Fuad Bagus

AI Agent & Security Engineer

Security engineer with 30 years in software, now focused on building safe, auditable AI agent systems. I bring enterprise security practice to AI: sandboxed execution, least-privilege tool access, human approval gates and tamper-evident audit trails, on hardened containers and Kubernetes.

Open to AI agent and security roles

About

30 years of software development and consulting, the last decade in security and observability at ASB Bank. My team covers the bank's entire security stack: every new system is onboarded through us so that high-fidelity detections are in place before it goes live. Improved incident response through better monitoring and alerting. Experienced in Agile delivery teams.

30 yearsin software development
Since 2008at ASB Bank, across five teams
Since 2021in the Security Practice

Skills

AI & Agents

  • LLM agent harnesses
  • Tool use
  • Multi-agent delegation
  • Anthropic API
  • OpenAI API
  • Local models (llama.cpp, GGUF)
  • Agent sandboxing and audit

Cybersecurity

  • SIEM
  • SOAR
  • Identity and Access Management (IAM)
  • Detection engineering
  • MITRE ATT&CK
  • Threat intelligence (MISP)

Containers & Cloud

  • Docker
  • Docker Compose
  • Kubernetes (kind)
  • Image hardening and CVE remediation
  • Docker Scout
  • Kubernetes RBAC
  • ingress-nginx
  • Azure Event Hubs
  • AWS S3

Observability & Ingestion

  • Elasticsearch
  • Logstash
  • Kibana
  • Beats
  • Cribl

Programming

  • C#
  • .NET & .NET Core
  • Python
  • Go
  • SQL
  • PowerShell

Automation & CI/CD

  • Azure Pipelines
  • GitHub Actions
  • Octopus Deploy
  • Git

Testing & Practices

  • NUnit
  • MOQ
  • pytest
  • Pester
  • k6 load testing
  • Test-Driven Development (TDD)

Experience

  1. 2008 - Present

    ASB Bank

    Progressed from Senior Software Developer to Software Consultant across five teams.

  2. Jan 2021 - Present

    Software Consultant · Security Practice

    • Part of the team that covers the bank's entire security stack: every new system is onboarded through us before go-live, so that high-fidelity detections are in place from day one.
    • Accelerated incident response by implementing and managing a security event monitoring and alerting platform.
    • Developed the data ingestion pipelines that feed the enterprise SIEM, onboarding diverse data sources to strengthen detection coverage.
    • SIEM Security ImplementationSuccessfully replaced the legacy SIEM solution with a modern platform. This improved detection accuracy and reduced maintenance effort.
    • Ingest Security ImplementationModernized the legacy ingestion layer. This implementation enhanced security event ingestion and reduced maintenance effort.
    • Security Analytics ImplementationLed a successful Proof of Concept (POC) to replace legacy SIEM solutions, scaling the solution to a production environment. This project strengthened security detection capabilities.
    • SIEM
    • Log ingestion pipelines
    • REST APIs
    • C#
    • Go
    • Git
    • Octopus
    • TFS
    • Azure Pipelines
    • GitHub Actions

  3. Jan 2020 - Dec 2020

    Software Consultant · Identity and Protection (Customer Identity)

    • Managed the bank's customer identity and access management (IAM) stack.
    • Introduced automation for repetitive IAM operations, along with automated software component integration and server provisioning to streamline deployment.
    • Implemented and managed security event ingestion to improve monitoring of the identity platform.
    • Collaborated with security and engineering teams to enhance system resilience and ensure compliance with industry standards.
    • IAM
    • REST APIs
    • NUnit
    • MOQ
    • Octopus
    • TFS
    • C#

  4. Jan 2016 - Dec 2019

    Software Consultant · Digital Engagement Platform

    • Developed the Digital Engagement Platform on top of the ATLAS platform built in the previous role.
    • Developed REST APIs for efficient log ingestion into Elasticsearch through Logstash, optimizing data flow.
    • Enhanced system observability using the Elastic Stack, successfully transitioning a proof-of-concept into a full-scale production solution.
    • Streamlined deployment workflows through implementation of CI/CD automation and Git branch policies.
    • Elastic Stack
    • REST APIs
    • NUnit
    • Octopus
    • TFS
    • C#

  5. Jan 2013 - Dec 2015

    Senior Software Programmer · ATLAS Project

    • Implemented IAM security policies and automated log management processes.
    • Developed secure API integrations, ensuring compliance with industry standards.
    • ATLAS PlatformBuilt the ATLAS platform, later the foundation of the Digital Engagement Platform. Automated server provisioning, enhanced observability, and integrated the Elastic Stack for real-time tracking. Improved security monitoring through custom API development and integration.
    • Elasticsearch/Kibana ImplementationLed a Proof of Concept (POC) for replacing legacy logging solutions. Scaled the solution to production on on-premises infrastructure, enabling proactive monitoring and response.
    • IAM
    • SQL
    • JSON
    • REST APIs
    • NUnit
    • Octopus
    • C#

