I architect Multi-Cloud infrastructure and the checks that make deployments trustworthy.

Centralized OS patching for a mixed Linux/Windows fleet, with zero inbound access

Claim. Built a mixed Amazon Linux, Ubuntu, and Windows Server EC2 fleet patched entirely through AWS Systems Manager — no server ever reachable over SSH or RDP. Measured before (164 missing patches, 1 of 4 nodes compliant) and after (0 missing, 0 failed, 3 of 4 compliant — the 4th left non-compliant on purpose as a control, to show what happens without follow-up).

Engineering focus. A custom Windows baseline and patch group routing only security/critical updates, a weekly maintenance window with concurrency and error-threshold limits, and three real issues found and fixed: a package-manager lock conflict from a duplicate patch run, a Windows security update missing from Patch Manager's own catalog (fixed via a direct Run Command, not the baseline), and a maintenance window silently pointed at the wrong SSM document, caught by checking the API instead of trusting the console.

VMware ESXi lab: real licensing limits, and monitoring proven by an injected failure

Claim. Built a nested VMware ESXi 8.0U3e environment from scratch, then found — through four separate operations that all returned the identical API error — that the free license blocks VM cloning, OVF deployment, and even reconfiguring an existing VM through the API; Terraform's vsphere provider crashed outright for a related reason. Automated configuration and monitoring with Ansible instead, and didn't stop at "deployed": stopped a monitored service on purpose and measured how long detection actually took.

Engineering focus. Diagnosing a Hyper-V/VT-x conflict that blocked nested virtualization before the VM would even power on, an Ansible playbook that hardens SSH and deploys a Python health-check tool plus a Prometheus/Grafana stack with its datasource and dashboard provisioned as code, and a firewall rule that had been silently blocking all of it until found and fixed.

Azure disaster recovery drill: VM and SQL failover

Claim. Ran two real Azure failover drills between West US and Central US and measured them: an Azure Site Recovery VM failover and an Azure SQL failover group under a live write load. RTO and RPO targets were committed to the repository before each run, and the results are published as measured, including the one target I missed.

Engineering focus. Terraform-built infrastructure, Site Recovery replication and failover, SQL failover groups, timing recovery from the recovered VM's own log, and a cost guardrail set before anything billable existed. Both labs were torn down and checked against Azure afterward.

EKS GitOps service with a measured database recovery drill

Claim. Deployed a service to EKS on Fargate with Argo CD, backed by Aurora, then ran a real recovery drill: the database was killed mid-traffic and restored while recovery time was measured against a target set beforehand. Target RTO was 2 minutes; measured recovery was 39 seconds.

Engineering focus. Terraform and Terragrunt for the VPC and cluster, GitOps delivery with Argo CD, Aurora, and diagnosing real failures along the way, including CoreDNS pods stuck Pending on Fargate and an AWS VPC quota limit that moved the deployment to another region. Everything was torn down and verified at zero cost afterward.

Hybrid Cloud Network Architecture

Claim. Built a Terraform-based network design using Transit Gateway and site-to-site VPN components, then tested rebuildability through destroy and reapply.

Engineering focus. Routing, IPsec connectivity, reusable infrastructure code, and fixing a GitHub Actions OIDC trust-policy error during deployment.

NovaRetail AWS Landing Zone

Claim. Created a single-account AWS foundation with Terraform modules for networking, identity, security controls, centralized logging, and budget visibility.

Engineering focus. Modular infrastructure and guardrails. The multi-account AWS Organizations extension is a future phase, not a completed feature.

AWS Site-to-Site VPN across two regions

Claim. Built a real AWS Site-to-Site VPN — IPsec, a Virtual Private Gateway, a Customer Gateway, static routing — connecting two simulated company networks in two different AWS regions, with no router or ISP cooperation needed since both sides are AWS. Verified with an actual ping and SSH hostname check routed through the gateway and across the tunnel, not just a status light.

Engineering focus. Terraform building both VPCs and the VPN connection end to end, Libreswan configured with the real tunnel address and pre-shared key straight from Terraform’s own outputs, and two real bugs found with tcpdump after the obvious fixes did not work: IP forwarding disabled by default, and a security group that allowed the reply direction but not the forward direction — both produced the identical symptom until isolated.

WCAG accessibility audit lab: 13 planted barriers, real tooling, real findings

Claim. Built a fictional "inherited" WordPress site (Astra, Elementor, Beaver Builder, Contact Form 7) with 13 deliberately planted accessibility barriers, then audited and fixed it against WCAG 2.1 AA and the newer WCAG 2.2 criteria — the same process later used for a real, paid accessibility engagement for a government client that can't be named here.

Engineering focus. Automated and manual auditing with Lighthouse, axe DevTools, WAVE, and a screen reader (NVDA), plus keyboard-only navigation, zoom, and contrast testing, with a before/after findings log and scorecard recorded for every barrier found.

From Disaster Recovery to Hybrid Cloud: My Hands-On Journey in Cloud Infrastructure Engineering

Four projects, each one leading into the next — AWS disaster recovery, Azure Site Recovery and SQL failover, a VMware ESXi lab, and an AWS Site-to-Site VPN across two regions. The piece is less about the resume line each project adds and more about what connected them: the same RTO/RPO discipline, carried from cloud to cloud to on-prem.

Building the AWS Backend for a Volunteer-Matching Platform: Serverless, Terraform, and a Bug That Taught Me Something About Lambda Layers

A serverless backend for a volunteer-matching platform — Lambda, API Gateway, DynamoDB, atomic transactions to stop two volunteers claiming the same slot at once. The real story is the bug: a shared Python module Lambda refused to import, traced back to the layer's ZIP not following the required python/ folder structure. Terraform said the deploy succeeded; the endpoints said otherwise.

How I Reduced Deployment Errors with a GitHub Actions CI/CD Pipeline on AWS EC2

Manual deployment is where human error actually lives — the wrong version tagged, a validation step skipped under time pressure. The pipeline: GitHub Actions runs tests and a Trivy security scan, builds the Docker image, deploys it to an EC2 server Terraform provisioned, then checks a real health endpoint before calling it done. Same release steps, every time, with nothing left to remember.