
Education
B.Tech, Computer Science
KIIT University, Bhubaneswar
9.2CGPA
Burp SuiteMetasploitNmapKali LinuxFortifyNessusIriusRiskWizPrisma CloudVantaKubernetesAWSAzureGCP
09Contact
Let's
talk.
Building a security function or governing AI at scale? I'm up for the conversation.
Prefer a shell?