>_ whoami

Aman Bains

Tech Lead / Security Architect

12+years in cyber security

8enterprise security roles

3edge platforms mastered

>_ summary

Driven, dedicated, and customer-oriented Information Security Professional with over 12 years of extensive experience across IT Infrastructure, Endpoint, Web Application, Cloud,CDN and Network Security environments. Proven track record in the end-to-end design, implementation, delivery, and governance of high-performance cyber security architectures. Adept at piloting enterprise-level security operations, managing cross-functional global teams, optimizing infrastructure cost structures, and mitigating emerging threat landscapes to fulfil complex business requirements.

>_ core_expertise

Strategy & Governance

Security Architecture & Design Cyber Security Project Management Security Consulting NIST, ISO, PCI-DSS, SOC2 Cloud Governance

Cloud & Web Security

Akamai Ecosystem Cloudflare Stack Web Application Firewall (WAF) Bot Protection API Security Enhanced DNS (eDNS) CASB , CWPP , CSPM DDOS

Threat Management & Ops

XDR / EDR - Palo Alto SIEM (Splunk) Data Leakage Prevention (DLP) - Forcepoint and Skyhigh UEBA Forcepoint (Web & Email Security) Vulnerability Assessment - Nessus

>_ experience --all

Tech Lead, Solution Architecture (Post Sales)

Dec 2025 — Present

Trantor Software Pvt Ltd · Enterprise Solutions Architecture & Security

Lead the conceptual architecture, structural implementation, and end-to-end edge delivery of robust Cloudflare solution frameworks across enterprise micro-services and multi-cloud web landscapes.
Architect and configure high-performance Layer 7 application protection utilising Cloudflare Advanced WAF, Bot Management, Page Shield, and API Shield to mitigate automated threat variants and OWASP Top 10 vulnerabilities.
Drive Zero Trust corporate architecture transformation workflows deploying Cloudflare Access (ZTNA), secure DNS routing, Magic Transit protection layers, and modern serverless application firewalls.
Conduct internal team trainings on Cloudflare solutions (CF One, AppSec, Developers Platform, Network Services).

Security Manager

Apr 2025 — Dec 2025

Paytm (One97 Communications Ltd.) · Cloud Security & Security Operations

Directed the conceptual design, end-to-end implementation, and delivery governance of strategic cloud security solutions; tailored security architectures for partners and vendors connecting to the Payment infrastructure (implemented mTLS, redesigned the default architecture for specific use-cases).
Managed, trained, and guided a high-performing team of security engineers handling daily BAU operations across CDN, WAF, XDR, and enterprise cloud security initiatives.
Held full accountability as the senior security lead, driving continuous technical evolution alongside comprehensive people and vendor relationship management.
Architected and secured scalable multi-cloud infrastructure across AWS (S3, ELB), Cloudflare, and Akamai ecosystems, enforcing automated DevSecOps pipelines and edge security frameworks.

Senior Security Lead

Apr 2023 — Mar 2025

Paytm (One97 Communications Ltd.) · Cyber Security Department

Designed and built the organisational technical roadmap for accelerated cloud security adoption.
Performed deep-dive technical gap assessments of the implemented Akamai stack to overhaul and optimise the organisation's overarching security posture.
Deployed advanced WAF, eDNS, Bot Protection, and API security architectures across the Akamai product portfolio to support volatile transaction demands.
Orchestrated full lifecycle implementation of complex security platforms (EDR, SIEM, Cloud Proxy, WAF, DLP) from conceptual design through structural optimisation and multi-million dollar cost optimisations.
Authored and delivered concise security review reports and tactical risk briefings directly to the C-suite and executive board.
Ran a Cloudflare POC and migrated one TLD from Akamai to CF, mapping core capabilities — WAF, Bot Management, AI crawler, Data Localisation, Transform rules.

Security Lead

Jul 2021 — Apr 2023

Paytm (One97 Communications Ltd.) · Cyber Security Department

Created and implemented the Akamai roadmap for rolling out their solution portfolio across the fin-tech environment.

Security Architect II

Aug 2017 — Jul 2021

Akamai Technologies · Global Security Services (GSS) | Professional Services (APJ)

Contributed core architecture insights on concept feasibility and technological solution scoping within high-impact cross-functional projects.
Owned end-to-end technical delivery frameworks and customer integrations — configuration, debugging, systemic testing, documentation, and post-go-live stabilisation.
Partnered continuously with Account Management — Sales, Pre-Sales, AkaTech, Product Engineering — to manage offerings and discuss up-sell / cross-sell opportunities.
Scoped project timelines, evaluated architecture vulnerabilities, and enacted concrete risk-mitigation blueprints.
Served as primary SPOC and trusted security advisor for enterprise client accounts — strategic reviews, technical training, and solution blueprints.
Worked with major public sector and enterprise customers across ANZ & Greater China to implement Akamai security solutions — WAF, BMP, API security, eDNS — mitigating vulnerabilities via WAF custom logic and supporting audit requirements.

Associate IT Security L2

Aug 2016 — Aug 2017

Publicis Groupe (formerly Sapient / Re:Sources IT) · Global Security Operations Center (GSOC)

Designed and implemented technical solutions securing enterprise cloud workloads across Box, ServiceNow, and Office365 to enforce compliance frameworks.
Specified secure baseline configuration standards covering Cloud Governance, real-time usage analytics, DLP compliance, and UEBA; implemented Skyhigh (CASB).
Supervised corporate log ingestion, active event monitoring, and behavioural intelligence systems using Splunk SIEM.
Co-developed security policies and an architectural playbook establishing the corporate ISMS.
Led deployment of Forcepoint (Websense) Web and Data Security stacks for strict multinational privacy agreements.

