Amir Bredy · Technical Program Manager, Edge Security

Selected work

4M+

machines, month over month

Security configuration and compliance at fleet scale

Context: A security baseline only matters if it holds on every machine, in cloud and hybrid environments alike.
What I did: Own the security configuration and compliance platform for Windows and Linux machines, end to end, from requirements through phased rollout.
Outcome: 4M+ machines managed month over month.

critical issues caught per feature

A release gate teams plan against

Context: Security defects found after release are the expensive kind, and Azure Local, Microsoft's on-premises cloud platform, ships security features across many teams.
What I did: Own the final quality and bug bash gate that Azure Local security features clear before release. Defined the entry criteria, owners and triage cadence that teams now plan against.
Outcome: About 3 critical issues caught per feature before launch, cutting defect escapes.

20%

smaller incident ticket queue

ConfigForge

Context: Customers hit a feature gap in authoring security baselines, and it was feeding the team's incident ticket queue.
What I did: Built, shipped and maintain a cross-platform desktop app for authoring security baselines on Windows and Linux, open-sourced under the Azure org. Marquee customers in oil and gas, shipping and consulting get it packaged directly from me.
Outcome: Closed the gap and cut the team's incident ticket queue by 20%.

github.com/Azure/ConfigForge

Gen2

VMs with vTPM and Secure Boot

Trusted launch for air-gapped clouds

Context: Regulated and air-gapped cloud environments need every dependency mapped and ready before a platform feature can land.
What I did: Owned cross-org delivery of Gen2 VM trusted launch into those environments, coordinating engineering, security and compliance, and operations from requirements and dependency mapping through integration readiness.
Outcome: Shipped, including SQL Server support on it.

Also on my plate

Own data suite security for Azure Local, setting platform security requirements for confidential data.
Co-lead definition of the edge AI agent security strategy, owning the tool call permission model, network egress control, and the identity an agent carries on Entra ID.
Led 8+ Executive Briefing Center sessions, making the security case to CEOs, COOs and CISOs at marquee enterprise customers.

Writing

Short notes on attestation, confidential computing, and securing systems that ship.

Apr 28, 2026

NPU attestation: what are we even measuring?

Boot attestation tells you the kernel is genuine. NPU attestation should tell you the model is too — and most current designs don't.

All writing →

Open source

Security baselinesConfigForge Author, compare, audit and apply security baselines on test devices. Built at Microsoft, open-sourced under the Azure org.TypeScript · Electron Supply chain securitybomdrift Diffs the SBOM on every pull request and flags new CVEs, typosquats, multi-major version jumps and young maintainers.Rust · GitHub Action Security toolingSecureScan Security scanning without the SaaS tax. Orchestrates code, dependency, IaC and DAST scanners with baseline diffing.Python

Background

2024 to now

Microsoft

Technical Program Manager II, Edge Security / Specialized Clouds

Promoted from TPM I, March 2026

2023

Microsoft

Product Management Intern, Azure Enterprise and OS Security

2022

Oaktree Capital Management

Product Management Intern

2021

The Office of Barack and Michelle Obama

Technology Intern

Education

Howard University

B.S. Computer Science, 2024

Confidential computing (AMD SEV-SNP, Intel TDX)Attestation and hardware root of trustSecure Boot and trusted launchSecurity baselines and complianceRelease and readiness gatesZero Trust

Full resume (PDF) →

Contact

Email is the best way to reach me. I'm also on LinkedIn.

amir@bredy.dev