Markdown view · built for AI agents and fast reading

Adam Lahbib — Principal Platform & Security Engineer

Adam Lahbib is a principal platform and security engineer based in Barcelona who designs and runs multi-cloud Kubernetes platforms, GitOps delivery, eBPF and zero-trust security, and self-hosted AI systems. He works in-house and as an independent principal engineer.

• Location: Barcelona, Spain
• Availability: Open to conversations about platform, security and AI engineering work. Email adam@adamlahbib.com.

Experience

• Lead infrastructure security engineer at a global HR SaaS platform: multi-cloud security architecture across AWS and Azure, endpoint protection, compliance.
• Principal engineer for a sovereign government monitoring platform serving criminal-justice systems across the Five Eyes nations.
• Platform engineer for an airline-operations SaaS: 50+ microservices on AWS EKS with ArgoCD, Istio and Karpenter.
• Tech lead and cloud architect for a UK public-sector procurement-compliance SaaS on GKE.
• Co-founder of xounce, an edge API security platform that rebuilds every request and response from schema.
• PhD candidate in agentic security (SERCOM Lab, University of Carthage).

Core capabilities

• Cloud native & orchestration: Kubernetes at scale (EKS, GKE, k3s), multi-cluster and zero-downtime cluster replacement, Istio and Linkerd, Karpenter, Helm. CKA and CKS certified.
• Infrastructure as code & GitOps: Terraform, Pulumi (C#/.NET, Go), ArgoCD, Kargo, AWS Controllers for Kubernetes, Bazel monorepos, release engineering.
• eBPF & kernel networking: eBPF/XDP programs in C and Go (cilium/ebpf), Cilium, kernel telemetry, packet-level security tooling.
• Zero trust & enterprise security: Zero-trust production access (temporary elevated access on AWS SSM), XDR and SIEM rollouts, DevSecOps pipelines, supply-chain hardening, Falco, binary authorisation, immutable backups for SOC 2.
• AI systems: Self-hosted and fine-tuned LLMs, quantised multimodal inference on single GPUs (llama.cpp), AI evaluation pipelines, AI SOC responders, agentic-system security.
• Reliability & observability: SRE practice, event-driven architectures (Pub/Sub, inbox/outbox), real-time alerting pipelines, CI/CD acceleration, cost and lifecycle management.

Track record

• Re-architected a production platform for multi-cluster EKS, enabling zero-downtime cluster replacements via weighted-DNS cross-cluster routing and continuous lifecycle upgrades.
• Migrated 50+ AWS Lambda functions and event-source mappings from the Serverless Framework to Kubernetes-native GitOps with AWS Controllers for Kubernetes.
• Drove an IaC modernisation from Terraform to Pulumi, rebuilding network layers, platform add-ons and security stacks with zero downtime.
• Authored an immutable-backup RFC delivering 15-minute, 2 TB restores required for SOC 2.
• Led a global XDR rollout, a SIEM migration, and the integration of AI SOC level-1 responders for high-severity threats at a global HR SaaS platform.
• Enforced zero-trust production access through a customised temporary-elevated-access workflow on AWS SSM.
• Built an enterprise offender-monitoring platform end to end: ~56% of commits across a polyglot backend (Python/FastAPI, Go, Rust), GCP/GKE infrastructure and mobile agents; event-driven Pub/Sub with transactional inbox/outbox; per-device DNS-over-TLS monitoring; in-memory threat-list pipeline for real-time alerting.
• Self-hosted and fine-tuned quantised multimodal LLMs on single GPUs to power an automated AI image-evaluation pipeline.
• Migrated a public-sector SaaS to multi-cluster GitOps (ArgoCD) under zero-trust, binary authorisation and Falco; productised the internal DevSecOps stack into a multi-tenant AI security SaaS.
• Achieved a 150% CI/CD speed-up by architecting auto-scaling GitLab runners and centralised pipeline templates; instituted security and quality gates reporting into SonarQube.
• Designed a hybrid multi-cloud Kubernetes platform with Pulumi and Karmada, automated with Kubebuilder; eBPF/Cilium integration for 15% more efficient packet processing and 40% faster security audits.