Information Security Specialist

Nov 2014 — Aug 2016

IBM India Pvt. Limited · Infrastructure & Endpoint Security

Engineered and managed IT hardware, infrastructure software, networks, and communication technologies to supply robust operational security services.
Represented IBM Security Competency as technical SPOC in weekly client reviews, remediating critical operational risks.
Engineered solution architectures, detailed SOWs, and end-to-end project management plans for new technology adoptions and version upgrades.
Implemented security solutions for one of India's biggest telecom customers — Citrix-WAF, Gemalto-HSM, Forcepoint Web/Data/Email Security, SMG and SEPM (Symantec), Tripwire-FIM.

Associate

Mar 2014 — Nov 2014

IBM — Software Data India Pvt. Limited · Information Security Operations

Supported foundational IBM security operations, providing tier-one troubleshooting for client issues around Antivirus, Proxy nodes, DLP policies, and email gateway security.

>_ education

MCA, Computer Applications2011–14

Bharati Vidyapeeth University, Pune (Institute of Management & Entrepreneurship Development)

BCA, Computer Applications2007–11

G.G.S.I.P.U, New Delhi (JSS Academy of Technical Education)

12th Standard, C.B.S.E2006

Kulachi Hansraj Model School, New Delhi

10th Standard, C.B.S.E2004

Bal Bhavan Public School, New Delhi

>_ recognitions

★

IBM People Manager's Choice Award — conferred for outstanding execution of IBM's core value: “Put the Client First”.

★

IBM People Manager's Choice Award — conferred for exceptional performance embodying: “Trust and Personal Responsibility in all relationships”.

>_ blog --list --sort=recent

Notes from the edge

Short write-ups on the Cloudflare products I actually work with — posted as I use them.

Cloudflare Wheel — all services arranged around a single wheel diagram

04 Aug 2026 · 09:15 IST

Cloudflare Wheel — All Services at a Glance

Cloudflare's own "wheel" diagram is one of those visuals I keep coming back to when I'm explaining our security stack to people outside the team — one circle, every product mapped by what job it does: application security on one edge, network and Zero Trust on another, developer platform tying it together in the middle. I still start most architecture conversations by pointing at this wheel and asking, "okay, which slice are we actually short on?" Simple picture, but it's saved me a lot of whiteboard time.

22 Jul 2026 · 18:40 IST

WAF Tuning in Production: Managed Rules vs Custom Logic

Every WAF rollout I've run starts the same way — turn on the managed ruleset, watch it in log-only mode for a week, then start writing the custom rules for whatever the managed set doesn't know about your app. The managed rules catch the obvious stuff (SQLi, XSS, the greatest hits); the custom logic is where you encode what's actually normal for your traffic. Skip that second step and you'll spend your first month firefighting false positives instead of blocking anything real.

05 Jul 2026 · 11:05 IST

Bot Management: Teaching the Edge to Tell Humans from Scripts

Bot Management is the one Cloudflare feature that made "is this a bot?" actually answerable instead of a guessing game — it scores every request instead of just blacklisting user agents, so you stop accidentally blocking Googlebot while a scraper walks straight through with a spoofed header. On login and checkout endpoints especially, that scoring is what separates credential stuffing from a real customer who just fat-fingered their password twice.

19 Jun 2026 · 20:10 IST

Retiring the VPN: Notes from a Zero Trust / Access Rollout

Ripping out a legacy VPN and replacing it with Cloudflare Access was one of the more satisfying migrations I've been part of — instead of a flat network everyone tunnels into, every app sits behind an identity check, and access decisions happen per-request, not per-session. The rollout itself is the hard part: mapping who actually needs what, before you turn on the policy that assumes nobody does by default.

30 May 2026 · 14:25 IST

Magic Transit: Pushing DDoS Scrubbing to the Network Edge

Magic Transit moves DDoS scrubbing off your own network and onto Cloudflare's edge, which matters the moment you're protecting infrastructure that isn't just a website — data centres, on-prem gear, whatever's still sitting behind a public IP. I've found it most useful for the parts of the estate everyone forgets to threat-model because they're "internal," right up until they're the thing getting hit.

12 May 2026 · 09:50 IST

API Shield: Locking Down Endpoints Nobody Remembers They Built

Every org I've worked with has at least one API endpoint nobody remembers building — an old integration, a partner feed, something shipped two years ago and never revisited. API Shield's schema validation and mTLS are what catch those, because you can't secure what you haven't inventoried, and the discovery piece usually turns up more surface area than anyone expects.

27 Apr 2026 · 16:30 IST

Page Shield and the Quiet Threat of Client-Side Scripts

Page Shield watches the third-party scripts running in your users' browsers, which is the blind spot most security programs still don't cover — your WAF protects the request path, but a compromised analytics tag or payment widget executes client-side, past all of that. It's the closest thing I've used to an early-warning system for Magecart-style skimming.

08 Apr 2026 · 10:00 IST

DNS, Argo, and the Unglamorous Job of Being Fast Everywhere

Enhanced DNS and Argo Smart Routing don't get talked about as "security" features, but resilience is a security property — an authoritative DNS layer that stays up under attack, and routing that picks the fastest backbone path instead of the public Internet's best guess. Half the "why is the app slow" tickets I've chased over the years traced back to DNS or routing, not the application at all.