Mohan Ganesh

I am an Enterprise Security Architect with over two decades of hands-on experience designing and delivering large-scale digital platforms, cloud migrations, and secure identity systems across healthcare, insurance, and enterprise domains. My work bridges cloud-native platform engineering, Generative AI integration, and Zero Trust security architecture.

I specialize in modern application platforms on Google Cloud, backed by Google Cloud Certified Security Engineer and Professional Cloud Architect certifications. My expertise spans architecting enterprise digital portals, conversational AI systems using LLM Models & RAG, keyless cloud authentication (Workload Identity Federation), and Backend-for-Frontend (BFF) Token Handler patterns.

I believe in improving the platforms I use. As an active open-source contributor, I designed and implemented the Firestore Session Service for the Google Agent SDK, which was officially added to the core project to enable stateful session management for enterprise AI agents. In addition, I contribute to the Spring Boot framework (Issue #47944), advocating for granular WebSocket buffer configuration options to enhance production scalability and resilience.

In my professional roles, I have led large-scale cloud migrations, modernized member-facing digital healthcare portals, built enterprise OAuth 2.0 / OIDC identity platforms, and established zero-trust authentication models that remove long-lived cloud credentials.

Professional Focus

Enterprise Architect focused on cloud-native platforms, Identity & Security Engineering (IAM / Zero Trust), and AI-driven systems. Experienced in modernizing enterprise applications on Google Cloud, bridging core technical architecture with business outcomes, and delivering resilient, production-grade platforms.

Open Source Software Contributions

Google Agent Development Kit (ADK) - Secure Firestore Session Service

  • As an active contributor to the Google ecosystem, I designed and implemented the Firestore Session Service extension for the Google Agent SDK, providing secure, isolated session state persistence and history management for enterprise-grade AI agents. Deep technical details can be found in DeepWiki and featured at adk.dev integrations.
  • This contribution enables enterprise developers to manage user conversation state securely, enforcing tenant isolation and session integrity across agentic workflows.
Spring Boot Framework - WebSocket Scalability & Resiliency (Issue #47944)
  • Architectural Analysis: Identified a critical configuration bottleneck in Tomcat’s default WebSocket implementation within Spring Boot, which causes CloseStatus[code=1009] resource exhaustion / Denial-of-Service conditions under high-throughput streaming workloads.
  • Technical Proposal: Authored a technical proposal Issue #47944 including a reproducible test suite to advocate for granular buffer configuration properties to prevent buffer overflow/exhaustion.
  • Community Impact: Acknowledged by the Spring Boot Core Team as a key resilience enhancement for production Java applications globally.

System & Platform Experience

  • Cloud & Enterprise Architecture: Google Cloud Platform (GCP), Cloud Run, App Engine, Microservices, Serverless, Active-Active Multi-Region Migration
  • Identity & Security Engineering: OAuth 2.0, OpenID Connect (OIDC), SAML 2.0, Workload Identity Federation (WIF), Token Handler Pattern (BFF), Zero Trust (IAP), HIPAA Data De-identification
  • Artificial Intelligence & LLMs: Google Agent SDK (ADK), Model Context Protocol (MCP), Retrieval-Augmented Generation (RAG), Conversational AI Agents, Gemini API
  • Digital Platforms & Content Systems: Member Portals, Call Center Modernization (CCoF), Adobe Experience Manager (AEM), Contentful Headless CMS
  • DevOps & Resiliency Engineering: ArgoCD, GitLab CI/CD, Cloud Build, DevSecOps, SRE, DORA Metrics, Splunk, Dynatrace
  • Languages & Frameworks: Java, Spring Boot, Node.js, React, Kubernetes, Kafka, Google Pub/Sub
  • Databases & Analytics: Cloud SQL, Firestore, BigQuery, MongoDB, Oracle
  • Development Productivity: Google Antigravity / Claude Code

