AAAbhinav Anand

Résumé · updated September 2026

Abhinav Anand

Principal Software Engineer · Identity, Access & Data Platforms · Distributed Java Systems at Scale

Bengaluru, India
linkedin.com/in/cyberaka · cyberaka.com · github.com/cyberaka

Download PDF

Summary of qualifications

  • 22 years in enterprise Java, 12+ of them architecting large-scale, highly available Spring services on Kubernetes across Azure, GCP and AWS; currently technical lead of AccessIntel, Walmart’s centralised authorization platform for HR and people data (15+ business-critical consuming applications, 3 production regions).
  • Identity and access specialist: OIDC-compliant SSO for 4M+ customers across Walmart International; multi-issuer PingFederate OAuth2/OIDC validation, Active Directory/LDAP enrolment, XACML-style policy decision points with OPA/Rego, and a five-layer query-time security model (OAuth2, RBAC, row-, column- and attribute-level security).
  • Architected and shipped Sage (sage.walmart.com), Walmart’s governed agentic-analytics platform, as sole engineer: ~186K lines across Java 21, TypeScript and Python, governing thousands of certified tables for the enterprise; cut dashboard load from 20–30s to 2–3s with a Java 21 re-architecture.
  • Distributed-systems delivery: Kafka access-log and change-data-capture pipelines, Cosmos DB and BigQuery at scale, Istio service mesh, read-through caches with stale-while-revalidate, single-flight and negative caching; sub-minute real-time detection replacing a two-hour batch pipeline.
  • Leads through metrics and architecture: chaired Walmart’s Operational and Engineering Excellence Council (a weekly DORA-style scorecard with SLIs/SLOs across 20+ services), ran the weekly Cloud Cost Council that cut the portfolio’s cloud run rate by 12–20% (roughly $100K a year) through traffic-based right-sizing and environment decommissioning, authored 90+ Architecture Decision Records and whitepapers, and exposed governed data to AI agents through MCP servers (43 tools across two platforms).

Core competencies

  • Identity & Access Management (OAuth2, OIDC, SSO, JWT/JWKS, RBAC/ABAC, XACML PDP/PIP, OPA/Rego; PingFederate, Keycloak, Active Directory/LDAP, Auth0)
  • Distributed Systems & Messaging (Kafka consumer groups, change-data-capture, Cosmos DB change feed, RabbitMQ, idempotent and fail-closed design)
  • Caching & Performance (read-through and stale-while-revalidate caches, in-flight deduplication, connection-pool tuning, Java 21 Virtual Threads)
  • Cloud-Native Engineering (Spring Boot 3, Spring Security, WebFlux, Kubernetes/AKS, Istio, Docker, multi-region deployment; Azure, GCP, AWS)
  • Query-Time Data Governance (SQL AST parsing/rewriting; row-, column- and attribute-level security; certified-table allow-lists)
  • Operational & Engineering Excellence (SLIs, SLOs, golden signals, OpenTelemetry, Grafana, cost optimisation, change governance, ADRs)
  • MCP & Agentic Integration (Spring AI MCP servers, tool-level authorization and audit, LLM gateways, RAG) and AI-augmented development (Claude Code, Copilot)

