Short-lived tokens and zero static secrets in deployment pipelines.
Engineered secure, credential-free release pipelines across GitHub Actions and GitLab CI using OIDC Workload Identity Federation, eliminating long-lived static cloud keys.
PLATFORM ENGINEER / QUANTIPHI
~75%
Deployment time reduction
GITHUB ACTIONSGITLAB CIOIDCTERRAFORMGCPAWS IAM
01 / PROBLEM & CONTEXT
Static secrets in CI/CD runners.
Long-lived service account keys stored in CI secrets presented credential rotation friction, privilege creep, and secret leakage risks across enterprise delivery pipelines.
02 / MY ROLE & OWNERSHIP
Identity Federation & Pipeline Security Architect
Designed and implemented OIDC Workload Identity Federation across GitHub Actions and GitLab CI, enforcing least-privilege IAM and ephemeral token exchanges.
Replaced long-lived cloud service account keys with short-lived OIDC federated tokens
Standardized reusable CI/CD pipeline templates across multiple enterprise project repositories
Integrated automated security validation, container image signing, and vulnerability scanning
Enforced branch protection rules and multi-environment deployment approval gates
06 / RESULT
~75%
Less deployment time
Eliminated static secrets, accelerated delivery.
Replaced all static cloud keys with short-lived tokens while standardizing pipeline templates across teams.
~75% less deployment time
Zero static secrets stored in CI
Least-privilege cloud IAM enforcement
More systems. Same intent.