Completed work, in depth.
Hands-on cloud infrastructure, DevSecOps, and security engineering across AWS automation, container delivery, Kubernetes/GitOps, cloud identity, and Zero Trust. Projects are developed in controlled AWS and local lab environments, with working code, tests, security controls, evidence, and documented tradeoffs where applicable.
Private AWS Web Infrastructure
A private multi-AZ AWS web platform designed around infrastructure automation, restricted administrative access, identity separation, and evidence-backed security controls.
- Provisioned a two-AZ VPC with public and private subnets, internet gateway, NAT gateway, public Application Load Balancer, and private EC2 instances.
- Used Terraform to manage networking, compute, IAM, security groups, S3 transfer infrastructure, VPC endpoints, VPC Flow Logs, and CloudWatch integration.
- Replaced inbound SSH and public instance IPs with AWS Systems Manager; Ansible uses dynamic EC2 inventory and SSM-based administration.
- Separated Terraform execution, Ansible execution, EC2 workload, and Flow Logs identities with scoped IAM permissions.
- Validated configuration idempotency and reviewed Checkov findings, security tradeoffs, and accepted lab risks.
Secure ECS/Fargate CI/CD Platform
A secure container delivery platform that combines infrastructure as code, automated security gates, immutable artifacts, temporary AWS credentials, deployment validation, and runtime scaling.
- Provisioned private ECS Fargate workloads across two Availability Zones behind an Application Load Balancer using Terraform.
- Built Jenkins CI/CD using EC2 instance-profile credentials rather than static AWS access keys.
- Integrated Checkov and blocking Trivy HIGH/CRITICAL image scanning; an initial scan found 11 HIGH and 1 CRITICAL vulnerabilities, all remediated before deployment.
- Published immutable container images to Amazon ECR and validated ECS service stability and live application behavior after deployment.
- Added a GitHub Actions deployment path using OIDC federation to AWS STS and validated target-tracking autoscaling under controlled load.
Secure EKS GitOps Platform
An EKS/Kubernetes delivery platform combining infrastructure automation, CI security, Kubernetes scaling, observability, and GitOps reconciliation.
- Provisioned Amazon EKS and supporting AWS infrastructure with Terraform, including private worker nodes and IAM boundaries.
- Delivered container workloads with Jenkins, Helm, and Kubernetes while integrating Checkov and Trivy security validation.
- Implemented Metrics Server, Horizontal Pod Autoscaling, and Cluster Autoscaler; validated application scale-out to three replicas and managed-node-group expansion to four nodes under controlled load.
- Built a GitOps delivery path where GitHub Actions uses OIDC federation, updates Helm desired state in Git, and Argo CD reconciles the cluster.
- Added Prometheus and Grafana for platform observability and documented scaling, deployment, and security evidence.
AWS NHI Governance Engine
A non-human identity governance engine that scans an AWS account and scores the identities people forget — IAM roles, users, access keys, secrets, and trust policies — mapping every finding to the OWASP NHI Top 10 and NIST 800-53, and gating CI on unaccepted high-severity risk.
- Eleven detectors: ownership, over-privilege (managed-policy admin and unused permissions via Access Advisor), trust-policy exposure (wildcard, cross-account without ExternalId, OIDC aud/sub gaps), and credential model
- Runs in CI via GitHub OIDC federation with no stored credentials, on a least-privilege read-only role
- Exception register with time-boxed risk acceptance and net-residual-risk reporting — open risk separated from signed-off risk
- JSON and Markdown audit reports rendered in the CI run summary; documented threat model for the scanner itself
- Packaged as a tested Python library; the gate fails the build on open HIGH or CRITICAL findings
Zero Trust Serverless Architecture on AWS
A zero-trust serverless API built with AWS CDK, Cognito, API Gateway, Lambda, DynamoDB, and KMS. Enforces JWT authentication, route-scoped IAM permissions, principal-bound data access, encryption, observability, and negative authorization testing.
- Cognito JWT authentication with API Gateway HTTP API — unauthenticated requests are rejected before application access.
