Architecting cloud infrastructure across AWS and GCP client engagements — building environments from scratch with infrastructure-as-code end to end.

• Cloud cost optimization: Cut monthly infrastructure spend 30% via Cloud Run scale-to-zero for non-production, shared review-app infrastructure replacing per-MR full stacks, and removal of redundant container builds.
• Multi-account AWS with Terragrunt: Built and maintain Terragrunt across five environments with shared baseline modules and per-environment overrides, with terraform-docs in CI keeping module documentation in sync with the HCL source.
• Infrastructure-as-code migrations: Migrated a live four-environment AWS application from CDK to Terragrunt/OpenTofu, importing existing resources rather than recreating them; brought a hand-built serverless production stack (about 50 Lambda functions, API Gateway, RDS, CloudFront, WAF) under Terraform and cut it over to a new, hardened production environment.
• CI/CD speed and reliability: Cut dev merge-request pipelines from 30 minutes to as little as 2 by rebuilding change detection; parallelized jobs with automated smoke tests, static-analysis and database-changelog validation, and build-gated releases to keep broken code out of downstream environments.
• Security scanning gates: Rolled out SAST, dependency, IaC, container, and DAST scanning in GitLab CI, remediated the findings (hardened images, KMS encryption, WAF, security headers), then made SAST, dependency, and IaC scans block merges.
• Developer environments: Built per-merge-request preview environments so reviewers test real infrastructure on every MR, plus fully-local (LocalStack) and hybrid (SAM CLI against deployed dev resources) modes that keep cloud costs off unit-test work.
• Secrets, certificates, and identity: Replaced long-lived CI credentials with GitLab OIDC federation, retiring self-hosted runners; moved vendor API keys and service credentials into AWS Secrets Manager and RDS-managed credentials that rotate automatically; automated GCP certificate renewal with Secret Manager and Pub/Sub, eliminating manual cert-swap downtime; implemented Cognito user pools with MFA and federated identity; owned GCP IAM design across a department engagement.
• Observability: Led the cutover from Datadog to GCP Cloud Monitoring while maintaining SLO coverage; manage CloudWatch alarms and dashboards as code with metric math, retention tiers, and SNS routing to email and Teams; added X-Ray tracing across Node and Python Lambdas.

AWS · GCP · Terraform · Terragrunt · OpenTofu · GitLab CI · LocalStack · AWS SAM · Cognito · KMS · Secrets Manager · ECR · X-Ray · Semgrep · Trivy

• Cloud administration application: Built a self-service app letting clients integrate and map external service data centrally, reducing support call durations by 50%.
• GitHub CI/CD migration: Led migration from Bitbucket and TeamCity to GitHub with branch protection, required code reviews, and automated secret-scanning on all commits.
• Documentation automation: Built an internal PowerShell tool publishing TypeDoc comments into a Gatsby docs site, eliminating manual doc maintenance.
• Client database migration SPA: Partnered with product to architect a single-page app for migrating client databases into cloud applications.

TypeScript · Angular · GitHub Actions · CI/CD · AWS

• CI/CD pipeline architecture: Designed CI/CD pipelines streamlining deployments across multiple teams.
• Infrastructure automation: Built infrastructure-as-code with Puppet Enterprise (Server/Agent) to reduce configuration drift across developer environments.
• Automated server provisioning: Automated server creation with Cloud-Config and VMware vRealize, reducing manual operations interventions by 75%.
• Security scanning pipeline: Established scheduled SAST/DAST scanning with automated vulnerability reporting, preventing vulnerabilities from reaching production.

Puppet · PowerShell · Azure DevOps · VMware vRealize · IIS · MS SQL Server