  6. Nov 2008 - Dec 2012

    Senior Software Developer · Teller Team

    • Developed the branch teller application used by front-line staff for customer transactions.
    • Built PIN pad integration for secure customer authentication at the teller counter.
    • Developed backend services supporting the teller systems.
    • C#
    • .NET
    • SQL
    • WinForms
    • WCF

  7. 1998 - 2008

    Old Mutual · Technology

    Senior Software Developer (Jan 1998 - Oct 2008). Built the GCS client CRM system and an enhanced telephony integration for the contact center.

    • C#
    • Delphi
    • SQL
    • COM+
    • IBM MQ
    • VB6

  8. 1996 - 1997

    Ankerdata · Point of Sale

    Junior Software Developer (Jan 1996 - Dec 1997). Point of sale front end and stock management.

    • VB6
    • SQL

Projects

Cordon - Sandboxed AI Agent Harness

Sep 2026 - Present Overview video

A provider-neutral agent harness, inspired by Hermes Agent and rebuilt where its design did not fit: about 12,000 lines of Python with around 1,000 automated tests.

  • Built an agent loop for Anthropic, OpenAI-compatible and local llama.cpp models, with parallel tool calls, parallel subagent delegation and an automatic model fallback chain.
  • Designed security controls for autonomous agents: a sandbox that fails closed, network egress through an allowlist proxy, a scrubbed environment, and an approval gate on every tool call.
  • Implemented a tamper-evident, hash-chained audit log with documented SIEM signals for egress, approvals, configuration changes and failures.
  • Built a hardened local web UI (token auth, Host and Origin checks, strict CSP) with streaming chat, a live view of running subagents, voice control, and context compaction for long sessions.
  • Python
  • Anthropic and OpenAI APIs
  • llama.cpp
  • Docker
  • macOS sandbox (seatbelt)
  • SQLite
  • pytest
  • JavaScript

SonicSort - Containerized Microservices on Kubernetes

Jun 2025 - Present

A Python and React music-library application that I containerized, split into microservices and run on Kubernetes.

  • Built 11 container images and deployed the stack as 16 Kubernetes Deployments with PostgreSQL, MinIO, Redis and a Redpanda event broker driving an event-driven processing pipeline; Docker Compose kept as a local development alternative.
  • Hardened images by clearing the fixable CVEs Docker Scout reported: multi-stage builds that copy in only the binaries needed, a statically linked ffmpeg so vulnerable shared libraries never enter the image, OS package upgrades at build time, and pip removed from runtime images.
  • Applied least-privilege Kubernetes RBAC (a namespace-scoped, read-only service account for the app) and a separate breakglass admin identity with documented rotation and revocation; resource limits and health probes on every service.
  • Automated cluster bootstrap and redeployment (kind, ingress-nginx, metrics-server) with PowerShell, and load-tested Docker Compose against Kubernetes with k6, including database connection-pooling verification.
  • Docker
  • Docker Compose
  • Kubernetes (kind)
  • ingress-nginx
  • Docker Scout
  • PostgreSQL
  • MinIO
  • Redis
  • Redpanda
  • k6
  • PowerShell

Other projects

IT Automation Scripts

PowerShell toolkit for Windows administration, including a winget-based patching suite with installer. Covered by Pester test suites, with automated releases and changelogs via GitHub Actions.

PowerShell · Pester · GitHub Actions

Detection-as-Code

SIEM correlation rules managed as YAML with MITRE ATT&CK tagging. Rules are created and modified through GitHub issue forms and automated pull-request workflows.

YAML · MITRE ATT&CK · GitHub Actions

MISP Threat Intelligence Toolkit

Containerized MISP deployment with Python tooling for DDoS incident response, uploading attacker IP indicators to MISP via its API.

Python · Docker Compose · MISP

Windows Forensics & Hardening

PowerShell auditing scripts that locate clipboard and screen-capture artifacts and apply registry-based security controls.

PowerShell · Windows

Education & Certifications

  • Diploma in Object-Oriented Analysis & Design Faculty Training Institute, Cape Town, South Africa (2004)
  • N3 Electronic Engineering Cape Town College, South Africa (1993-1994)

Certifications & courses

  1. 2023

    SIEM Training, Ingest Training, EDR Training

  2. 2022

    SOAR

  3. 2019

    Elasticsearch Engineering I & II, Ansible