Cloud Security Engineer
I work the config layer of cloud infrastructure: Kubernetes, Helm, Terraform, mostly on GCP. I find the controls that are documented but never actually enforced, and hand back the YAML that fixes them.
GCP Professional Cloud Security Engineer ISC2 CC Google Cybersecurity
Fixed-scope security reviews of infrastructure that is already built. You get a ranked findings report and the patches. You apply them. I do not touch your cluster, your state file, or your cloud account.
The failure I keep finding is a control that is documented but not declared. The README promises it, the template implements it, and values.yaml never exposes it, so it renders with a default nobody chose and no scanner flags it. That class of bug is invisible to Checkov and Trivy, because the problem is not in the output, it is in the missing input.
I am not a pentester. No exploit work, no red teaming, no application security testing.
If you need someone to break into something, hire someone else. If you need to know whether your cluster, your IAM, or your pipeline is configured the way you think it is, that is the job I am good at.
from $250 · fixed price quoted after scope
Scope: one namespace set or one Helm release, up to about 15 manifests. Send the manifests, or a temporary read-only kubeconfig if you want a live read.
You get: a ranked findings report, ready-to-apply YAML patches, and a 30-minute walkthrough call.
Turnaround: 4 business days.
What I check: NetworkPolicy coverage and default-deny including egress, RBAC wildcards and cluster-admin bindings and automounted service account tokens, pod security context, resource limits, secret handling, image provenance, admission control, ingress and TLS.
from $400 · fixed price quoted after scope
Scope: one environment or one module set, on GCP or AWS.
You get: a findings report on the Terraform, plus a GitHub Actions workflow on a branch that scans every pull request, with the suppressions already tuned so the gate is green on day one, plus one written line of rationale for each suppression.
Turnaround: 5 business days.
The tuned suppressions are the point. An untuned scanner is a pipeline that goes red on day one and gets disabled by Friday, which means you paid for a workflow nobody runs.
from $600 · infrastructure scope only
Your first enterprise buyer sent a security questionnaire and you need the infrastructure sections answered properly, in engineering language, without overstating anything.
You get: the infrastructure sections answered, plus a ranked list of which controls will not pass a review and what order to fix them in.
Not included: this is not an audit, an attestation, an opinion, or a SOC 2 report of any kind. I write the engineer's answer and tell you what to fix.
Five merged pull requests in Kubescape's Helm charts, the Kubernetes security project. The two most recent are the same failure class described above:
cloudProviderMetadata.aksSubscriptionID and the whole secretRef block, the README documented all of it, and values.yaml declared none of it. On AKS there was nothing to fill in and no way to discover the key names.rulesUpdateConfig, but nothing could set it except --set, and none of it appeared in helm show values.I also maintain a hardened GKE reference build: private nodes, workload identity, default-deny NetworkPolicy, pod security standards, CMEK envelope encryption, and a CI gate running Checkov, Trivy, Gitleaks and Conftest on every pull request. github.com/farhan-beg