Headline

Staff Engineer | Distributed Systems & Network Security | DLP in C++/Go · System Design · 120 PoPs · AWS · Kubernetes · DPDK · gRPC | Open to Staff / Senior Staff / Principal roles

About

Every system I've built for 13 years has had the same job: move enormous traffic — without dropping a record, leaking access, or adding a millisecond it can't afford. That's the hot path. A single bug there shows up as lost data or an open door. I didn't set out to specialize in it — I just kept chasing the hard problems, and they kept living in the same place. 🔹 Today — Staff Engineer, Data Security (DLP) @ Netskope I took a Go microservice from a blank page to GA across 120 points of presence, then rebuilt the C++ forensics path behind it from synchronous to asynchronous — pushing reliability past 99.9% and turning ~60–70K lost forensic records a year into near zero. The whole path runs on short-lived workload identity, so no standing access sits in the pipeline. The work I'm proudest of, though, isn't a single service. 🔹 It's the direction The design and testing standards two teams build to are mine. I mentor across both, and pulled our delivery speed up 3–4x by building automation into how we ship. The systems I care about most are the ones that keep running long after I've stepped away. 🔹 The path here At Imperva, I owned the edge access-control path in multithreaded C/C++ on a DPDK kernel-bypass pipeline — writing the deny-by-default Geo ACL logic that decided, per request and at line rate, what traffic was allowed or dropped across the scrubbing edge. That edge once held against a record 25.3-billion-request DDoS; at that scale, correctness under load stops being a feature and becomes the whole job. Before that at Altran, I put every privileged session onto production routers and switches behind RADIUS/TACACS+ AAA — authenticated, authorized, accounted for. And it started in payments, writing settlement servers where a dropped transaction wasn't a bug — it was money, gone. 🔹 The through-line Distributed systems and network security, built to stay fast, correct, and secure under pressure — from low-level C/C++ (DPDK, lock-free concurrency, epoll) up to Go microservices (gRPC, event-driven, backpressure) on AWS and Kubernetes. The interesting failures live where performance, scale, and security collide — and that's the work I want more of. 📩 I'm looking for my next hard problem — at the Staff, Senior Staff, or Principal level. If you're building high-throughput infrastructure or network-security platforms in Go or C/C++ and want someone who works from the kernel to the service mesh, I'd like to hear about it. Reach me here or at burman.vishal@hotmail.com.

Location

Bengaluru

AI stack

claude code

claude

cursor

gemini

github copilot

opencode

Work experience

Staff Engineer at Netskope, Apr 2025 - Jul 2026 · 1 yr 4 mos, Bengaluru, Data-security services that inspect and protect enterprise traffic at scale on AWS EKS. ⚙️ Owned dlp-event-generator, a stateless Go microservice, end to end — designing, building, and driving it through staged rollout to GA across 120 points of presence; goroutine and buffered worker pools with WaitGroup synchronization sustain 500–700 req/s on payloads from a few KB to 128 MB into S3. 📈 Re-architected the core C++ DLP path from synchronous to asynchronous and spooled decrypted forensics to local disk so egress retries replay from disk instead of re-downloading from S3 — lifting pipeline reliability past 99.9% and cutting ~60–70K lost forensic records a year to near zero. 🔐 Eliminated long-lived static credentials from the DLP data path by federating Kubernetes service accounts to scoped AWS roles through the cluster OIDC provider (IRSA, EKS pod identity), so every S3 call runs on short-lived STS credentials with zero standing access. 🔑 Built the forensics decryption path — unwrapping per-request AES keys with a Vault-held private key, then streaming GCM-encrypted objects from S3 and re-encrypting in 64 KB chunks — keeping memory flat on payloads up to 128 MB. 🤝 Defined service data contracts in OpenAPI (JSON/HTTP ingress, gRPC/Protobuf egress) so producer and consumer teams ship independently; authored the domain-driven design and testing standards now used across two teams and drove a 3–4x delivery speedup for 5–7 engineers via human-approved CI automation.

Lead Engineer at Imperva, Apr 2024 - Mar 2025 · 1 yr, Hybrid, 🛡 Doctored the edge Geo ACL feature for DDoS mitigation and traffic scrubbing in multithreaded C/C++ on a DPDK packet pipeline, blocking malicious and untrusted regional traffic across global scrubbing centers of a SaaS platform handling hundreds of millions of requests a month 📊 Ran cluster-health dashboards across Grafana, Prometheus, and Coralogix, giving the team proactive visibility into the scrubbing fleet. 🎯 Set design direction on the edge access-control path and interviewed backend and security candidates on system design and C/C++.

Senior Software Engineer at Imperva, Apr 2022 - Mar 2024 · 2 yrs, Remote, ⚡ Replaced the ranking method in the real-time C++ analytics service with an in-memory top-K algorithm, sharpening anomaly and attack-pattern visibility without adding latency to the hot path. 🩺 Built an active health checker in Go with bounded worker pools that maintains a live in-memory view of cluster topology, continuously discovering proxy nodes and their state while holding health-probe times under a millisecond. 🔧 Tuned the NGINX reverse-proxy layer returning scrubbed traffic to customer origins, keeping the security path low-latency at production scale.

Technical Lead at Altran, Jun 2019 - Mar 2022 · 2 yrs 10 mos, Greater Bengaluru Area, 🏗 Architected a model-driven network management agent from scratch in C++ using an OOP provider-factory pattern, decoupling the device and transport layers from business logic so a new device family lands as a drop-in connector plugin against a stable core. 🔐 Integrated a RADIUS/TACACS+ authentication client into the libnetconf2 SSH transport layer, giving privileged device management a full AAA path so every operator session against production routers and switches authenticated to a central identity store and was accounted for. ✅ Built a transactional configuration pipeline with libyang that validates incoming OpenConfig XML/JSON against compiled YANG schemas before commit, rejecting invalid or unsafe privileged changes before they reach a live device. 📡 Delivered an agentless call-home module that establishes management sessions to controllers behind customer firewalls, with session handshake and retry handling, alongside a real-time state and telemetry notification stream.

Technical Lead at HARMAN India, Dec 2018 - Jun 2019 · 7 mos, Greater Bengaluru Area, ⚡ Built low-latency, lock-free asynchronous request queuing (sd-bus/GDBus) for the automotive control plane, tuning D-Bus limits and backpressure to cut context-switch overhead on the in-vehicle message path.

Software Engineer at GE Transportation, Oct 2015 - Dec 2018 · 3 yrs 3 mos, Bengaluru, ⚙️ Developed embedded C/C++ locomotive control and HMI software (MQX/QNX RTOS, Qt) for US and Canadian rail-yard operations. 🖥 Built new HMI screens and Tower IPM features enabling remote locomotive control in train yards, improving rail-yard operational efficiency.

Education

HSC, Science, Jawahar Vidya Mandir, Shyamali

Bachelor of Technology (B.Tech.), Electronics and Communications Engineering, Rajasthan Technical University, Kota

Public links

github: https://github.com/vishalearnz