Solutions Architect · AWS DevOps · AzureRemote · Open to roles

Cloudinfrastructure,automated,securedandbuilttolast.

Four years designing, shipping and running production platforms on AWS and Azure. Terraform, containers, CI/CD and Microsoft 365 security, across healthcare and SaaS.

See the work→Download CV

17: Projects delivered
4+: Years in DevOps
83.7%: Microsoft Secure Score
3: Cloud certifications

01

Idesigncloudplatformsthatarerepeatable,secureandboringtooperate.

My work sits where infrastructure, delivery and security meet: Terraform-defined AWS and Azure environments, dynamic CI/CD pipelines with OIDC and vulnerability scanning, and the monitoring that tells you something is wrong before your users do.

I also run the Microsoft 365 side end to end: Entra ID, Intune, Defender, Exchange and Purview, plus tenant migrations and compliance work (Cyber Essentials, CE+, NHS DSPT, ISO 27001 alignment). Cloud, identity and security in one engineer.

Cyber EssentialsCyber Essentials PlusNHS DSPTISO 27001 alignmentHSCN connectivityLeast-privilege IAMOIDC workload identityVulnerability scanning

02

Numbersfromrealenvironments.

Microsoft Secure Score

Raised through systematic identity, endpoint and compliance controls, applied by business need rather than blindly.

Intune compliance

Across 60+ managed devices.

Availability

Healthcare analytics platform with monitoring and backup automation.

Less credential exposure

Secrets moved from S3 env files to Secrets Manager with OIDC.

Faster downtime detection

Route 53 health checks and Lambda alerts into Teams.

Users on a VoIP system I built

Business VoIP and dialler platform, integrated directly with the company's web app.

Microservices migrated

AWS Lambda to Amazon EKS, plus 100+ metrics in Grafana.

Long-lived AWS keys in CI/CD

Bitbucket to AWS via OIDC.

03

WhereI'vebuiltit.

DevOps Engineer · 31G Ltd

Dec 2024 – Present

United Kingdom / Pakistan

Design and run multi-environment infrastructure (Dev, QA, UAT, Prod) across a portfolio of healthcare and SaaS platforms on AWS, Azure and Microsoft 365.
Terraform as the standard: reusable VPC, ECS/Fargate, ALB, RDS, Redis, IAM and Route 53 patterns with isolated state per environment.
Dynamic Bitbucket pipelines with Trivy scanning, OIDC to AWS, environment-aware deploys and post-deployment health validation.
Own production troubleshooting across ECS, ALB, CloudFront, RDS, DNS and CI/CD, then fix root causes, not just restart services.
Lead Microsoft 365 security and compliance work: Cyber Essentials and CE+, NHS DSPT, ISO 27001 alignment.

DevOps Engineer · Stelle Cloud

Sep 2022 – Nov 2024

Remote

Built and maintained AWS infrastructure with Terraform, ECS, EC2, RDS, VPC and IAM, and CI/CD on GitHub Actions and Bitbucket.
Cut operational costs by 20% and deployment times by 30%, and reduced manual configuration errors by 40% through Infrastructure as Code.
Set up Grafana and Prometheus monitoring, cutting incident response time by 25%.

2021 – 2022

Cardiff Metropolitan University

BA (Hons) Accounting and Finance

2018 – 2021

University of Gloucestershire

BA (Hons) Accounting and Finance with Foundation (transferred)

04

17 projects across AWS, Azure and Microsoft 365.

Client names are kept private. Open any project for its architecture. Keep scrolling to swipe through them.

01

17

Healthcare01 / 17

Digital healthcare platform

Terraform-managed ECS/Fargate estate across Dev, UAT and Production, with S3 and CloudFront media delivery, HSCN-aware private networking and live domain migrations.

ECS/FargateTerraformCloudFrontHSCN

Open case study →

Architecture live

Microsoft 36502 / 17

Microsoft 365 tenant build and hardening

End-to-end tenant: Entra ID, Intune, Defender, Exchange, Purview and Conditional Access, with BitLocker key escrow and MFA plus compliant-device rules.

83.7%Secure Score

Entra IDIntuneDefenderPurview

Open case study →

Architecture live

Migration03 / 17

Multi-domain M365 tenant migration

Mailboxes and OneDrive moved across domains, security and endpoint controls replicated in the destination, access and mail flow validated after cutover.

Shared authentication and scheduling platform

Central auth and rota services reused across products, on standardised Terraform and CI/CD patterns to cut duplication.

TerraformCI/CDPlatform engineering

Open case study →

Architecture live

Healthcare05 / 17

Healthcare platform on ECS/Fargate

Terraform workspaces for Dev and Prod, private RDS behind a bastion, Celery workers with Redis/Valkey, Secrets Manager, DNS and TLS. Built to be recreated from code.

TerraformECSRDSCelery

Open case study →

Architecture live

Migration06 / 17

Website migration and 150-user VoIP

Live site moved off Wix into a cloud app environment with a controlled DNS cutover, plus a business VoIP and dialler system for ~150 users, integrated directly with the web app.

