Shubham is available for hire
Hire ShubhamShubham Lohar
Verified Expert in Engineering
DevOps and Cybersecurity Engineer and Developer
Pune, India
Toptal member since September 29, 2026
Bio
Shubham is a lead DevOps and cybersecurity engineer with more than 8 years of experience designing secure cloud infrastructure, DevSecOps platforms, CI/CD automation, and Kubernetes environments across AWS, Azure, and GCP. Shubham specializes in infrastructure as code, cloud security, security automation, and the development of reliable, scalable engineering platforms.
Portfolio
Fushi Enterprises
DevSecOps, AWS IoT, Azure, GCP, Kubernetes, CI/CD Pipelines, Terraform, Pulumi...
Knowmax
Kali Linux, Burp Suite, Metasploit, DevSecOps, Cloud...
Persistent Systems Ltd
GitHub Actions, Snyk, JFrog Artifactory, Okta, Ansible, Prometheus, Grafana...
Experience
- Terraform - 9 years
- DevOps - 9 years
- Azure - 9 years
- GCP DevOps - 9 years
- Python - 9 years
- Kubernetes - 9 years
- AWS IoT - 9 years
- Cyber Defense - 8 years
Preferred Environment
AWS IoT, Azure, GCP, Enterprise Cybersecurity
The most amazing...
...platform I've built is a production system of 8 AI agents with least-privilege access and zero baked secrets, deployed on a private VPN-only network.
Work Experience
Lead DevOps & Cybersecurity Engineer
2024 - PRESENT
Fushi Enterprises
- Owned end-to-end DevSecOps across cloud, SOC, and compliance, leading and mentoring a team of 10+ engineers and running quarterly red-team vs. blue-team drills and secure-coding workshops.
- Architected and operated a production platform of 8+ AI agents with LLM guardrails, input/output filtering, policy enforcement, least-privilege tool access, on a private VPN-only network with managed-identity authentication and zero baked secrets.
- Built a private LLM gateway fronting Azure OpenAI and Anthropic Claude with per-user metering, budget caps, prompt-injection guardrails, audit trails, and anomaly alerting for governed, cost-attributed AI access.
- Stood up an autonomous, deploy-triggered continuous-assurance platform that runs QA and security testing on every release behind a two-plane quality-and-security gate.
- Embedded security gates (Snyk, SonarQube, Trivy, SAST/DAST) into every CI/CD stage, reducing critical vulnerabilities by approximately 60%.
- Built multi-cloud infrastructure using Terraform, Pulumi, and Helm with policy-as-code (OPA/Rego, AWS Config) and hardened Kubernetes via RBAC, Pod Security Admission, OPA Gatekeeper, and Falco runtime detection.
- Engineered and automated data pipelines on Apache Airflow and Spark with an Apache Iceberg lakehouse and Project Nessie catalog versioning for reproducible, governed analytics for the data team.
- Engineered SIEM detection and response in Elastic, Wazuh, and Splunk by authoring correlation rules and alert tuning that cut false positives and improved MTTD. Led incident response and root-cause analysis.
- Achieved SOC 2 and HIPAA certification by managing Sprinto and Drata for continuous control monitoring and evidence automation; external audits passed with zero findings. Remediated CSPM findings across AWS and Azure.
- Drove cloud FinOps through cross-cloud cost review and legacy-infrastructure decommissioning that recovered approximately $2,000 per month while right-sizing the estate.
