Portfolio · Resume · LinkedIn · Email

About I am a Security Engineer focused on AI & Agent Security, Application Security, Cloud IAM Security, and Model Supply-Chain Security. I secure three trust boundaries where AI systems become security-critical: Agent → Tool, Identity → Authority, and Artifact → Runtime. My work emphasizes default-deny design, reproducible testing, security telemetry, and evidence that can be independently reviewed. I completed an M.S. in Information Technology (Security) at Arizona State University, GPA 3.87/4.00.

• LLM Red Team Framework: adversarial evaluation for LLM security
• Dataset Poisoning Detector: statistical and streaming checks for training-data integrity
• Adversarial ML Lab: FGSM, PGD, C&W, robustness evaluation, and MITRE ATLAS mapping

• Independent AI Security Researcher & Engineer · Self-directed research · Aug. 2024 to Present
  • Led security design and architecture reviews across self-directed AI and cloud security systems, translating threat models into enforceable requirements, CI gates, and documented repository release criteria.
  • Expanded the MCP Gateway validation track from 622 to 723 passing tests (+16.2%), while statement coverage rose from 78.41% to 81.91% (+3.5 percentage points) as measured Python statements grew from 4,679 to 5,644 (+20.6%).
• Business & Compliance Lead, AEROSEC (academic externship) · Honeywell Aerospace Technologies × ASU · Aug. 2025 to Dec. 2025
• Graduate Teaching Assistant / IT Grader · Arizona State University · Jan. 2025 to Oct. 2025

AI & Agent Security: MCP/JSON-RPC 2.0, tool-call security, prompt injection, LLM red teaming, model supply-chain security

Identity & Application Security: Cloud IAM Security, AWS IAM, least privilege, trust policies, permission boundaries, capability-based authorization, API security, threat modeling

Security Engineering & DevSecOps: Python, FastAPI, pytest, GitHub Actions, CI/CD security, SARIF 2.1.0, GitHub Code Scanning, Docker

Detection & Observability: Elastic Security, ECS, SIEM, Prometheus, tamper-evident audit logging, MITRE ATLAS

A Personalized E-Learning System Using Reinforcement Learning Through Satellite · IEEE INDICON 2023

Portfolio: https://poojakira.github.io/Pooja_Kiran_Portfolio_Website/
LinkedIn: https://www.linkedin.com/in/poojakiran/
Email: poojakiranbhardwaj@gmail.com

_{The headline test and coverage metrics above are tied to explicitly cited October 2026 hosted runs; the 69-signature figure is a separate detector source count. These must not be treated as a joint security-effectiveness experiment. Consult RESUME_METRICS_EVIDENCE.md for the evidence sources. Original development periods are documented separately in each repository's provenance file; current metrics are not projected backward to project inception.}

See evidence and limitations. Passing CI at a dated commit or a preview deployment does not certify all source, security controls or operational claims.

Maintenance checks and their limits are recorded in the October 9 fix verification.

• MCP Agent Security Gateway: CI 38012954359, Python 3.12 782 passed, 81.93% coverage. The 69 signatures are a separate code inventory, not this run's efficacy measure; older 723/81.91%/55 metrics remain historical.
• AWS Agent Identity Guard: CI 38009457205, 247 collected, 244 passed, 3 credential-dependent skips.
• HF Model Provenance Scanner: CI 38002138828, 260 passed, 1 skipped, 6 subtests, 75.67% statement coverage. The 33/33 fixture count remains scoped to committed adversarial examples, not real-world detection rate.
• Older resume PDFs and historical posters may cite different snapshots; never silently replace their denominators or combine dates. See RESUME_METRICS_EVIDENCE.md.