- Route-scoped Lambda execution roles constrain each function to the AWS permissions required for its specific operation.
- Principal-bound DynamoDB access uses the validated JWT subject to prevent horizontal data access and BOLA/IDOR-style authorization failures.
- DynamoDB uses customer-managed KMS encryption and point-in-time recovery, with structured CloudWatch logging and X-Ray tracing.
- Negative authorization tests validate unauthenticated and spoofed-access scenarios; infrastructure is defined as modular AWS CDK Python stacks.
Enterprise IAM Lifecycle Automation
An end-to-end Identity Governance and Administration build: HR-sourced joiner, mover, and leaver lifecycle on midPoint and 389 Directory Server, with reconciliation, non-human identity disposition, and a Python evidence validator that proves the directory matches the source of truth.
- HR-driven joiner, mover, and leaver provisioning and deprovisioning into 389 Directory Server via midPoint
- Reconciliation that surfaces out-of-band changes and orphaned accounts, with disablement before deletion
- Unmatched service-account (non-human identity) disposition: link to owner, remove, or document as a time-bound exception
- Python evidence validator comparing the HR source against the directory, emitting control-mapped JSON findings
- Three-way identity correlation and SOC 2 CC6 access-control mapping for audit-style evidence
AWS Continuous Compliance Automation Framework
An engineering-driven approach to Governance, Risk, and Compliance on AWS. This framework interrogates AWS APIs directly — producing structured evidence, risk-scored findings, and audit-style reporting across six major compliance frameworks simultaneously.
- 16 automated controls across IAM, S3, CloudTrail, GuardDuty, and Security Hub
- Risk scoring engine with compliance percentage, severity grouping, and prioritized remediation
- IAM Governance module — stale users, unused keys, leaver validation with three-way identity correlation
- Immutable evidence vault using S3 Object Lock — tamper-proof audit artifacts
- A single automated check can produce evidence mapped to relevant controls across CIS, NIST 800-53, SOC 2, ISO 27001, and PCI DSS
AWS Policy-as-Code Guardrails
Preventive guardrails that evaluate a Terraform plan before apply and fail the build when a change would violate a security control. The shift-left counterpart to the NHI engine: the engine detects risky identities that already exist, these guardrails stop a class of misconfigurations from ever deploying.
- OPA Rego policies executed with Conftest against
terraform show -jsonplan output - Denies public S3, security groups open to 0.0.0.0/0 or ::/0, wildcard IAM, unencrypted storage, and missing Owner tags
- Every policy mapped to NIST 800-53 (SC-7, AC-6(10), SC-28, CM-8)
- Unit-tested with
opa testand enforced as a GitHub Actions CI gate that blocks violating plans
Real-Time IAM Cross-Account Detection Pipeline
An event-driven detection pipeline that surfaces high-signal IAM anomalies in near real-time. Built with a QA engineer's approach to signal quality — systematic false positive tuning distinguishes legitimate activity from genuine risk.
- CloudTrail → EventBridge → Lambda enrichment → SNS alert pipeline
- Targets unauthorized AssumeRole activity, misconfigured trust policies, and cross-account anomalies
- False-positive tuning for CI/CD roles, Lambda execution, and developer sessions
- Structured JSON findings with context, severity, and embedded remediation guidance
Secure Multi-Account AWS Architecture for Retail Platforms
A security-first AWS reference architecture for retail workloads — demonstrating architect-level thinking across trust boundary separation, multi-account org design, and layered security controls. Grounded in real retail business context: customer identity, order workflows, payment-adjacent services, and prod/non-prod isolation.
- Multi-account AWS Organizations model with dedicated management, security/log archive, shared services, production, and non-production accounts
- Layered ingress: Route 53 → CloudFront → WAF → ALB → private subnets — reducing attack surface at every boundary
- Threat model documenting retail platform threats, trust boundaries, business impact, and mitigations per attack vector
- Security controls mapped across preventive, detective, responsive, and governance categories — the full control lifecycle
- Architecture Decision Records explaining why each major design choice was made — not just what was built