IaC, delivery paths, and observability for production AWS. Hands-on lead work: migrations, root-cause fixes, and mentoring engineers.
About
I lead cloud engineers and fix production platform problems. Day to day that means Terraform and CloudFormation foundations, safer release paths, and monitoring that actually helps when something breaks.
I started in mechatronics, industrial automation, and IoT. The habit stuck: automate the boring parts, make system behavior visible, and write down how the platform works so it does not live only in one person’s head.
I verify against the live environment before I trust a design. If I ship it, I can rebuild it, troubleshoot it, and explain it.
Expertise
Terraform and CloudFormation for multi-account AWS foundations, landing zones, and org-wide guardrails, including MAP cost-allocation tagging.
Commit-to-production paths with GitHub Actions, CodePipeline, and CodeBuild, plus docs so teams know who owns what.
EKS and bare-metal Kubernetes with TLS ingress and Cloudflare Zero Trust when public exposure should stay tight.
Metrics, logs, traces, and alerts that help people find the real fault instead of drowning in noise.
Mentoring, architecture reviews, workshops, and AWS cert coaching so the team levels up with the platform.
Selected Work
Blue/green replacement across three AWS environments
Three OpenVPN Access Server hosts (dev, staging, and production) ran on an end-of-life OS that blocked the required server upgrade. Replacements had to keep public addresses, certificates, config, and client profiles for about 260 user accounts.
One parameterized CloudFormation template and two idempotent Systems Manager documents reproduced, migrated, and reconciled all three environments. Each cutover was validated end to end (account counts, CA data, licensing, tunnels, DNS, private-network access), then hardened: no public SSH, Session Manager only, TLS 1.2 minimum, encrypted storage.
An apparent permissions failure that was private DNS interception
A containerized service got HTTP 403 calling a public regional API. It was escalated as permissions. An interface VPC endpoint with private DNS was overriding the regional hostname and sending traffic through a policy meant only for selected private APIs.
In-place Terraform change, development first. Endpoint ID kept; no dependent replacements. Public API resolved publicly and succeeded; private APIs still went through the VPC endpoint. Then the same change rolled through the remaining environments.
Production delivery for a multi-environment database service
Healthy API and worker services behind an internal load balancer, multi-source pipeline, scoped IAM, and dedicated logging. Live in development in about a week and unblocked the UI team.
An internal database ops service had working app code but no production-grade deploy path. It needed private AWS runtime, separate API and worker processes, a private shared dependency, and reach into connected dev, staging, and production networks.
Voice exchange rates and conversion for 140+ currencies
Published Currency Genie to the Alexa Skills Store with lookups, spoken conversion, multi-turn sessions, and voice-friendly formatting. Separate Lambda lanes, tests, sanitized CloudWatch logs, OIDC deploys, and explicit cert/publish controls.
Reworked a Lambda-backed Alexa currency skill after a generic invocation name competed with other public skills. Needed clear voice routing, strict dev/prod isolation, resilient rate providers, and a controlled certification path.
Resource discovery and tagging for AWS Migration Acceleration Program
Python CLI to discover and tag resources for MAP across customer accounts and regions. Built to replace Tag Editor, which throttles silently after about 28 resources and cannot find resources with zero tags.
Raised single-run tag success from 16% to 99% on 1,200+ CloudWatch Log Groups with exponential backoff. Reached zero-tagged RDS, EC2, EBS, and Lambda that Tagging API never saw, via deep discovery in multi-account estates.
Experience
My current responsibilities at DinoCloud span two concurrent tracks: customer-facing cloud strategy and hands-on engineering leadership.
Guide customers in the AWS Cloud, connecting technical priorities with security, cost, resilience, and long-term platform strategy.
Support customer AWS environments spanning 15+ accounts, connecting executive priorities with concrete actions across governance, security, resilience, and cost optimization.
Lead and mentor cloud engineers while shaping resilient AWS platforms, security controls, observability, and delivery standards.
Provide technical direction and mentoring to 3–4 cloud engineers through architecture reviews, production troubleshooting, documentation, and targeted development plans.
Engineered and automated AWS infrastructure, delivery pipelines, monitoring, and serverless systems for production environments.
Designed and deployed custom IoT solutions for industrial automation, integrating AWS and third-party services for real-time control.
Stack
AWS credentials
Direct links to verification on Credly.
Open to senior cloud, platform engineering, and technical leadership. I read every message myself.