Writing
Articles, short notes and production case studies on cloud security, identity and access, and policy-as-code: what worked, what didn't, and why. RSS
Replaced legacy SAML SSO across 30+ AWS accounts. Built discovery tooling that scans a dozen resource surfaces and 100+ repositories for legacy role references, and a Terraform module defining permission sets for every engineering role, with Okta SCIM and separately managed break-glass access.
Took production infrastructure changes from ungated to 100% gated: every Terraform apply across 200+ workspaces requires a ServiceNow change record and a clean Wiz scan, backed by a HashiCorp Sentinel policy library enforcing encryption, TLS and tagging standards.
Tenant identity managed entirely in Terraform — management groups, custom RBAC roles, 30+ service principals — with just-in-time admin access through Entra ID PIM and OIDC workload identity federation, so pipelines store no cloud credentials.
SCP service allow-list (60+ approved services, all others denied), 50+ Control Tower controls as code, and GuardDuty, Security Hub and Config enabled for every new account, with findings forwarded to Microsoft Sentinel.
Enforced Kubernetes guardrails at admission and in the pipeline: Kyverno admission policies that block privileged pods, RBAC and namespace isolation, and Trivy and Aqua image scanning built into CI/CD, so insecure workloads are rejected before they run.
Traced it to a Transit Gateway attachment in a Deleted state, restored the route table associations, propagations and return routes, and turned the diagnostic order into a repeatable drill for the team.
Built Kubernetes clusters from scratch with Terraform across dev, staging and production (Helm deployments, autoscaling, ingress, RBAC and health probes) and Azure DevOps pipelines that cut deployment time by 50%. Infrastructure was defined in Terraform, ARM and Bicep, so every environment was built the same way.