Technologies: DevSecOps, AWS IoT, Azure, GCP, Kubernetes, CI/CD Pipelines, Terraform, Pulumi, Helm, AWS Config, Role-based Access Control (RBAC), OPA Gatekeeper, Falcon, Apache Airflow, Apache Spark, Apache Iceberg, Elastic, Wazuh, Splunk, Snyk, SonarQube, Trivy, SAST/DAST, Drata, LiteLLM, DevOps, AWS Security Hub, Argo CD, GitLab, GitOps, AWS DevOps, Amazon EKS, Amazon Web Services (AWS), Cloud, GitLab CI/CD, Infrastructure as Code (IaC), Technical Leadership, Docker, Architecture, Cloud Architecture, Cloud Infrastructure, Cost Reduction & Optimization (Cost-down), Containerization, Finance, Google Cloud Platform (GCP), Site Reliability Engineering (SRE), Infrastructure, Monitoring, ELK (Elastic Stack), Microservices, PostgreSQL, Spark, Full-stack, Python
Senior Security Engineer
2024 - 2024
Knowmax
- Led a red-team engagement using Kali Linux, Burp Suite, and Metasploit, simulating full MITRE ATT&CK kill chains, including initial access through lateral movement, privilege escalation, and exfiltration.
- Pen-tested web apps and APIs for OWASP Top 10 vulnerabilities such as IDOR, SSRF, broken authentication, and injection. Delivered CVSS-scored full-chain PoC findings with executive and technical reporting.
- Performed end-to-end security scans across applications, APIs, infrastructure, containers, and cloud environments, identifying vulnerabilities and supporting remediation efforts.
Technologies: Kali Linux, Burp Suite, Metasploit, DevSecOps, Cloud, Infrastructure as Code (IaC), Technical Leadership, Docker, Architecture, Cloud Architecture, Cloud Infrastructure, Containerization, Google Cloud Platform (GCP), Site Reliability Engineering (SRE), Infrastructure, Monitoring, Microservices, Python
Engineering Lead (DevOps)
2024 - 2024
Persistent Systems Ltd
- Hardened the software supply chain by implementing GitHub Actions CI/CD with build-time Snyk scanning as well as JFrog Artifactory artifact signing and provenance policies.
- Centralized identity with Okta using MFA and zero-trust access; automated CIS-aligned operating system hardening through idempotent Ansible playbooks.
- Built SLO/SLA observability using Prometheus, Grafana, and Datadog with proactive anomaly alerting that reduced MTTR by approximately 35%.
Technologies: GitHub Actions, Snyk, JFrog Artifactory, Okta, Ansible, Prometheus, Grafana, Datadog, DevSecOps, DevOps, AWS Security Hub, Argo CD, GitLab, GitOps, AWS DevOps, Amazon EKS, Amazon Web Services (AWS), Cloud, GitLab CI/CD, Infrastructure as Code (IaC), Technical Leadership, Docker, Architecture, Cloud Architecture, Cloud Infrastructure, Containerization, Finance, Google Cloud Platform (GCP), Site Reliability Engineering (SRE), Infrastructure, Monitoring, ELK (Elastic Stack), Microservices, PostgreSQL, Python
DevOps Engineer
2022 - 2024
Cloudaeon Pvt Ltd
- Built fully automated CI/CD pipelines integrating DevSecOps tooling such as Snyk, Trivy, SAST, and DAST for shift-left security that reduced security defects reaching production by 70%.
- Developed custom threat-modeling templates and tooling for the SDLC design-review process, standardizing a threat-register format adopted across 5 product teams.
- Engineered SIEM detection content on the ELK stack using Lucene and KQL rules mapped to MITRE ATT&CK TTPs; built security-telemetry dashboards that cut analyst investigation time by 40%.
- Ran multicloud security assessments across AWS, Azure, and GCP, remedying IAM misconfigurations, permissive security groups, and unencrypted storage. Automated CIS-aligned baselines using Terraform and Ansible with Azure Just-In-Time access and PIM.
- Implemented DLP via Microsoft Purview, Intune, and Azure Information Protection, enforcing data classification to prevent exfiltration of sensitive data.
