Cloud Portfolio Site
This site. Every push to GitHub reaches production on its own — no manual uploads, no human error. Azure Storage static hosting behind a GitHub Actions pipeline.
Azure StorageStatic WebsiteGitHub ActionsHTML/CSS/JS
Projects
Each solves a real problem a real business has. Lead with the outcome; the services are supporting details.
Secure 2-Tier App
Keeps the database unreachable from the public internet even while the site stays public — web and data tiers on isolated subnets, locked down with NSGs.
Azure VMsVNet / SubnetsNSG
PaaS Modernization & Secrets
Gets passwords out of code and patching off the calendar — a self-managed database VM retired for Azure SQL, secrets in Key Vault retrieved by a Managed Identity.
Azure SQLKey VaultManaged IdentityRBACAzure Monitor
Infrastructure as Code
Rebuilds an entire environment from scratch in minutes, identically, every time — the whole stack in Terraform, extended live to prove it only changes what's different.
TerraformazurermCloud Shell
Governance & Hardening
Least-privilege access with RBAC, an Azure Policy that blocks expensive VM sizes, and a budget alert — guardrails so mistakes can't get costly.
Entra IDRBACAzure PolicyCost / Budgets
AWS → Azure Migration
Moves a production server from AWS to Azure with a rehearsed cutover and zero data loss — discovery, assessment, replication, and cutover, all infra defined in Terraform.
Azure MigrateSite RecoveryTerraform (AWS + Azure)
Containerized App on Kubernetes
Lets an app absorb a traffic spike with no operator involved — containerized with Docker, deployed to Azure Kubernetes Service with ingress and horizontal pod autoscaling.
DockerKubernetesAKSACRHelm
End-to-End CI/CD Pipeline
Stops untested code from ever reaching production — build, test, and deploy across dev and prod with environment approvals and gated Terraform plan and apply stages.
GitHub ActionsAzure DevOpsAutomated TestingGitOps
Serverless API & Automation
Makes a recurring operational chore run itself and serves API traffic with zero servers to manage — event-driven Azure Functions backed by Cosmos DB.
Azure FunctionsServerlessCosmos DBEvent-driven
Observability & Alerting
Surfaces problems before users notice them — dashboards, log queries, and SLO-based alerts on a fully instrumented app.
Azure MonitorLog AnalyticsGrafanaPrometheusAlerting
Reusable Terraform Modules
Turns every environment into a one-command deploy — reusable Terraform modules with remote state and separate dev and production environments, validated automatically in CI, with HashiCorp Vault issuing short-lived cloud credentials over OIDC instead of long-lived secrets sitting in GitHub.
TerraformModulesRemote StateHashiCorp VaultOIDC
Highly Available, Autoscaling Web App
Stays up through a traffic spike or a zone failure — a load-balanced web tier on VM scale sets across availability zones with autoscale rules and health probes.
Load BalancerVM Scale SetsAvailability ZonesAutoscale
Configuration Management with Ansible
Hardens a hundred servers as safely as one — idempotent Ansible playbooks for packages, users, and baseline security, repeatable across any fleet.
AnsiblePlaybooksLinux HardeningIdempotency
Hub-Spoke Network & Private Endpoints
Takes PaaS services off the public internet entirely — an enterprise hub-spoke topology with VNet peering, private endpoints, and access only through VPN and Bastion.
Hub-SpokeVNet PeeringPrivate EndpointsVPN / Bastion
Cloud Security Audit & Hardening
Finds the misconfigurations attackers actually scan for and fixes them — a vulnerable-by-design environment audited with Prowler, remediated against the CIS benchmark, and re-scored to prove the gap closed.
ProwlerCIS BenchmarkIAMTerraform
Threat Detection & Incident Response
Catches a leaked access key being abused within minutes — detection wired first, then a simulated attack it has to spot, contained and written up through the full incident-response lifecycle, mapped to MITRE ATT&CK.
