Vidhart Bhatia
Distributed systems and services engineer at Microsoft, Seattle.
I like the parts of a system nobody sees until they break.
I'm at Microsoft Defender now, moving security services onto Kubernetes. Before that, six years on the platform behind Xbox services: seven of us owning ingress, CI/CD, telemetry and autoscaling for 116 services across ~45 clusters, and helping launch xCloud, Xbox's cloud gaming platform.
Seven of us owned that platform end to end. Earlier I built C#/.NET services for console streaming and shipped Remote Play to GA. Lately I have been building AI tools for other engineers: the first one out is copilot-brag-sheet, an MCP server that turns agent sessions into durable work records.
Experience
Microsoft · Seattle
2020 — present
Microsoft Defender
2026 —
Security services moving onto Kubernetes: malware detection, SmartScreen, endpoint protection.
Xbox Platform Services and Cloud Gaming
2020 — 2026
- Designed how ingress worked for the shared platform behind 116 Xbox services, and carried the pager for it.
- Moved the platform to KEDA-backed autoscaling through one shared Helm chart, so services scaled on real demand instead of static replica counts.
- Re-architected fleet logging from fluentd to FluentBit, decoupling it into forwarders and aggregators and cutting each pod's CPU request from 300m to 50m across roughly 880 pods, about 220 cores back.
- Designed a data-contract system and a pub/sub pipeline for business-critical telemetry with different durability requirements from the rest of the fleet.
- Built defense in depth at the edge: DDoS protection, WAF with bot management, and rate limits set per service and per title, so a Fortnite event could be scaled for without loosening the ceiling on everything else. The same limits contained a live L7 attack and kept the backends stable.
- Designed the Gateway API and Istio migration to modernize routing and ingress topology, and reversed the chosen approach when the design review showed edge mTLS terminates upstream.
- Migrated a 547-dashboard Grafana estate into a hardened tenant.
- Moved 30+ secret key vaults and service connections to managed and federated identity with no downtime.
- Cut ~30 of ~94 recurring alerts in one on-call cycle by finally fixing what triggered them.
- Earlier: built C#/.NET session-management services for console streaming and shipped Remote Play to GA.
Built
- Vids in One Frame
A photography site where every photo leads to its nearest visual neighbour, so you can walk the archive without touching a menu. The hard part is that "nearest" is not one thing: Azure Vision notices two photos are warm and grainy, SigLIP notices they both contain street food, and DINOv2 notices they both put the subject dead centre. Four models, four defensible answers, fused with Reciprocal Rank Fusion.
- copilot-brag-sheet
A Copilot CLI extension and typed stdio MCP server that turns session and tool events into durable work records. Atomic persistence, PID locks, orphan recovery.
Also: fluxcd/flagger #1241, the KEDA ScaledObject API needed to carry MetricType for triggers.
Skills
- LanguagesC# / .NET · TypeScript · Python
- PlatformKubernetes (AKS) · Terraform · Helm · NGINX · Azure Application Gateway / WAF
- Scaling and meshKEDA · Istio · Gateway API, Gateway API and Istio: design and early implementation
- ObservabilityGrafana · Prometheus · Azure Monitor · FluentBit
- Security and identityPIM and RBAC · Managed and federated identity · DDoS protection · Rate limiting · mTLS
- OperationsIncident response and on-call ownership · Alerting design · Capacity planning
- AI toolingMCP server design · LLM tool-calling workflows · Embeddings and semantic retrieval
Education
Carnegie Mellon University, B.S. Computer Science. Minors in Game Design and Systems Engineering.