Technologies: CI/CD Pipelines, Snyk, Trivy, SAST/DAST, ELK stack, AWS IoT, Azure, GCP, Terraform, Ansible, Microsoft Purview, Intune, DevSecOps, DevOps, AWS Security Hub, Argo CD, GitLab, GitOps, AWS DevOps, Amazon EKS, Amazon Web Services (AWS), Cloud, GitLab CI/CD, Infrastructure as Code (IaC), Docker, Cloud Architecture, Cloud Infrastructure, Cost Reduction & Optimization (Cost-down), Containerization, Google Cloud Platform (GCP), Site Reliability Engineering (SRE), Infrastructure, Monitoring, ELK (Elastic Stack), Microservices, PostgreSQL, Full-stack, Python
Research Fellow
2023 - 2023
Energy Research Institute @ NTU
- Authored a literature review paper on real-time performance in 2D and 3D object detection for autonomous driving, cited in over 40 academic works.
- Completed MATLAB ONRAMP certification; organized more than 300 research papers in Mendeley. Conducted top business model analysis for Autonomous Mobile Robots.
- Developed and validated MATLAB-based models for energy and utility systems, improving simulation accuracy and supporting data-driven operational decisions.
Technologies: MATLAB, Python
DevOps & Cybersecurity Engineer
2018 - 2022
Fushi Enterprises
- Supported SOC operations, including log analysis, threat hunting, and incident triage. Built SIEM detection rules with Zabbix/Prometheus alerting enriched by open-source threat-intelligence feeds.
- Conducted penetration testing and vulnerability assessments across web apps, internal networks, and cloud environments. Tracked risk-rated findings to closure.
- Performed STRIDE and attack-tree threat modeling for cloud and on-prem systems, maintaining a centralized threat register.
- Designed and managed scalable AWS/Azure infrastructure as code using Terraform or CloudFormation with security controls from day one. Integrated Trivy/Snyk/DAST into Kubernetes workflows.
- Led a team of 5 engineers in security-automation efforts using Bash/Python for log parsing, scanning, and alert triage. Drove incident response, including containment, eradication, and documentation.
Technologies: Zabbix, Prometheus, AWS IoT, Azure, Terraform, AWS CloudFormation, Trivy, Snyk, Dynamic Application Security Testing (DAST), DevSecOps, DevOps, AWS Security Hub, Argo CD, GitLab, GitOps, AWS DevOps, Amazon EKS, Amazon Web Services (AWS), Cloud, GitLab CI/CD, Infrastructure as Code (IaC), Technical Leadership, Docker, Architecture, Cloud Architecture, Cloud Infrastructure, Cost Reduction & Optimization (Cost-down), Containerization, Finance, Google Cloud Platform (GCP), Site Reliability Engineering (SRE), Infrastructure, Monitoring, ELK (Elastic Stack), Microservices, PostgreSQL, Spark, Full-stack, Python
Experience
Azure 3-tier Infrastructure with Automated CI/CD
I designed and delivered a production-grade 3-tier application platform on Microsoft Azure, provisioned entirely as code with Terraform. The architecture separated web, application, and data layers, each in its own subnet, with all internal traffic routed over Azure Private Link, so no tier was exposed to the public internet. The compute layer ran on Virtual Machine Scale Sets for horizontal autoscaling and was fronted by a load balancer.
I built the full delivery pipeline: remote Terraform state on an Azure Storage back end, CI authenticated through a dedicated Entra service principal, and an isolated, idempotent database restore path proven with recovery evidence. Secrets were held in purpose-scoped Key Vaults with purge protection.
I authored an in-repo runbook covering deploy, teardown, and recovery so the environment could be rebuilt deterministically from a single bootstrap script. I owned the infrastructure design, the pipeline, the private networking model, and the disaster-recovery validation end to end.
I built the full delivery pipeline: remote Terraform state on an Azure Storage back end, CI authenticated through a dedicated Entra service principal, and an isolated, idempotent database restore path proven with recovery evidence. Secrets were held in purpose-scoped Key Vaults with purge protection.
