Drumin Gajjar — AI Security Engineer
Securing enterprise AI.
At full speed.
I lead enterprise AI security for 600 employees at MasterControl — building the gateways, guardrails, governance, and detection systems that let teams adopt AI safely.
Case studies, in depth
The work I would want to be judged on — what the problem was, what it had to live with, and what I would decide differently.
Building an enterprise AI security program from zero
Enterprise AI adoption arrives team by team. I own the program that makes it safe at MasterControl — the gateway, the guardrails, the policy, and the training that makes people actually follow it.
Governed model access today, with identity-aware inspection and policy enforcement rolling out in stages.
Read the case study →Detecting prompt injection, data leakage, and shadow AI
Three threat classes that do not look like anything in a traditional SIEM. Building coverage means deciding what an attack even looks like when the payload is ordinary English.
A threat model and coverage design for three AI threat classes that conventional detection does not see.
Read the case study →Embedding security into the delivery pipeline
Security review that happens after the code is written is advice. Moving the checks into the pipeline — static analysis at the merge, signature verification at the cluster — turns them into constraints.
Findings move to the merge; image integrity is enforced at the cluster boundary rather than audited after it.
Read the case study →Turning cloud findings into work someone owns
A finding in a dashboard is not a finding anyone is accountable for. Three pieces of automation that attribute cloud resources at creation, convert policy violations into tracked tickets, and keep the scanner and the issue tracker telling the same story.
Cloud security signals arrive as assigned work with a deadline, instead of as a dashboard someone has to remember to read.
Read the case study →How I think about AI security
Control points, not rules
A policy people have to remember is not a control. I would rather give each AI surface an inspected path and enforce there than write a rule and hope it is followed.
The safe path has to be the easy one
Security that adds friction gets routed around, and shadow usage is worse than imperfect coverage. The sanctioned path has to be genuinely better than the alternative.
Detection over assurance
A control you cannot observe is a claim. I build the detection and the logging alongside the enforcement, so coverage is something we can measure rather than assert.
Security operations to AI security, at one company
Three years at MasterControl — from a SOC internship to owning the enterprise AI security program.
Field notes on enterprise AI security
I couldn't list my own AI tools
Every AI tool takes two minutes to add and nobody goes back to look at it. Notes from building a local scanner for it, and what went wrong along the way.
Giving a finding a name both systems agree on
Two systems, no shared key, and a job that has to know whether this finding is that ticket — plus the rewrite that took it from fifteen minutes to thirty seconds.
A quiet control and a broken one look the same
What I found reading back through security automation I'd written and inherited — and why "it hasn't alerted" is the least trustworthy sentence in security engineering.