I design, build, and automate AWS cloud infrastructure — Terraform, CI/CD pipelines, event-driven automation, and security tooling — bringing a security-first, automation-driven approach to complex infrastructure problems.
A cloud-native version of secure facility-to-facility tunneling I've done professionally — a multi-VPC network joined through a Transit Gateway hub with a real Site-to-Site IPsec VPN. Getting from a clean deploy to working traffic took fixing 9 real bugs, including two byte-identical IAM trust policies behaving differently — diagnosed via CloudTrail's raw denial event. Verified end-to-end: 0% packet loss on the first attempt after a full destroy/reapply.
View Project →A fully serverless link shortener that costs $0 at rest — nothing runs between requests. The obvious approach (check if a code exists, then write it) has a race condition under concurrent requests; solved it with DynamoDB's atomic conditional write instead, plus a Lambda IAM role scoped to exactly three actions on one table.
View Project →A 6-stage GitHub Actions pipeline (lint → test → Semgrep SAST → Trivy container scan → ECR → EKS) that enforces a hard quality gate: critical vulnerabilities block the deploy instead of reaching production. Shifts security left so scanning happens before a bad image ever reaches Kubernetes, not after.
View Project →A Python CLI covering 12 security checks across IAM, S3, EC2, CloudTrail, and RDS — built to understand how tools like Prowler work internally, not to replace them. Every check is tested against mocked AWS calls (31 tests, no real account needed), yet pointed at my own real AWS account it found genuine problems on the first run: security groups with SSH/RDP open to the internet, no active multi-region CloudTrail trail, and a 415-day-old access key.
View Project →Used Claude Code as an AI engineering assistant to accelerate solution design, implementation, debugging, documentation, and infrastructure troubleshooting across multiple AWS projects — validating all generated code before deployment.
View Project →NovaRetail's developers were manually provisioning AWS resources — inconsistent networking, weak governance, public-exposure risk, no audit visibility. Built a Terraform Landing Zone (3-tier VPC, centralized CloudTrail logging, GuardDuty, Security Hub, KMS-encrypted logs, least-privilege audit role) plus Python audit scripts for security groups, S3, and cost — reducing environment setup from hours to minutes while standardizing security controls.
View Project →Extends my Security Baseline Audit tool from on-demand scanning into continuous enforcement: EventBridge catches risky changes (open security groups, public S3 buckets) in real time and Lambda remediates them automatically. First deploy looked correct but silently did nothing — CloudTrail's always-on Event History doesn't feed EventBridge, only an actual Trail resource does. Verified both directions: in-scope resources get auto-remediated, and IAM denies remediation on anything out of scope, confirmed by testing an untagged security group and finding the open rule still there.
View Project →I'm a Cloud Infrastructure Engineer with 3 years of professional IT/systems administration experience, including hands-on project work designing, building, and automating AWS cloud infrastructure. I'm AWS Certified Solutions Architect – Associate and Microsoft Certified Azure Administrator, with a B.S. in Cloud Computing.
I work with Terraform, Python, GitHub Actions, Docker, Kubernetes, and IAM to build reproducible AWS infrastructure, CI/CD pipelines, event-driven automation, and security tooling — applying systematic root-cause analysis to complex infrastructure issues. I'm also the founder of CloudCapeCoast and an AWS Community Builder for Networking & Content Delivery.
Get in touch →Have an infrastructure challenge, an open role, or want to collaborate? I'd love to hear from you.