Manish J.

I secure enterprise AI platforms and the agents built on them - the problem area that does not yet have an established playbook. Ten years in security. Nine of them at KPMG (India then UK), analyst to SecOps Manager, leading a 30+ analyst threat hunting function and running SecOps delivery for financial services, media and law firm clients. Four months at Okta. Today my work is split between enterprise AI platform governance and building the systems that verify what agents actually do. WHAT I DO NOW - Enterprise AI platform governance. Custom RBAC governed by additive directory groups, with a per-group capability matrix covering code execution, memory, web search, public projects and skill sharing as separate decisions rather than one "power user" tier. SSO and SCIM where the deprovisioning path gets the same attention as provisioning, because that is the half that matters at audit. - MCP server security. Model Context Protocol servers stood up against production data platforms and SIEMs, then hardened. A poorly scoped MCP server is a credentialed, always-on path into production data that bypasses your access review process entirely. - Agent supply-chain defence. Every @latest and unversioned npx -y stripped from agent and IDE configurations and pinned against an approved server register. An auto-updating dependency inside an agent loop is remote code execution on a delay. Enforcement carried by the endpoint management platform, not by a policy document asking people to comply. - AI governance evidence. Controls mapped to the EU AI Act, NIST AI RMF and ISO/IEC 42001, with release decisions driven by evals and red-team results against pre-defined criteria rather than subjective sign-off. SYSTEMS I HAVE BUILT - Shiva + Kartikeya. Compiles an agent from a requirement, gates its capabilities on Gate = Blast Radius x Capability Delta, runs it against evals and emits a reproducible Proof Report. Capability is observed from a real tool-call trace at runtime, not inferred from a description. - Garuda. A five-stage LangGraph verdict engine with an adversarial review loop that downgrades citations the model invented and exits non-zero on a weak report, so a pipeline cannot silently consume a bad verdict. - SecureDev. Azure-native SDLC gates: AST analysis of package lifecycle scripts, Shannon entropy for obfuscated payloads that carry no signature, CycloneDX SBOM, and OPA/Rego policy gates so the release decision is auditable and reproducible. - ARGUS. Dependency and software supply-chain risk engine: SCA, SBOM, control-mapped evidence and change-impact analysis. THE SECURITY DEPTH UNDERNEATH Microsoft Sentinel, Defender XDR, Purview, Intune, Entra ID, conditional access, PIM, DLP, eDiscovery, Databricks governance, Splunk, RSA NetWitness, Qualys, Tenable, CrowdStrike, Carbon Black, Palo Alto. Threat hunting against APT and ransomware operators, incident response on major incidents, and multi-cloud threat modelling across Azure, AWS and GCP. HOW I WORK Evidence-first. If I could not verify something against the live system, I say so rather than presenting an assumption as a finding. Every deliverable carries what was checked, what was found, what remains unknown, and what I would do next. A security agent that is confidently wrong is worse than no agent, because it manufactures false assurance. So the harness holds the privilege, not the agent. Message me with what you are building and what you are worried about.