Ankit Jangir

One orchestrator running specialist agents across three surfaces — code and application security, cloud posture and cost, and deployment. Each agent owns its domain and reports back through a single scored channel.

• The deploy agent shipped ~250 same-day releases in a month across roughly 20 project teams — a fixed seven-step path: validate, review, snapshot, migrate, sync, rebuild, verify. Non-production only; production is never touched by an agent.
• The cloud agent patrols every AWS account for internet-exposed hosts, open database ports, obsolete TLS, end-of-life software and publicly readable files — then checks account policy and posts a daily cost report naming the specific optimisations worth making.
• The security agents swept 264 repositories for a supply-chain advisory in one afternoon, parsing lockfiles so transitive pins were caught and not just declared dependencies.
• Rule-based detection, model-based judgement. Scanners are deterministic so findings stay reproducible between runs; the model only triages, remediates and summarises.
• Backup before every write, health check after — the reason a month at that deploy volume produced no production incidents.

A protocol for building software end to end with AI. Three plugins — Account Manager, Architect, Builder — each carrying its own skills, tools and commands, handing work down a gated chain from discovery through solutioning to build and test. The process cannot be skipped, because the tooling refuses.

• Gates enforced in the tooling, not the wiki. The Architect's commands stay locked until a signed charter exists; the Builder's until the solution document is approved. Process drift becomes impossible rather than discouraged.
• Sub-personas inside the build loop — QA writes failing tests from the acceptance criteria before any implementation exists, Dev writes the minimum that passes, docs ship in the same PR, and a reviewer gates the merge.
• Five specialist reviewers run in parallel on every change: permissions, SQL injection, PII leakage, endpoint exposure, and translation coverage. Critical findings block the merge.
• Scope drift is surfaced, not absorbed — a weekly sweep compares live work against the locked charter and drafts the change request.
• A versioned central skill library behind the plugins, semver'd and eval-gated, so a change to shared behaviour is a release rather than a surprise.

The security programme our platforms are assessed against. I wrote it, I keep it current, and I am the person who sits opposite the assessors when a bank asks to see it.

• 34 numbered policies — access control, incident response, secure development, third-party risk, cloud security, PAM, data classification and localization.
• 16 operational registers that make the policies falsifiable: asset inventory, incident log, access recertification, DR-drill records, VAPT findings tracker.
• Carried through the vendor security review of banks, insurers and a Big-Four assessor — each a full controls-to-evidence exercise.

The platform our SaaS products run on. Designed for the two things that are expensive to retrofit: horizontal headroom, and an audit trail that satisfies an enterprise security review.

• Karpenter for node autoscaling rather than fixed groups — capacity follows demand instead of peak provisioning sitting idle overnight.
• Security plane across the account: GuardDuty, Security Hub, Inspector, Config, KMS and ACM, with bastion access behind MFA only.
• Observability from day one — Prometheus, Grafana and Loki internally, Site24x7 checking from outside the perimeter.