What is Nur Azhar's technical focus?

Systems engineer retraining toward platform/DevSecOps — Kubernetes, Terraform/OpenTofu, CI/CD and OPA — on a CyberArk PAM and IAM operations background: safe/vault operations, recorded-session review, access recertification, RSA MFA, AD access administration, Tenable credentialed scanning and 24/7 security operations in regulated environments.

Which CyberArk components were owned in production?

Production ownership was operations — safe/vault access, session review and recertification — not greenfield Vault/DR deployment.

What is the enterprise hands-on background?

Hands-on across CyberArk PAM operations, RSA SecurID 2FA with monthly privilege and weekly 90-day recertification, Active Directory and M365 access administration, IBM Guardium administration, Tenable Nessus scans, Carbon Black EDR triage, and delivery of CSA CyberTrust Mark remediation with 125 VAPT findings to validated closure.

How do I start a hiring conversation?

Email career@nurazhar.com about platform/DevSecOps, PAM/IAM operations or SecOps contracts, or see sprint terms at https://nurazhar.com/hire. Singapore citizen, available immediately, remote APAC/global contract with UTC+8 and EMEA overlap; Singapore hybrid considered.

$ whoami

Nur Azhar

Systems engineer retraining toward platform / DevSecOps

Kubernetes — Terraform/OpenTofu — CI/CD — OPA · IAM/PAM operations background

CyberArk PAM and IAM Operations Engineer with 7 years across regulated government, critical-infrastructure and enterprise environments. Safe/vault operations, session review, access recertification, RSA MFA, Active Directory, Tenable credentialed scanning and 24/7 security operations to closure — including 125 VAPT findings to validated closure. Builds Python and Babashka automation for access audits and policy gates. Available immediately from Singapore for remote APAC/global contracts or Singapore hybrid engagements. Production ownership was operations, not greenfield deployment. Now retraining toward platform engineering — Kubernetes, Terraform/OpenTofu, CI/CD and policy gates.

Singapore Citizen · Available ImmediatelyRemote APAC / Global Contract · UTC+8 with EMEA OverlapSG Hybrid Contracts Considered

Singapore Citizen · Available Immediately · Remote APAC/Global · UTC+8 with EMEA Overlap

View Open-Source Security Automation Repositories→Contact for Platform / DevSecOps Roles→Fixed-scope paid trial — see terms→

Hiring Lanes — Operations Background, Platform Direction

PAM Operations

CyberArk safe/vault access, recorded-session review, privileged-access recertification, RSA SecurID, and AD access administration — reliable operations with audit-ready evidence.

Access Governance + Automation

Joiner/mover/leaver evidence, dormant-account and MFA-gap detection, OPA/Rego least-privilege gates in CI/CD. Deterministic CLI tooling (pam-audit-clj, identity-policy-as-code) that cuts audit prep from weeks to hours.

SecOps & Vulnerability Operations

EDR triage, SOC advisory handling, Tenable credentialed scanning, Guardium administration, and VAPT remediation tracking to validated closure — the second lane behind IAM/PAM.

Operations Evidence, Not Architecture Slides

Three hiring lanes, one operating principle: reliable operations, audit-ready evidence, and automation where it removes manual review effort. Direction of travel: platform engineering — Kubernetes, Terraform/OpenTofu, CI/CD.

Privileged Access Operations

CyberArk safes/vault · session review · recertification · RSA SecurID

Privileged access run as operations: CyberArk safe/vault access, recorded-session review and periodic privileged-access recertification in regulated government environments, RSA SecurID MFA, monthly privilege reviews and weekly 90-day inactive-account reviews across provisioning, recertification and deprovisioning workflows.

Access Governance & Automation

JML controls · RBAC least-privilege · audit evidence · Python/Babashka

Joiner-mover-leaver controls, RBAC with least privilege, and deterministic audit evidence. Python and Babashka automation for access audits, dormant-account rules, MFA-gap reports and CI policy gates — operations first, automation where it removes manual review effort.

SecOps & Vulnerability Operations

Carbon Black · SOC advisories · Tenable scans · VAPT closure

24/7 security operations: Carbon Black EDR triage, HTSOC/GCSOC/IOC advisory handling with SLA evidence, Tenable credentialed scans with target onboarding and audit reviews, IBM Guardium administration, and 125 VAPT findings across 29 systems driven to validated closure.

Availability — Contract Sprints

Available immediately from Singapore for remote APAC/global contracts (UTC+8 with EMEA overlap); Singapore hybrid considered. Adjacent billable work I already do: privileged-access review sprints, IAM runbook packs, VAPT closure tracking, access-review automation, PDPA pre-commit gates.

Proof — PAM Audit, Policy Gates, PDPA Scanner

Auditable, deterministic access-review and policy tooling. Portfolio labs — not production CyberArk integrations — with tests and CI badges on main.

pam-audit-clj

PAM / SCIM audit CLI — detects dormant accounts, missing MFA and unvaulted privilege; exports deterministic audit evidence. Portfolio lab — not a production CyberArk integration.

Outcome: evidence-ready access reviews that cut audit prep from weeks to hours.

github ↗identity-policy-as-code

Identity policy-as-code — OPA/Rego deny rules evaluate Terraform/OpenTofu plans before deployment.

Outcome: least-privilege enforced pre-deploy; blocks risky IAM before it ships.

github ↗pdpa-sg-clj

Singapore PDPA compliance-as-code toolkit — NRIC Mod-11 static scanning, PII redaction, SARIF/JSON/HTML output, CI gate.

Outcome: PDPA-safe pipelines that pass regulatory review. Audits every post on this site.

github ↗identity-control-plane

Workload identity control plane — enforcement API with fail-closed OPA authorization. Portfolio lab.

Outcome: repeatable access-decision evidence with no ambient authority.

github ↗

Research & Writing

Selected deep-dives on operations, platform retraining, and vulnerability closure. Full archive of 207 posts on the archive page.

Case Study: Implementing Deterministic Telemetry & Flight Recorders for Agentic Execution Pipelines

Case study on implementing deterministic telemetry and flight recorders for agentic execution pipelines: immutable DAG evidence, SHA-256-chained runs, and four failure modes caught by dogfooding before production.

Architectural Patterns: Multi-Tiered State Storage for Immutable Systems

Traditional agent frameworks serialize giant state dictionaries on every step. An immutable DAG engine splits storage into three layers — HAMT pointers in RAM, content-addressed blobs on disk, and a replay proxy store — and last night I built layer two for real.

Building pdpa-sg-clj — A Clojure/Babashka Scanner Library With NRIC Mod-11 and ripgrep NDJSON

Deep-dive into the architecture of pdpa-sg-clj — how it uses Babashka, ripgrep NDJSON, and the Singapore NRIC Mod-11 checksum algorithm to build a fast, correct PII scanner library.

Six Security Automation Tools in Babashka: A Modular Security Automation Monorepo

How I built six security automation assistants as a babashka monorepo with pure functions, a self-contained CSV parser, and 175 assertions of golden tests — zero external dependencies, zero linter warnings, zero bugs.

I Made My Blog Discoverable by AI Agents — llms.txt, Content-Type, and the Agent Discovery Flow

How I implemented the llmstxt.org standard on nurazhar.com — dynamic llms.txt generation, proper Content-Type headers, and an agent discovery flow that lets AI agents navigate the whole archive without scraping.

Open Source & Platform / Operations Contracts

Explore the proof repos, or reach out about platform/DevSecOps, PAM/IAM operations, or SecOps contracts — remote APAC/global or Singapore hybrid. Singapore citizen, available immediately. Direct contact:

career@nurazhar.com