~150users

Route 53TerraformVoIP

Open case study →

Architecture live

Migration07 / 17

WordPress and web migrations to AWS

Apps moved from external hosts to EC2/ECS, RDS, S3 and CloudFront. DNS replicated before nameserver change for a safe rollback path.

CloudFrontACMRoute 53Backups

Open case study →

Architecture live

Platform08 / 17

Azure DevOps support

Azure Container Apps, ACR, Static Web Apps, Front Door and Redis, with Docker build and deploy workflows.

Container AppsACRFront Door

Open case study →

Architecture live

Healthcare09 / 17

Telemedicine infrastructure

ECS/Fargate on Terraform with S3 remote state and DynamoDB locking, Identity Center roles with permission boundaries, rollback checks in pipelines.

TerraformIdentity CenterTwilio

Open case study →

Architecture live

Healthcare10 / 17

NHS HSCN multi-environment infrastructure

Dev, QA, UAT and Prod with REG and Pilot kept separate, HSCN and EMIS connectivity over Direct Connect and VPN, VPN-only database access.

90%less secret sprawl

HSCNDirect ConnectSecrets Manager

Open case study →

Architecture live

Healthcare11 / 17

Healthcare AI platform

Full Terraform coverage for VPC, ECS/Fargate, ALB, RDS and logging. Private RDS with bastion-only access and Secrets Manager via OIDC.

95%less credential exposure

TerraformECSOIDCCelery

Open case study →

Architecture live

Healthcare12 / 17

Healthcare analytics platform

Reproducible Terraform modules, Bitbucket pipelines, Power BI over an on-prem gateway, Prometheus and CloudWatch monitoring with Lambda alerts into Teams.

99.99%availability

TerraformPrometheusLambda

Open case study →

Architecture live

SaaS13 / 17

Healthcare supplies platform

WordPress on EC2/RDS with S3 backups and snapshot DR, VPN-restricted database access, ECS microservices with Secrets Manager via OIDC.

50%faster backup recovery

Hybrid AWS and Azure SaaS

Hybrid workloads across AWS and Azure with pipelines and identity integration. OIDC replaced static AWS keys in CI/CD.

Compliance and analytics infrastructure

Cyber Essentials and CE+ readiness through patching, remediation and hardening, the NHS DSPT process, ISO 27001-aligned documentation, Apache Superset analytics VMs.

Containerised delivery on ECS

Dockerised workloads, Terraform-managed ECS and GitHub Actions build and deploy.

15%fewer deploy issues

DockerECSGitHub Actions

Open case study →

Architecture live

SaaS17 / 17

Lambda to EKS migration

10+ microservices moved from Lambda to EKS, Bitbucket to ECR pipelines, Grafana and Prometheus across 100+ metrics.

Next · 18Your platform
could be here.Let's talk →

scroll to swipe · click a card for its case study

05

Apipelinethatsaysno.

The dynamic Bitbucket pipeline I build for multiple apps and environments. Every release takes the same road, and two gates decide where it ends up: a scan that refuses vulnerable images before anything is built, and a health check that rolls a bad deploy back on its own. Production only ever runs a version that has proven healthy.

OIDC between Bitbucket and AWS, no long-lived keys
Separate state and config per environment
Reusable scripts instead of copy-pasted shell
Rollback checks and health validation

How I work

Zero long-lived keys.

Least privilege by default.

Scanned before it ships.

Everything as code.

07

ToolsIshipwitheveryweek.

fig.07 / toolchain

33 tools

hover a tool

drag to spin

01Cloud & compute05

02IaC & delivery06

03Microsoft 365 & identity05

04Data & observability07

05Also08

AWS services used in production29

VPCECSFargateEKSECREC2LambdaRDSElastiCacheS3CloudFrontRoute 53ACMIAMIdentity CenterSecrets ManagerCloudWatchCloudTrailALBNATDirect ConnectSite-to-Site VPNSESSNSMQEBSDynamoDBTextractWorkSpaces

AWS

Azure

Kubernetes

Docker

Linux

Terraform

Bitbucket

GitHub Actions

Trivy

Bash

PowerShell

Entra ID

Intune

Defender

Purview

Exchange

PostgreSQL

Redis

SQL Server

Grafana

Prometheus

Superset

Power BI

Vault

Cloudflare

Twilio

WordPress

DigitalOcean

Python

DBeaver

Cyberduck

Microsoft 365

Microsoft Teams

EC2

ECS

Fargate

EKS

Lambda

RDS

ElastiCache

DynamoDB

S3

CloudFront

Route 53

ACM

IAM

Secrets Manager

CloudWatch

CloudTrail

VPC

ALB

SES

SNS

Amazon MQ

08

Experienceacrossdiverse,multiculturalteams.

Across different companies and projects I've worked with people from 14 countries, each bringing their own culture and way of thinking. Every team has sharpened how I communicate, document and solve problems, and the best engineering decisions I've seen came from the most diverse rooms.

14: countries
4: continents