Professional Experience

Highmark Health | Pittsburgh, PA

Enterprise Architect | Nov 2023 – Present

  • Token Handler Pattern (BFF-for-SPAs): Architected and implemented an enterprise-grade Token Handler pattern using Spring Boot as a Backend-for-Frontend (BFF). Prevents exposure of sensitive OAuth access tokens to browser environments by utilizing secure, encrypted HTTP-only cookies and short-lived cloud token exchanges via Google Workload Identity Federation (WIF) and CyberArk.
  • Enterprise Identity & Policy Management Tool: Architected an internal policy platform to manage OAuth client registrations, scope authorization policies, and SSO metadata across enterprise IdP integrations (Ping, Microsoft Entra, LDAP, Oracle Access Manager).
  • Zero Trust & Keyless Authentication: Led the enterprise adoption of zero-trust, keyless authentication architecture using Google Workload Identity Federation (WIF) and CyberArk, completely eliminating hardcoded service account key files and significantly mitigating cloud credential compromise risks.
  • Google Agent Development: Led end-to-end delivery of enterprise AI agents using Google Agent SDK (ADK), progressing from proof of concept to production and enabling intelligent automation for Benefit Booklets and Prospect-to-Customer workflows.
  • Call Center Platform Modernization: Spearheaded cloud architecture modernization for enterprise call center systems, unifying customer identity data across GCP integrations for a Customer Center of Fulfillment (CCoF)–aligned, 360-degree customer view.
  • Healthcare Data Security & Privacy: Designed and implemented data security frameworks for sensitive healthcare data, incorporating encryption, automated data de-identification pipelines, and Fine-Grained Access Control (FGAC) for HIPAA compliance.
  • AI-powered Developer Productivity: Evaluated and drove adoption of AI-powered development tools, improving software development efficiency and delivering a 15–20% increase in developer productivity.

CVS Health | Rhode Island, RI

Principal Engineer II/Director | Jan 2022 – Oct 2023

  • Cloud Migration & High Availability: Led cloud migration for CVS Virtual Care and MinuteClinic digital platforms, building multi-region active-active architecture on GCP that reduced latency by 40%.
  • DevSecOps & Security Mentorship: Mentored 15+ engineers on DevSecOps, SRE, secure coding practices, and automated CI/CD pipeline automation.
  • API Resiliency Architecture: Architected API resiliency utilizing Circuit Breakers and federated Apollo GraphQL for microservices, ensuring high availability and fault tolerance.
  • Headless Content Management: Led adoption of Contentful headless CMS to externalize and centrally manage content for Angular applications, replacing hardcoded content and streamlining publishing.
  • DevOps Metrics & Blue/Green Deployments: Introduced DORA metrics and zero-downtime blue/green deployment models, increasing deployment frequency by 50%.

Highmark Health | Pittsburgh, PA

Lead Architect | Oct 2012 – Dec 2021

  • Digital Member Portals Modernization: Modernized digital member portals on GCP (Cloud Run, App Engine, Firebase), enhancing user engagement by 25% via biometric authentication and CDN optimization.
  • Healthcare Mandate & CMS Compliance: Engineered integration solutions for federal healthcare mandates, establishing seamless CMS integration for Medicare enrollments and eligibility checks across 3 states.
  • IoT Client Portals: Redesigned IoT-enabled client portals, enabling decentralized communication for over 1M+ active users.
  • Cloud Cost & Solution Validation: Collaborated with Google Engineering to validate cloud architectures, achieving a 20% cost reduction for enterprise IT operations.
  • Enterprise CMS Integration: Modernized customer and member portals using Adobe Experience Manager (AEM) to streamline cross-channel publishing, reducing content update cycles from weeks to hours.

Key Projects

  • Enterprise Cloud Migration: Multi-region active-active migration of digital health platforms to GCP, reducing latency by 40%.
  • Zero Trust & Keyless Cloud Authentication: Google Workload Identity Federation (WIF) implementation eliminating service account key files for enterprise workloads.
  • AI & Agent SDK Production Deployments: Production stateful AI agents using Google ADK with Firestore Session persistence and RAG workflows.
  • Token Handler Pattern (BFF Architecture): Spring Boot Backend-for-Frontend shielding client SPAs from OAuth token exposure.
  • Sensitive Healthcare Data De-identification: Automated pipelines to de-identify production data for safe usage in lower testing environments.
  • Member Portal Modernization & CMS Compliance: Cloud-native portal redesign and federal CMS compliance integrations.

Education & Certification

  • Google Cloud Certified Security Engineer Certification
  • Google Cloud Certified Professional Cloud Architect Certification
  • Bachelor of Engineering in Electronics and Communication | Mysore University | Karnataka, India

My Github Portfolio

You can explore my open-source projects, code samples, and contributions on my Github portfolio.
Visit: github.com/mohan-ganesh