GuardDutyCloudTrailEventBridgeMITRE ATT&CK
Zero Trust Identity
Stops a stolen password from working and ends standing admin access — Conditional Access enforcing MFA and blocking legacy auth, with admin roles granted just-in-time through PIM, time-boxed and logged.
Entra IDConditional AccessPIMMFA
Multi-Cloud DR & Failover
Keeps an app online through an entire cloud outage — traffic fails over from AWS to Azure automatically, with no human in the loop.
AWS Route 53Azure Traffic ManagerMulti-RegionAutomated Failover
Multi-Cloud FinOps Dashboard
Shows live cloud spend across AWS and Azure in one view, and alerts before the bill is a surprise — the visibility teams pay a SaaS vendor thousands a month for.
AWS Cost ExplorerAzure Cost ManagementFinOpsBudget Alerts
Unified Observability (OpenTelemetry)
One dashboard over apps in both AWS and Azure — catch trouble before a user does, without a Datadog-sized bill.
OpenTelemetryAWS CloudWatchAzure MonitorGrafana
Multi-Cloud Security Posture (CSPM)
One security score across AWS and Azure — finds the misconfigurations that cause real breaches, in both clouds, in one report.
AWS Security HubMicrosoft Defender for CloudCSPMCompliance
One Terraform Codebase, Two Clouds
Deploys the same app to AWS and Azure from a single Terraform codebase — one command up, one command down. Real IaC, not a tutorial.
TerraformAWSAzureMulti-Cloud IaC
Container Image Scanning & Promotion Pipeline
Stops a vulnerable container from ever reaching production — every image is scanned before it can be promoted, and a full bill of materials is generated for every build, clean or not.
TrivyAzure Container RegistrySBOMSupply Chain Security
Golden VM Image Pipeline
Ends configuration drift at the source — a CIS-hardened base image built on a schedule, versioned, and ready before any VM in the environment spins up from anything else.
PackerCIS BenchmarkAzure Compute GalleryGitHub Actions
AKS GitOps with ArgoCD
The pipeline never touches the cluster — it only updates Git. ArgoCD watches the repo and deploys automatically, so what's running always matches what's committed.
AKSArgoCDGitOpsImage Update Automation
Penetration Testing Lab
An isolated, no-internet-egress range where Nmap, Metasploit, and Burp Suite test a deliberately vulnerable target — and Defender for Cloud catches the attack as it happens.
Kali LinuxMetasploitBurp SuiteDefender for Cloud
Real-Time Data & AI Platform
A live sales event stream lands, transforms, and gets queried end to end — then Azure OpenAI turns the numbers into an executive summary a business owner can actually read.
Event HubData FactorySynapse AnalyticsAzure OpenAI
Internal Developer Platform
A developer fills out a form and a real service appears — infrastructure, pipeline, and Kubernetes deployment provisioned automatically from one self-service catalog, targeting AWS or Azure on demand.
BackstageTerraformKubernetesMulti-Cloud
Event-Driven Microservices & Distributed Tracing
Kill one service on camera and the rest keep running — services talk through queues instead of direct calls, every request traced end to end, failures caught by a dead-letter queue instead of cascading.
SQS/SNSLambdaOpenTelemetryX-Ray
Progressive Delivery & Automated Rollback
A bad deploy rolls itself back before a human notices — canary releases gated on real error-rate metrics, zero manual intervention.
EKSArgo RolloutsPrometheusGitOps
Multi-Region Disaster Recovery
The primary region goes down live on camera — traffic and data fail over automatically to a standby region, with RTO and RPO actually measured, not just claimed.
AWSRoute 53Aurora Global DatabaseMulti-Region
Multi-Tenant Kubernetes Platform
Every tenant gets its own isolated slice of one cluster — network policies, RBAC, and resource quotas enforced per tenant, provisioned through a self-service onboarding pipeline.
AKSNetwork PoliciesRBACEntra ID