Cloud Security Engineer · Identity & Access · AWS & Azure
Cloud security engineer with 10+ years building and governing AWS and Azure platforms in regulated banking, finance and healthcare. I specialize in identity and access — workload and machine identity, least privilege at scale, and policy-as-code guardrails that produce their own audit evidence.
7 case studies · internal details withheld
Real production work, described at the level I can share publicly: no internal names or code.
01 · Case study · production
Before
No reliable inventory of what still referenced legacy roles, so the IAM upgrade had stalled.
What I built
Replaced legacy SAML SSO across 30+ AWS accounts. Built discovery tooling that scans a dozen resource surfaces and 100+ repositories for legacy role references, and a Terraform module defining permission sets for every engineering role, with Okta SCIM and separately managed break-glass access.
02 · Case study · production
Before
Compliance depended on whoever reviewed the merge request.
What I built
Took production infrastructure changes from ungated to 100% gated: every Terraform apply across 200+ workspaces requires a ServiceNow change record and a clean Wiz scan, backed by a HashiCorp Sentinel policy library enforcing encryption, TLS and tagging standards.
03 · Case study · production
Before
Standing administrative role assignments.
What I built
Tenant identity managed entirely in Terraform — management groups, custom RBAC roles, 30+ service principals — with just-in-time admin access through Entra ID PIM and OIDC workload identity federation, so pipelines store no cloud credentials.
04 · Case study · production
Before
Account onboarding was manual and error-prone.
What I built
SCP service allow-list (60+ approved services, all others denied), 50+ Control Tower controls as code, and GuardDuty, Security Hub and Config enabled for every new account, with findings forwarded to Microsoft Sentinel.
05 · Case study · production
Before
Without admission controls, a cluster runs any workload it's given, including privileged pods and images no one has scanned.
What I built
Enforced Kubernetes guardrails at admission and in the pipeline: Kyverno admission policies that block privileged pods, RBAC and namespace isolation, and Trivy and Aqua image scanning built into CI/CD, so insecure workloads are rejected before they run.
06 · Case study · production
Before
An outage between a cloud application and on-premises systems had resisted triage for days, because firewall policy reported the traffic as allowed.
What I built
Traced it to a Transit Gateway attachment in a Deleted state, restored the route table associations, propagations and return routes, and turned the diagnostic order into a repeatable drill for the team.
07 · Case study · production · 2018–2023
Before
Deployments took twice as long as they needed to, and environments weren't yet defined consistently in code.
What I built
Built Kubernetes clusters from scratch with Terraform across dev, staging and production (Helm deployments, autoscaling, ingress, RBAC and health probes) and Azure DevOps pipelines that cut deployment time by 50%. Infrastructure was defined in Terraform, ARM and Bicep, so every environment was built the same way.
Personal project
A small Django site run the way I'd want a production service run: secrets only in environment variables, a strict Content-Security-Policy with no third-party scripts, HSTS, a rate-limited contact form, and a CI pipeline that runs the test suite, Django's deployment checks and a dependency audit on every push.
Links coming soon.
Approach
01
Every human, pipeline and workload gets its own scoped identity. Standing access and shared or long-lived credentials are treated as defects to remove, not risks to accept.
02
Controls live in code and run on every change, so the safe path is the default path and no review depends on one person catching a mistake.
03
A control that can't show it ran isn't finished. Policy-as-code and change records produce their own audit trail, so compliance is a by-product of shipping rather than a separate project.
Writing
Replacing a static database password with short-lived, platform-issued identity: what it solves, and what it doesn't.
Toolkit
Contact
Want to talk cloud security, identity or policy-as-code, or have a question about a post? Send a note and I'll reply directly. Or connect on LinkedIn.