Hands-on cloud infrastructure, automation, Kubernetes, CI/CD, and security projects developed as part of my transition from regulated life-sciences operations into cloud engineering. I am targeting cloud security engineering and AI platform engineering roles.
Each project has its own README with an at-a-glance summary, architecture, validation steps and evidence. If you have two minutes, read the summary table at the top of one.
| # | Project | What it shows | Technologies | Status |
|---|---|---|---|---|
| 01 | Kubernetes Stateful Application | A stateful workload with persistent storage, runtime secrets and a non-root security context, with data proven to survive pod replacement | Kubernetes, Minikube, StatefulSet, Splunk | Complete (validated locally) |
| 02 | Argo CD GitOps and RBAC | Git-driven deployment, drift self-healing, environment boundaries and least-privilege access, with real allow and deny tests | Argo CD, AppProject, Kubernetes RBAC | Complete (validated locally) |
| 03 | Multi-Region Hub-and-Spoke Web Application with Centralized SIEM | A seven-region AWS network with centralized log collection, no SSH access and least-privilege security groups | Terraform, AWS Transit Gateway, ALB, Loki, Grafana | Deployed, verified and torn down. Evidence and cost in the project README. |
| 04 | WAF to Bedrock Threat Correlation to SOAR Pipeline | An AWS pipeline that turns WAF logs into scored findings, incidents and reports. Amazon Bedrock only explains. Deterministic code makes every decision, and containment is never automated. Cognito MFA and group-based access protect the API. | Terraform, AWS WAF, Lambda, Bedrock, EventBridge, DynamoDB, Cognito, Python | Deployed, verified and torn down. Based on a class group lab. Evidence is partial and the limitations are listed in the project README. |
| 05 | GCP to AWS HA VPN with BGP | Four IPsec tunnels with BGP between a Google Cloud VPC and an AWS Transit Gateway, generated pre-shared keys and private test machines | Terraform, GCP HA VPN, Cloud Router, AWS Transit Gateway, Site-to-Site VPN | Deployed, verified and torn down. Based on a class group lab. |
| 06 | Local DevSecOps Pipeline with Jenkins | A 12-stage Jenkins pipeline, configured as code, that builds and tests a small Flask app, then scans it (SonarQube quality gate, gitleaks, Trivy, OWASP ZAP), deploys it to a local container and tears everything down. One run is blocked by Trivy on purpose and the fixed run passed on 2026-10-03 (a later run stopped at the image scan on a base-image package finding; after a Dockerfile fix it passed again on 2026-10-04, see the project README). | Jenkins, SonarQube, Trivy, gitleaks, OWASP ZAP, Docker Compose, Python | Run, verified and torn down. Based on a class exercise. |
- AWS infrastructure CI/CD: Terraform deployment through a Jenkins pipeline with infrastructure validation, an approval gate, automated security testing (PortSwigger Dastardly) and teardown
- Kubernetes platform work: ingress, TLS with cert-manager, and Splunk on Kubernetes
- Kubernetes policy and gateways: OPA, Flux and Kong labs
| Area | Where to see it |
|---|---|
| Infrastructure as Code (modules, provider aliases, remote state) | Project 03 |
| Network security (Transit Gateway routing, security groups, no SSH) | Project 03 |
| Hybrid connectivity (HA VPN, BGP) | Project 05 |
| Kubernetes workloads and storage | Project 01 |
| GitOps and policy boundaries | Project 02 |
| Access control and least privilege | Projects 02, 03 and 04 |
| Event-driven AWS (Lambda, EventBridge, DynamoDB, SNS) | Project 04 |
| Generative AI with guardrails (Bedrock explains, code decides) | Project 04 |
| API authentication and role-based access (Cognito, MFA, API Gateway authorizer) | Project 04 |
| Secrets handling (kept out of Git) | Projects 01 and 02 |
| Secrets handling in Terraform (generated pre-shared keys) | Project 05 |
| CI/CD with Jenkins (pipeline and configuration as code) | Project 06 |
| SonarQube quality gates | Project 06 |
| Trivy (dependency, container image and Terraform scanning) | Project 06 |
| OWASP ZAP (baseline scan of a deployed container) | Project 06 |
| Troubleshooting and evidence-based documentation | All projects |
Every project follows the same pattern, so you can find things quickly:
projects/NN-project-name/
├── README.md # At a glance, talk track, architecture, validation, scope
├── manifests/ # or terraform/ for infrastructure code
├── notes/ # Troubleshooting write-ups
└── evidence/ # Command output and screenshots
Each README states its scope and limitations plainly. These are learning and portfolio projects, and I describe what was actually validated.
- Automated secret scanning. A gitleaks scan runs over the full commit history on every push and pull request, and weekly (see the badge at the top).
- Nothing sensitive is committed. Each project's
.gitignoreexcludes Terraform state,*.tfvars, real backend configuration, keys and secret manifests. Files such asbackend.tf.exampleshow the shape without real values. - Runtime secrets. The Splunk administrator password is created at deploy time and never stored in Git.
- Infrastructure-as-code scanning. Checkov scans the Terraform and Kubernetes manifests on every push and pull request. It currently reports findings without blocking the build, and the first results are triaged in docs/iac-scan-findings.md.
- Dependency updates. Dependabot proposes weekly updates for GitHub Actions and the Terraform provider, and the workflows pin each action to a commit.
- In what I build. Project 04 uses Amazon Bedrock under one rule: deterministic code decides severity, playbooks and compliance results, and the model only writes the explanation. Anything the code cannot evaluate becomes
REVIEW, and nothing is ever contained automatically. - In how I work. I use an AI assistant to review my work, draft documentation and run checks such as secret and infrastructure scans. I then verify the result with the tools themselves: scanner output,
terraform validate, and deployments that were applied and destroyed. A claim in a README is either tested or labeled as untested.
- AWS Certified Solutions Architect – Associate
- AWS Certified Machine Learning Engineer – Associate
- Oracle Cloud Infrastructure Generative AI Professional
- HashiCorp Terraform Associate – In Progress
I bring more than 10 years of experience in regulated life-sciences operations, including risk management, audit readiness, vendor oversight, documented controls, and cross-functional delivery.
My current focus is building and documenting hands-on cloud infrastructure skills that can be demonstrated directly through the projects in this repository.