Professional experience

Walmart Global Tech

Bengaluru, India
Principal Software Engineer — AccessIntel (HR Data Authorization Platform) — Technical LeadJul 2026 – Present
  • Technical lead for the control plane of Walmart’s centralised, XACML-style authorization platform that decides who may see or act on employee data for 15+ business-critical consuming applications across 3 production regions: a Java policy decision point with an OPA/Rego sidecar, a policy information point for subject and organisation attributes, and Kafka plus change-feed ingest keeping Cosmos DB in step with the HR system of record and the BigQuery warehouse.
  • Designed and built the control plane from zero to staging in about five weeks: a Java 21/Spring Boot service, a TypeScript/React portal, and a Spring AI MCP server that observe decision traffic, API usage, consumer catalogue and platform health and own access lists and alerts; 30+ ADRs and a 244-test suite that runs fully offline against a Keycloak realm shaped like PingFederate and a Cosmos emulator. Production rollout in progress.
  • Identity model: multi-issuer PingFederate OAuth2/OIDC bearer validation with per-issuer principal-claim canonicalisation, a stateless Spring Security chain, and default-deny route authorization; Cosmos-backed allow-list as primary authorization with Active Directory nested-group membership as secondary, enrolled once per principal with single-flight lookups, negative caching, and directory outages surfacing as 503 rather than 403.
  • Real-time detection: joined the existing Kafka access-log topic as a second consumer group and made the service the OPA decision-log sink for every sidecar, cutting decision-to-alert latency from a two-hour batch to under a minute, with threshold, rate-versus-baseline and never-seen rules, revision-aware alerts, and a containment runbook that proves a policy rollback landed.
  • Data and performance: BigQuery repositories with keyset pagination and bound parameters; a per-verb read-through cache with stale-while-revalidate semantics and scheduled warming that serves ~97-second cold queries sub-second and keeps working when the warehouse is unreachable; provenance endpoints publishing the exact SQL behind every screen.
  • Agent-operable and private by design: 12 read-only MCP tools with tool-level authorization as a fail-closed AspectJ gate and an audit wrapper recording every call including denials; employee identifiers masked server-side, lookups keyed by event id rather than person.
  • Architecture governance: superseded a proposed self-issued second authorization token with an ADR establishing that authorization travels as audited identity assertions with a joinable audit trail, making revocation latency and delegation semantics explicit decisions rather than token side effects.
Java 21Spring BootOPA/RegoPingFederate OIDCAD/LDAPKafkaCosmos DBBigQueryReactSpring AI MCP
Principal Software Engineer — Sage — People Data Platform (Architect & Sole Engineer)Jun 2025 – Jul 2026
  • Architected and shipped Sage to production at sage.walmart.com on Azure/AKS with BigQuery on GCP — Walmart’s first governed agentic-analytics platform, where AI agents turn natural language into RLS/CLS-secured dashboards. Built as the sole engineer via a specification-first, AI-augmented workflow: first production release in ~5 months, 14 epics and 100+ stories, ~186K lines of code, 60+ ADRs.
  • Designed the polyglot microservices architecture: Java/Spring Boot for authentication, RBAC, the REST gateway (single front door and sole owner of auth) and the MCP server; TypeScript/React 19 for the dashboard frontend; Python/FastAPI for the SQL security firewall.
  • Built the five-layer security model enforced on every query, centred on a Data Firewall that parses each SQL statement into an AST and rewrites it per viewer through an ordered deterministic pipeline: variable resolution, filter-sentinel rewrite, an atomic CTE-aware certified-table allow-list pre-gate (one uncertified reference fails the whole query with 403 — which is what makes agent-authored SQL safe), RLS predicate injection, SELECT * expansion to permitted columns, attribute-conditional masking and CLS.
  • Identity design: a strict two-token model in which the OIDC bearer comes only from the external IdP (PingFederate; Keycloak locally), is validated against IdP JWKS and never minted internally, while a backend context JWT carries authorization context and can never substitute for it; governed “view-as” delegation honoured by the firewall (RLS re-derived) with full audit attribution.
  • Re-architected the Core query engine from Python to Java 21 (Virtual Threads, a refresh-aware three-tier Postgres-backed BigQuery cache with in-flight query deduplication), cutting multi-widget dashboard load from ~20–30s to ~2–3s.
  • Governed-AI surface: an MCP server exposing 31 certified query tools with client allow-listing and multi-provider OIDC validation, so agents run analytics under the same access controls as every other client; a LangGraph natural-language-to-SQL layer built behind a feature flag.
  • Delivered an interactive Dashboard Builder (26 widget types, event-driven pub/sub, cascading variables with topological resolution) and end-to-end production observability (OpenTelemetry golden signals, Grafana alerting, OpenObserve logging, Langfuse LLM tracing with PII masking).
  • Production forensics: root-caused a 100-minute service hang to a HikariCP connection timeout exceeding the Postgres idle-session timeout; fixed production-only HTTP/2 “protocol error” resets by sanitising hop-by-hop headers echoed into Istio/Envoy; resolved OAuth callback state mismatches caused by SameSite=Strict session cookies on cross-site redirects.
  • Over-and-above — ULearn International security remediation: led an unplanned HackerOne bug-bounty + Snyk remediation, closing all 23 in-scope findings (15 Critical, 8 High) across 7 microservices under a 3-week SLA with zero production incidents; re-architected the JWT model (single mint point, server-side RBAC, no client-parameter trust) and built an 882-assertion SQL-injection regression suite retained as a permanent CI gate. Mentored an intern through delivery.
Java 21Spring BootPythonFastAPIReact 19BigQueryMCPLangGraphOpenTelemetry
Principal Software Engineer — International Market Customer Engagement (Accounts, Identity)Feb 2022 – May 2025
  • Led technical initiatives for Identity, Profile and Membership across Walmart International markets (Mexico, Canada, Chile).
  • Architected OIDC-compliant SSO for the Digital Connections Program (Mexico), serving 4M+ customers with an 82% login rate; owned Bill C64 Phase 3 delivery for Walmart Canada, designing the Walmart Compliance Adapter (WCA) and integrating OneTrust for centralised consent management.
  • Chaired the Operational and Engineering Excellence Council for the Profile, Identity and Membership domains: a weekly scorecard across 20+ services tracking cycle time, development cycle time, automated code coverage, Sonar blocker violations, open security vulnerabilities, unplanned-work share, change failure rate, DevOps maturity score, OE score and per-application cloud cost against published targets, with SLOs, SLIs and deployment governance enforced from it; chaired the daily Change Council for UI, orchestration and backend layers.
  • Ran the weekly Cloud Cost Council for the portfolio: custom cost models and dashboards flagged every spend movement, year-over-year traffic reviews right-sized pod counts per service, and idle test and dev environments were decommissioned, cutting the portfolio’s monthly cloud run rate by 12–20% (roughly $100K a year).
  • Authored whitepapers on Java 21 patterns, the Privacy Compliance Adapter and Single Identity architecture.
OIDCOAuth2PingFederateSpring BootKubernetesSLOsCost optimisation

