Vidhart Bhatia

I like large-scale problems, and services a lot of people would notice if they went down.

I'm at Microsoft Defender now, on the web protection services Windows calls for URL and phishing checks: their infrastructure, the move to Kubernetes, and new services like package vulnerability detection. Before that, six years on the platform behind Xbox services: seven of us owning ingress, CI/CD, telemetry and autoscaling for 116 services across ~45 clusters, and helping launch xCloud, Xbox's cloud gaming platform.

Lately I've been building AI tools for other engineers. The first one out is copilot-brag-sheet.

Experience

Microsoft · Seattle

2020 — present

Microsoft Defender

2026 —

Web protection services behind SmartScreen: the URL reputation and phishing checks nearly every Windows PC calls.

Xbox Platform Services and Cloud Gaming

2020 — 2026

Designed how ingress worked for the shared platform behind 116 Xbox services, and carried the pager for it.
Made KEDA the platform's default autoscaler through one shared Helm chart, so services could scale on queue depth and request rate, not just CPU.
Re-architected fleet logging from fluentd to FluentBit, decoupling it into forwarders and aggregators and cutting each pod's CPU request from 300m to 50m across roughly 880 pods, about 220 cores back.
Built the C# logging library every service used, with PII redaction and enforced data contracts, plus a pub/sub pipeline for the telemetry that needed stronger durability than the fleet default.
Set rate limits per service and per title, so we could raise the limit for a Fortnite event without raising it for everyone. They were one layer of defense in depth at the edge, alongside DDoS protection and WAF with bot management, and together they contained a live L7 attack while the backends stayed stable.
Validated 50,000 requests per second per cluster and 3× title-launch bursts, and onboarded the highest-traffic service at 10× its prior volume.
Wrote the spec to move fleet ingress off ingress-nginx, ahead of its upstream retirement, onto Gateway API and Istio, and ran the cross-team design review. Reversed my own design when the review showed edge mTLS already terminates upstream, which removed the case for sidecar passthrough.
Owned the fleet's Grafana and Prometheus monitoring, and moved all 547 dashboards into a hardened tenant.
Moved 30+ secrets and service connections to managed and federated identity with no downtime.
Cut ~30 of ~94 recurring alerts in one on-call cycle by finally fixing what triggered them.
Earlier: built C#/.NET session-management services for console streaming and shipped Remote Play to GA.

Built

Vids in One Frame
1,748 photographs · 26 collections · Astro, Vercel, Cloudflare R2
My photography site. Every photo links to its nearest visual neighbors, so you can wander the archive without a menu. "Nearest" turned out not to be one thing: Azure Vision pairs two photos because both are warm and grainy, SigLIP because both have street food in them, DINOv2 because both put the subject dead center. Gemini embeddings add a fourth opinion and power text search, and Reciprocal Rank Fusion merges the four rankings. I own the product, the photos and the curation; the implementation was AI-assisted.
copilot-brag-sheet
Published under Microsoft's GitHub · listed in GitHub's awesome-copilot · npm
A Copilot CLI extension plus a typed stdio MCP server that records what a session actually did while it runs. The careful part is persistence: fsync-then-rename writes, PID locks, and recovery of records stranded by dead processes. No telemetry, and nothing leaves the machine by default.

Also: fluxcd/flagger #1241, a small upstream fix so KEDA ScaledObject triggers carry MetricType.

Skills

LanguagesC# / .NET · TypeScript · Python
PlatformKubernetes (AKS) · Terraform · Helm · NGINX · Azure Application Gateway / WAF
Scaling and meshKEDA · Istio · Gateway API (design and early implementation)
ObservabilityGrafana · Prometheus · Azure Monitor · FluentBit
Security and identityPIM and RBAC · Managed and federated identity · DDoS protection · Rate limiting · mTLS
OperationsIncident response and on-call ownership · Alerting design · Capacity planning
AI toolingMCP server design · LLM tool-calling workflows · Embeddings and semantic retrieval

Education

Carnegie Mellon University, B.S. Computer Science. Minors in Game Design and Systems Engineering. Sole undergraduate TA for the graduate Distributed Systems course.