Hemant TiwariSecurity compliance & platform engineer
Hemant
Tiwari
I automate STIG hardening so audits become a rerun, not a scramble.
Seven years of turning controls into code.
I design and automate compliance for VMware Cloud Foundation and open-source platforms.
I work at Broadcom (formerly VMware) with globally distributed teams. Before security I spent nearly three years in DevOps at Wipro, which is why I treat compliance as versioned, testable code.
Selected work
Open-source STIG profiles
Chef InSpec and Ansible content for VCF, Photon and Ubuntu, published in VMware's public DoD repository. See the activity
STIG-hardened container images
GitHub Actions pipelines with Twistlock scans that enforce controls and keep FedRAMP compliance on track.
CIS Benchmark for VCF
Owned the effort end to end: defining controls and coordinating the teams that had to implement them.
Non-FIPS crypto scanner
An internal tool that finds non-FIPS cryptographic modules early and cuts audit preparation effort.
Latest writing
Why I'm Writing About STIGs and Automation: A Beginner's Guide to Security Hardening at Scale
A starting point for anyone new to STIG hardening and how automation makes it repeatable.