Applied Materials

Bengaluru, India
Principal Solution ArchitectAug 2020 – Feb 2022
  • Led the Software Development Accelerator CoE; built code generators and promoted cloud-native and low-code practices; drove tech-stack standardisation and framework adoption.
Cloud-nativeCode generationLow-codeStandardisation

Cognizant (Client: Apple)

Bengaluru, India
Associate DirectorMay 2016 – Aug 2020
  • Delivered 15+ global projects across customer systems, including the Apple Jobs Portal and contact-centre tools.
Delivery leadershipCustomer systemsContact centre

Custologix Solutions

Bengaluru, India
Solution ArchitectMar 2015 – Apr 2016
  • Developed a full-stack ERP for a retail customer and integrated ESL middleware.
ERPFull-stackESL middleware

X-ISS Inc. (HealthSignz)

Bengaluru, India
Principal Product SpecialistJun 2014 – Mar 2015
  • Architected an HPC monitoring and analytics tool used by global HPC customers.
HPCMonitoringAnalytics

Techworks Technologies Pvt. Ltd.

Kolkata, India
Founder / EntrepreneurNov 2009 – Jun 2014
  • Founded a software-product startup and built Antida, a distributed P2P file-sharing solution.
  • Managed product development and published 50+ mobile apps; developed JavaFX-based POS and embedded Java middleware.
P2PMobile appsJavaFXEmbedded JavaProduct

Adept Software Avenues

Kolkata, India
Senior Software EngineerAug 2006 – Oct 2009
  • Worked on Android, NFC and J2ME projects including Visa Mobile and SIP-client apps.
AndroidNFCJ2MESIP

Elecom Software Pvt. Ltd.

Kolkata, India
System EngineerJan 2004 – Jul 2006
  • Developed SCADA-based HMI software for industrial automation using Java.
SCADAHMIJavaIndustrial automation

Certifications

  • AI Engineering Program, Outskill, 2025 — 6-month intensive: LLMs, RAG, prompt engineering, multimodal AI, AI deployment
  • Cyber Security (Using AI Tools), MSME-PPDC (Govt. of India), 2026
  • Ethical Hacking, MSME-PPDC (Govt. of India), 2025
  • Sun Certified Java Developer, Sun Microsystems, 2002
  • Sun Certified Java Programmer, Sun Microsystems, 2001

Education

  • Master of Business Administration, 2017
  • Bachelor of Computer Applications, 2003

Tech stack

Languages
Java 21, TypeScript, Python, JavaScript, Rego, SQL
Frameworks
Spring Boot 3, Spring Security, Spring AI, WebFlux, Hibernate/JPA, JUnit 5, React 19, FastAPI, LangGraph
Messaging & Data
Apache Kafka, RabbitMQ, Cosmos DB, PostgreSQL (incl. pgvector), BigQuery, MongoDB, Redis, FAISS
Cloud & Platform
Azure (AKS), GCP, AWS, Kubernetes, Istio, Docker, Jenkins, GitHub Actions, Ansible, Cloudflare, SonarQube
Identity & Observability
PingFederate, Keycloak, Active Directory/LDAP, Auth0, Google STS, OneTrust, OpenTelemetry, Grafana, Prometheus, OpenObserve, Langfuse

Recognition

  • Demo Day presentations that helped the pillar win Walmart International’s Best Pillar Engagement Award (Feb 2025); recognised for AI innovation and teamwork at Walmart’s EBS Elevate GenAI Hackathon (Aug 2025).
  • 11 peer-recognition badges at Walmart (2023–2026): Customer Champion, Impact Driver (×2), Innovation (×2), Inspirer (×2), Collaborator (×3) and Fire Fighter — for Bill C64 delivery, SSO, security remediation, and the Sage dashboard integration used in leadership reviews.

Passion projects

  • Sinha Academy — sinhaacademy.com: A learning portal to teach Hindi and English, built with Claude Code.
  • Ajit Kids — ajitkids.com: Language-learning activities for kids (Hindi and English), built for my own family first with Claude Code.
  • QuizWrap — quizwrap.com: Free AI study platform generating quizzes and grounded chat from students’ own notes — ~420 users in 60+ countries with zero paid acquisition. Built with Claude Code; 22 ADRs.
  • Quiz Ajit — qajit.com: Quiz platform for PPL (pilot licence) exam preparation, on the web and mobile — the project that later grew into QuizWrap. Still live at qajit.com.
  • Digger — a 1983 DOS classic, rebuilt — /digger: A playable HTML5 tribute to Digger (Windmill Software, 1983), built in one session with Claude Code — WebAudio chiptune sound, six original levels, and a built-in AI watch mode that plans routes with Dijkstra’s algorithm and narrates what it’s doing.
  • SeekAnswers.in — seekanswers.in: Paid numerology readings plus an LLM chat guide on a credits model — founded by Anindita Sarkar; I am the engineering partner. Java owns identity, money and the deterministic engines; Python/LangGraph owns the AI path via the same public API. 33 ADRs; first prize, Outskill hackathon capstone (Aug 2026).
  • Writing — technical blogging at cyberaka.com.