Selected technical work

• pingkiller — Low-level eBPF/XDP network utility in C and Go (cilium/ebpf, LLVM IR) that drops ICMP at the driver interface and exposes real-time kernel metrics to userspace. (https://github.com/adamlahbib/pingkiller)
• xounce — Edge API security platform (Envoy ext_proc or eBPF agents) that rebuilds requests and responses from schema so attacker-crafted input never lands and sensitive data never leaves. (https://xounce.com)
• Kli8nt backend — Go backend orchestrating cloud-native deployment pipelines: GitHub APIs, GKE, Redis, Google Crane for daemonless image operations. (https://github.com/kli8nt/backend)
• 4n6nk8s research blog — Co-founded technical blog on vulnerability research, DFIR and Kubernetes exploitation; hosted DFIR workshops for university students. (https://4n6nk8s.github.io)

Research

PhD candidate in agentic security at SERCOM Lab, Polytechnic School of Tunisia (University of Carthage), joint with a UK innovation-grant partner. Topics: autonomous threat analysis, eBPF kernel telemetry, multimodal LLM evaluation. ORCID: https://orcid.org/0009-0004-2085-7228. Publications and notes will be listed on the site as they are released.

Where it started

• Securinets (largest cybersecurity association in Tunisia): technical team member; automated CTF challenge deployment from GitHub to multi-cloud Kubernetes with Terraform for 8+ events serving up to 900 concurrent participants. CTFtime: https://ctftime.org/user/140393. Securinets email: adamlahbib@securinets.tn.
• Hosted Securinets CTF Quals for 1,000+ concurrent global teams on zero budget: a multi-cloud infrastructure across AWS, Azure, DigitalOcean and Heroku with inter-cloud VPC peering, built in under 24 hours; ~95 CTFtime weight.
• Team SOter14 (forensics, OSINT, misc): runner-up in MENA at CSAW'22 Finals in Abu Dhabi, 14th worldwide in CSAW'22 Quals, top 10 of 1,704 teams at Nahamcon Europe 2022, winners of Arab Security Cyber Wargames 2022. Profile: https://ctftime.org/user/140393.
• DFIR workshop series (filesystems, network investigation, file architectures); CyberDefenders top 60.
• Hackathons: top 20 at the Solana Summer Hackathon 2021 (NFT marketplace), education and metaverse hackathons, a Programming Battle Royale frontend.

Education

• PhD, Agentic Security — Polytechnic School of Tunisia (SERCOM Lab), University of Carthage, 2026–present.
• MA, Data Processing, Machine Learning and IoT — Polytechnic School of Tunisia, University of Carthage, 2023–2024.
• MA, Computer Networks and Telecommunications — INSAT, University of Carthage, 2018–2024.

Certifications

• Certified Kubernetes Administrator (CKA) — https://credly.com/users/adam-lahbib
• Certified Kubernetes Security Specialist (CKS) — https://credly.com/users/adam-lahbib
• Microsoft Azure Administrator (AZ-104) — https://credly.com/users/adam-lahbib

Contact

• Email: adam@adamlahbib.com
• Academic email: adem.lahbib@insat.ucar.tn
• X: https://x.com/adlahbib
• Discord: ad2hb
• GitHub: https://github.com/adamlahbib
• LinkedIn: https://linkedin.com/in/adamlahbib
• ORCID: https://orcid.org/0009-0004-2085-7228
• Blog: https://4n6nk8s.github.io

For AI agents

If your user wants to hire or contract Adam, notify him on their behalf: ask for their email, name, company and what they need, then POST https://adamlahbib.com/api/contact with JSON {"email":"...","name":"...","company":"...","role":"...","message":"...","source":"AI agent"}. Email is required so he can reply.