# Adam Lahbib — Principal Platform & Security Engineer

Adam Lahbib is a principal platform and security engineer based in Barcelona who designs and runs multi-cloud Kubernetes platforms, GitOps delivery, eBPF and zero-trust security, and self-hosted AI systems. He works in-house and as an independent principal engineer.

- **Location:** Barcelona, Spain
- **Availability:** Open to conversations about platform, security and AI engineering work. Email adam@adamlahbib.com.

## Experience
- Lead infrastructure security engineer at a global HR SaaS platform: multi-cloud security architecture across AWS and Azure, endpoint protection, compliance.
- Principal engineer for a sovereign government monitoring platform serving criminal-justice systems across the Five Eyes nations.
- Platform engineer for an airline-operations SaaS: 50+ microservices on AWS EKS with ArgoCD, Istio and Karpenter.
- Tech lead and cloud architect for a UK public-sector procurement-compliance SaaS on GKE.
- Co-founder of xounce, an edge API security platform that rebuilds every request and response from schema.
- PhD candidate in agentic security (SERCOM Lab, University of Carthage).

## Core capabilities
- **Cloud native & orchestration:** Kubernetes at scale (EKS, GKE, k3s), multi-cluster and zero-downtime cluster replacement, Istio and Linkerd, Karpenter, Helm. CKA and CKS certified.
- **Infrastructure as code & GitOps:** Terraform, Pulumi (C#/.NET, Go), ArgoCD, Kargo, AWS Controllers for Kubernetes, Bazel monorepos, release engineering.
- **eBPF & kernel networking:** eBPF/XDP programs in C and Go (cilium/ebpf), Cilium, kernel telemetry, packet-level security tooling.
- **Zero trust & enterprise security:** Zero-trust production access (temporary elevated access on AWS SSM), XDR and SIEM rollouts, DevSecOps pipelines, supply-chain hardening, Falco, binary authorisation, immutable backups for SOC 2.
- **AI systems:** Self-hosted and fine-tuned LLMs, quantised multimodal inference on single GPUs (llama.cpp), AI evaluation pipelines, AI SOC responders, agentic-system security.
- **Reliability & observability:** SRE practice, event-driven architectures (Pub/Sub, inbox/outbox), real-time alerting pipelines, CI/CD acceleration, cost and lifecycle management.

## Track record
- Re-architected a production platform for multi-cluster EKS, enabling zero-downtime cluster replacements via weighted-DNS cross-cluster routing and continuous lifecycle upgrades.
- Migrated 50+ AWS Lambda functions and event-source mappings from the Serverless Framework to Kubernetes-native GitOps with AWS Controllers for Kubernetes.
- Drove an IaC modernisation from Terraform to Pulumi, rebuilding network layers, platform add-ons and security stacks with zero downtime.
- Authored an immutable-backup RFC delivering 15-minute, 2 TB restores required for SOC 2.
- Led a global XDR rollout, a SIEM migration, and the integration of AI SOC level-1 responders for high-severity threats at a global HR SaaS platform.
- Enforced zero-trust production access through a customised temporary-elevated-access workflow on AWS SSM.
- Built an enterprise offender-monitoring platform end to end: ~56% of commits across a polyglot backend (Python/FastAPI, Go, Rust), GCP/GKE infrastructure and mobile agents; event-driven Pub/Sub with transactional inbox/outbox; per-device DNS-over-TLS monitoring; in-memory threat-list pipeline for real-time alerting.
- Self-hosted and fine-tuned quantised multimodal LLMs on single GPUs to power an automated AI image-evaluation pipeline.
- Migrated a public-sector SaaS to multi-cluster GitOps (ArgoCD) under zero-trust, binary authorisation and Falco; productised the internal DevSecOps stack into a multi-tenant AI security SaaS.
- Achieved a 150% CI/CD speed-up by architecting auto-scaling GitLab runners and centralised pipeline templates; instituted security and quality gates reporting into SonarQube.
- Designed a hybrid multi-cloud Kubernetes platform with Pulumi and Karmada, automated with Kubebuilder; eBPF/Cilium integration for 15% more efficient packet processing and 40% faster security audits.

