I build reliable cloud infrastructure, automate delivery, and run production
Kubernetes platforms. Four years of GitLab CI/CD at scale — runner fleets tuned
at the OS level, reusable pipeline templates other teams build on, and security
gates that run on every commit. Hands-on with AWS, EKS, Terraform and Argo CD
GitOps, including production cluster upgrades and multi-account governance.
Commit to production, with the gates that run on the way.
GitDesired state
GitLab CIBuild · test
Security gatesSAST · Gitleaks · Trivy
RegistrySigned images
Argo CDApp-of-Apps sync
EKSIstio canary
ObservabilityPrometheus · Grafana
Rollback is a git revert — the same path in reverse, not a separate runbook.
Services
Four areas I take on for teams: modernising how software ships, reshaping cloud estates that grew organically, making production legible, and getting security and compliance into the pipeline rather than bolted on afterwards.
Engagements usually start with a discovery pass over what actually runs today — the target design is worth more when it addresses real workloads rather than assumptions.
DevSecOps Transformation & Automation
Modernising how software gets from a commit to production — automated, gated, and repeatable, so releases stop being events that need a person watching them.
Reshaping cloud estates that grew organically: a governed account structure, workloads containerised where it pays off, and spend that is attributable to the team that caused it.
Making production legible before an incident forces the issue — metrics, logs and alerting that tell you what changed, not just that something is wrong.
Security that runs on every commit in the shared pipeline stage teams already consume, and compliance evidence that is a by-product of the platform rather than a quarterly scramble.
If it was clicked in a console, it will drift. Terraform modules and Ansible roles with real test coverage, applied through pipelines rather than laptops.
Security by default
Scanning belongs in the shared pipeline stage every team already consumes, not in a checklist someone remembers. It runs on every commit or it does not run.
GitOps
Git is the desired state. Promotion between environments should be a declaration, not a runbook — which also makes rollback a revert.
Reversible rollouts
Canary and progressive delivery exist so production changes have a middle state. An upgrade plan without a rollback plan is not a plan.
Observability before incidents
Dashboards and alerting for pipeline and platform health, so failure trends are visible before someone escalates them.
Self-service over tickets
The platform team should not sit in the path of every deployment. Reusable templates and App-of-Apps let product teams move without waiting.