I authored an in-repo runbook covering deploy, teardown, and recovery so the environment could be rebuilt deterministically from a single bootstrap script. I owned the infrastructure design, the pipeline, the private networking model, and the disaster-recovery validation end to end.
Education
2021 - 2024
Bachelor's Degree in Computer Engineering
Vishwakarma University - Pune, India
2018 - 2021
Diploma in Computer Technology
Bharati Vidyapeeth’s Jawaharlal Nehru Institute of Technology - Pune, India
Certifications
OCTOBER 2024 - PRESENT
IBM Cyber Security & Forensics Graduate
IBM
MARCH 2024 - PRESENT
Google Cybersecurity Professional Certificate
SEPTEMBER 2023 - PRESENT
Microsoft Security, Compliance & Identity Fundamentals (SC-900)
Microsoft
AUGUST 2023 - PRESENT
MATLAB ONRAMP Certification
NTU Singapore
APRIL 2023 - PRESENT
IBM ICE Hackathon 2023 – 3rd Place
IBM
Skills
Libraries/APIs
Node.js
Tools
Jenkins, Terraform, Helm, Apache Airflow, Apache Iceberg, Elastic, Splunk, SonarQube, Ansible, Grafana, Metasploit, Zabbix, AWS CloudFormation, Confluence, AWS IAM, Amazon Virtual Private Cloud (VPC), CircleCI, Bitbucket, Suricata, NMap, Nessus, Wireshark, Azure Kubernetes Service (AKS), Azure Key Vault, GitLab, Amazon EKS, GitLab CI/CD, ELK (Elastic Stack), GitHub, Jira, MATLAB
Languages
Python, Bash Script, Falcon, TypeScript, Groovy, SQL, Bash
Frameworks
Apache Spark, Next.js, Flask, OpenVAS, Spark
Paradigms
DevOps, DevSecOps, Role-based Access Control (RBAC), Azure DevOps, ETL, Microservices
Platforms
Kubernetes, AWS IoT, Azure, Wazuh, Kali Linux, Burp Suite, Docker, Amazon Web Services (AWS), Google Cloud Platform (GCP)
Storage
MySQL, PostgreSQL, MongoDB, Memcached, Datadog
Industry Expertise
Cybersecurity
Other
Cyber Defense, GCP DevOps, GitHub Actions, CI/CD Pipelines, GCP, Pulumi, AWS Config, Snyk, Trivy, SAST/DAST, Drata, Okta, Prometheus, ELK stack, Microsoft Purview, Intune, Dynamic Application Security Testing (DAST), Security Groups, LiteLLM, Audit trails, Static Application Security Testing (SAST), SLSA, OWASP Top 10, Elastic SIEM, STRIDE, PASTA, MITRE ATT&CK, Qualys, Autopsy, HTML/CSS, Programming, Engineering, Azure ACA, vmss, Azure private link, API Key, Networking, Disaster Recovery Automation, IT Security, Enterprise Cybersecurity, Hackathons, AWS Security Hub, GitOps, AWS DevOps, Cloud, Infrastructure as Code (IaC), Technical Leadership, Architecture, Cloud Architecture, Cloud Infrastructure, Cost Reduction & Optimization (Cost-down), Containerization, Finance, Site Reliability Engineering (SRE), Infrastructure, Monitoring, Full-stack, AI Engineering, OPA Gatekeeper, JFrog Artifactory, Argo CD, SOC 2, HIPAA, PCI DSS, AIP, VAPT
Collaboration That Works
How to Work with Toptal
Toptal matches you directly with global industry experts from our network in hours—not weeks or months.
1
Share your needs
Discuss your requirements and refine your scope in a call with a Toptal domain expert.
2
Choose your talent
Get a short list of expertly matched talent within 24 hours to review, interview, and choose from.
3
Start your risk-free talent trial
Work with your chosen talent on a trial basis for up to two weeks. Pay only if you decide to hire them.
Top talent is in high demand.
Start hiring