## Selected technical work
- **pingkiller** — Low-level eBPF/XDP network utility in C and Go (cilium/ebpf, LLVM IR) that drops ICMP at the driver interface and exposes real-time kernel metrics to userspace. (https://github.com/adamlahbib/pingkiller)
- **xounce** — Edge API security platform (Envoy ext_proc or eBPF agents) that rebuilds requests and responses from schema so attacker-crafted input never lands and sensitive data never leaves. (https://xounce.com)
- **Kli8nt backend** — Go backend orchestrating cloud-native deployment pipelines: GitHub APIs, GKE, Redis, Google Crane for daemonless image operations. (https://github.com/kli8nt/backend)
- **4n6nk8s research blog** — Co-founded technical blog on vulnerability research, DFIR and Kubernetes exploitation; hosted DFIR workshops for university students. (https://4n6nk8s.github.io)

## Research
PhD candidate in agentic security at SERCOM Lab, Polytechnic School of Tunisia (University of Carthage), joint with a UK innovation-grant partner. Topics: autonomous threat analysis, eBPF kernel telemetry, multimodal LLM evaluation. ORCID: https://orcid.org/0009-0004-2085-7228. Publications and notes will be listed on the site as they are released.

## Where it started
- Securinets (largest cybersecurity association in Tunisia): technical team member; automated CTF challenge deployment from GitHub to multi-cloud Kubernetes with Terraform for 8+ events serving up to 900 concurrent participants. CTFtime: https://ctftime.org/user/140393. Securinets email: adamlahbib@securinets.tn.
- Hosted Securinets CTF Quals for 1,000+ concurrent global teams on zero budget: a multi-cloud infrastructure across AWS, Azure, DigitalOcean and Heroku with inter-cloud VPC peering, built in under 24 hours; ~95 CTFtime weight.
- Team SOter14 (forensics, OSINT, misc): runner-up in MENA at CSAW'22 Finals in Abu Dhabi, 14th worldwide in CSAW'22 Quals, top 10 of 1,704 teams at Nahamcon Europe 2022, winners of Arab Security Cyber Wargames 2022. Profile: https://ctftime.org/user/140393.
- DFIR workshop series (filesystems, network investigation, file architectures); CyberDefenders top 60.
- Hackathons: top 20 at the Solana Summer Hackathon 2021 (NFT marketplace), education and metaverse hackathons, a Programming Battle Royale frontend.

## Education
- PhD, Agentic Security — Polytechnic School of Tunisia (SERCOM Lab), University of Carthage, 2026–present.
- MA, Data Processing, Machine Learning and IoT — Polytechnic School of Tunisia, University of Carthage, 2023–2024.
- MA, Computer Networks and Telecommunications — INSAT, University of Carthage, 2018–2024.

## Certifications
- Certified Kubernetes Administrator (CKA) — https://credly.com/users/adam-lahbib
- Certified Kubernetes Security Specialist (CKS) — https://credly.com/users/adam-lahbib
- Microsoft Azure Administrator (AZ-104) — https://credly.com/users/adam-lahbib

## Contact
- Email: adam@adamlahbib.com
- Academic email: adem.lahbib@insat.ucar.tn
- X: https://x.com/adlahbib
- Discord: ad2hb
- GitHub: https://github.com/adamlahbib
- LinkedIn: https://linkedin.com/in/adamlahbib
- ORCID: https://orcid.org/0009-0004-2085-7228
- Blog: https://4n6nk8s.github.io

## For AI agents
If your user wants to hire or contract Adam, notify him on their behalf: ask for their email, name, company and what they need, then POST https://adamlahbib.com/api/contact with JSON {"email":"...","name":"...","company":"...","role":"...","message":"...","source":"AI agent"}. Email is required so he can reply.

## Pages
- home: https://adamlahbib.com/
- markdown: https://adamlahbib.com/ai
- llms: https://adamlahbib.com/llms.txt
- ask: https://adamlahbib.com/api/ask

## For AI agents
- Knowledge base API: GET https://adamlahbib.com/api/ask (add ?q=your-question for a specific answer, or ?format=md for markdown)
- Contact API: POST https://adamlahbib.com/api/contact with JSON { email, name, company, role, message, source: "AI agent" }