Koushik Kotamraju

Yahoo Inc., Cloud Security

• Own the AWS security baseline for every engineering team on AWS, a role taken at month three in 2022: decide which controls ship, when each becomes enforced, and which are merged or retired.
• Own deployment and maintenance of 200+ Python detection signatures that monitor the AWS baseline across 1,400+ AWS accounts, covering AWS service controls and IAM, each turning a failed control into a per-resource finding with remediation steps the account owner can act on.
• Built Argus, which correlates cloud alerts into toxic combinations: findings that are low severity alone but form a privilege-escalation path together, such as a missing IMDSv2 requirement and an over-privileged IAM role on the same instance. Defined 15 AWS combinations from documented escalation paths in DataDog's public pathfinding.cloud catalog.
• Extended the Paranoids MCP, the security team's MCP server for Claude users, from answering process questions to serving AWS, GCP, Kubernetes, and Docker security baselines as MCP tools, so engineers get the applicable controls where they build. In evals that mimicked feature work across repositories, including Terraform, Claude identified and fetched the applicable baseline in every trial.
• Proposed and built Ingestor, an LLM pipeline that turns new cloud and container attack research into draft baseline controls for human review. A partner detection team adopted its staged design for their own workflow, and I fixed two configuration weaknesses in their deployment during the handoff.
• Run cloud security reviews through an AI-assisted workspace I built for a coding assistant (skills, hooks, rules, commands) that assembles each dossier, pulls detected state, walks the control checklist, and drafts findings. Nothing is written until I approve the exact text.
• Proposed and built Artemis on GCP (Cloud Run, Security Command Center, BigQuery, Terraform) to rotate resources through the platform's attack-path simulation limit, so simulation covers the full resource set and its results reach resource owners. AWS side designed, not built.

Yahoo Inc., Cloud Security, Remote, USA

• Designed and launched the high-severity cloud alert enforcement program for every AWS account owner: each high-severity finding becomes a ticket with a deadline set by a three-tier severity model based on what an attacker gains, and declining a fix requires a written exception with an expiry.
• Defined posture metrics that resist gaming: the remediation clock follows detection state, not ticket state, and exception volume and expiry are reported on their own, so suppressing a finding cannot improve the chart.
• Led 100+ cloud security architecture reviews since 2021 across AWS, GCP, and Azure for every business unit, tying each objection to a named written control and recording accepted risk with an owner and an expiry.
• Co-authored the largest control release in the baseline program's history as one of a small senior group, writing most of the release and running its gap analysis.
• Built a deterministic advisory engine for alert-suppression requests that scores each request on four signals, caps confidence so it never reads as certain, and hard-blocks exceptions in control categories where none is allowed. Chose rules over a model because the decision gates access.
• Built review-aws-iam-policies, an IAM analysis tool covering 10 privilege-escalation classes that pairs deterministic checks with a model pass, tags each finding with its source, and maps paths to DataDog's public pathfinding.cloud catalog (65+ paths). Benchmarked it against 32 ground-truth findings in 11 synthetic Terraform fixtures written before evaluation.
• Owned detection correctness across the signature fleet: fixed two controls whose findings never reached the ticketing system for months, and a shared policy-evaluation helper that hid real access along with the fleet-scale false positives it had been masking, then audited the fleet for the same pattern.
• Trained engineers across the company through four internal technical talks (2023 to 2025), and taught assistant-driven development to a partner team whose engineers now ship features into a platform I own without pairing.
• Authored enforced container controls for image scanning, image lifecycle, admission control on the managed scheduler, and task-role scoping, with the detections that evaluate them.
• Built an AI-assisted remediation validator for cloud alert tickets in review: a model judges the submitted remediation evidence and validated tickets close automatically, removing a manual verification step from the remediation workflow.

CYR3CON, Tempe, AZ (intern until Apr 2019)

• Team lead for the infrastructure and security teams (up to 7 engineers): ran sprint planning, defined project scope, and mentored both teams, which owned AWS infrastructure and security, on-prem data-center servers, firewalls, and shared engineering tooling.
• Designed the company's multi-account AWS foundation as code (Prod, Dev, Staging, and Security accounts on a Transit Gateway hub-and-spoke with centralized SSO) and removed static credentials from the deployment path by authenticating every deployment through cross-account role assumption.
• Deployed a honeypot network (T-Pot, Cowrie) that collected live attacker telemetry for the company's threat-intelligence product, and partnered with the data team on the pipelines clients used to prioritize vulnerabilities actively exploited against their own assets.

Infosys Ltd., Hyderabad, India

• Automated a US logistics client's B2B partner data exchange on Dell Boomi, re-architecting the EDI integration processes and tuning runtime configuration to raise processing throughput about 80%.