I secure and operate multi-cloud environments across AWS, Azure and GCP — with a specialism in enterprise IAM & identity governance.
◆ Open to senior cloud security / platform security roles — remote or UAE.
Currently running — Tech Intelligence: automated ingestion, scoring and summarisation across nine cloud and DevOps sources, every six hours. [ View → ]
I secure and operate enterprise cloud platforms end-to-end — across AWS, Microsoft Entra ID and Google Cloud — with a specialism in identity governance and posture management.
The differentiator is range: I move fluently between IAM design (SSO / SAML / SCIM, Conditional Access) and the infrastructure layer that IAM ultimately protects — landing zones, Terraform, incident automation, certificate lifecycle.
I replace manual review with scripted controls. Real examples: an access-governance audit across 30+ GitHub orgs, a multi-region SNS→Lambda→Jira incident pipeline, org-level GCP deny policies.
AWS Solutions Architect — Professional. Currently pursuing CKA, AWS DevOps Professional and Terraform Associate.
A scheduled, read-only GitHub App poller that streams commits, pull requests, CI runs and security alerts from 33 organisations into the SOC's SIEM — with no public endpoint and no long-lived credentials.
Live across 33 organisations / 34 installations and ~5,000 repositories at 15-minute latency, for effectively nil running cost.
Took a dedicated-region Oracle Cloud realm from "no outbound egress, can't be done" to load-balancer logs flowing into Observe the same day — Logging → Service Connector → Function → HTTP ingest, with no agents and no stored credentials.
~1,800 observations per hour, live within a minute of the request; unblocked after two weeks of vendor tickets, archive untouched.
Turned a "make the bucket public" request into a pattern that keeps every bucket private: per-environment buckets mounted read-only with gcsfuse and served same-origin through the existing Cloud Armor / VPN front door.
5 buckets, 9 VMs, 5 environments across 3 regions with zero public exposure — and a runbook the team now reuses.
Default VPCs — open firewall rules, public IPs by default — kept reappearing with every new project. I took the control to the organisation: an org policy that prevents default-network creation (approved through change control), remediation of the 30 default VPCs that already existed, deny policies on service-quota increases, and a scripted service-account posture audit.
Result: a whole class of CSPM findings removed at the source and inherited by every future project.
Dormant-user remediation across 30+ organisations (PowerShell + GitHub CLI), enterprise owners trimmed to the admin team plus a break-glass account, and an RBAC design using enterprise-defined custom organisation roles to retire blanket Owner access.
Result: thirty-one per-organisation review packs capture what each business owner actually needs, so roles are assigned by requirement rather than habit.
Production database alarms were triaged by hand. An SNS → Lambda → Jira pipeline across three AWS regions now turns every alarm into a tracked incident with the right fields set.
Result: a ticket, an owner and a timeline from the moment every alarm fires.
An application needed a credential from Secrets Manager and the default ask was an IAM access key. I scoped an inline policy on the instance role to the single secret and the single instance with an ec2:SourceInstanceARN condition — the application reads the secret with its own identity, nothing to store or rotate.
Result: the pattern is now the standard answer for the same request in other environments.
Application teams hit AccessDenied on new foundation models despite "models are enabled automatically". I traced it to the Marketplace subscription that fires on the first invocation and needs permissions the app roles don't carry, enabled six cross-region inference profiles across two accounts with one privileged call each, and documented that one model has no EU-contained profile.
Result: a vague blocker turned into a clear data-residency decision for leadership.
A production intelligence pipeline I built and run. It ingests official release and security feeds from nine cloud and DevOps sources, deduplicates and enriches each item with AI, scores it against my technology profile, and surfaces only what warrants action.
Open dashboard