Cloud Armor WAF for Kubernetes (GKE)
Layer-7 protection for GKE via External HTTP(S) Load Balancer: OWASP WAF rules, rate limiting and geo/IP allow-deny, with Cloud Logging and Terraform IaC.
Hiring for this? Get in touchPortfolio — Production GCP Platform, Security & FinOps
Portfolio & Projects
Portfolio
I design and ship enterprise cloud platforms that stay secure, reliable and cost-efficient — from architecture review to production operations.
Google CloudAmbassador
5×GCP Professional Certified
25Reference Architectures
3Clouds — AWS · Azure · GCP
Enterprise-grade cloud, security and AI delivery — trusted from architecture to production.
Designed & delivered on
Google CloudAWSAzureKubernetesTerraform
Cloud Platform Engineering
Multi-region GKE, Shared VPC and load balancing, Terraform and Argo CD GitOps — owned in production for 5+ product teams.
Cloud Security & DevSecOps
Least-privilege IAM, Workload Identity, Cloud Armor WAF, policy-as-code, secrets and supply-chain controls — built into the platform.
FinOps & Cost Governance
Cross-cloud reviews that cut spend by 40% — right-sizing, autoscaling, storage tiering, commitments — with SLOs intact.
Reliability & SRE
Observability, SLOs, on-call, RCA, backup and RPO/RTO validation — proven at FIFA 2026 peak and under external DDoS testing.
Cloud Migration & GCP Adoption
OpenStack/AWS to GCP re-platforming with IaC, GitOps promotion and zero-downtime cutover; internal enablement for 150+ engineers.
AI Workloads on GCP
RAG and LLM services run securely on the platform — guardrails, evals, PII controls, EU AI Act / GDPR governance.
Hiring for one of these? Pick the focus — it pre-fills the contact form.
Cloud Platform / ArchitectCloud MigrationCloud SecurityRecruiter / AgencyAI Platform on GCPFinOps Focus
Open to permanent senior roles · Germany / DACH · onsite, hybrid or remote
Reference Architectures![]()
Architectural Designs
I architect and deliver enterprise-grade platforms across AWS, Azure and Google Cloud — scalable across regions, zero-trust secured, observable and cost-optimized. Each diagram below is a real-world reference architecture: landing zones and governance, resilient networking, secure CI/CD, event-driven systems, data platforms and applied AI. Filter by cloud, open any design and zoom in to explore the details.
The collection spans GKE and Kubernetes networking, Cloud Armor WAF, VPC Service Controls, landing zones, disaster-recovery patterns such as pilot light and warm standby, event-driven pipelines and multi-region failover on Google Cloud, AWS and Azure.
Click any diagram to open the viewer and zoom in.
Multi-Region GKE Cluster with GitOps & Fleet
Highly available GKE across multiple regions, managed with Google Fleet. Config Sync from Git keeps deployments consistent with multi-region failover.
Hiring for this? Get in touchCross-Regional Internal Load Balancer for GKE
Round-robin load balancing across GKE clusters in different regions via Cross-Regional ILB. NEG-based, highly available, low-latency internal access.
Hiring for this? Get in touchBackup and Restore
Multi-region backups with S3 Cross-Region Replication, Aurora Global Database and EBS snapshots — data integrity, HA and DR for critical workloads.
Hiring for this? Get in touchPilot Light Architecture
Pilot-light DR with Aurora Global Database, ELB and Auto Scaling Groups. Critical DBs stay on; the app tier spins up on failover for lower cost and RTO.
Hiring for this? Get in touchCI/CD for ML with Vertex AI Pipelines
Cloud Build and Vertex AI Pipelines automate images, artifacts and pipeline deploys from every Git commit — a full, reproducible MLOps loop.
Hiring for this? Get in touchWarm Standby Architecture
Warm-standby environment in a secondary region with Aurora Global Database, ELB and Auto Scaling Groups for fast failover and reduced recovery time.
Hiring for this? Get in touchCloud VPN Hub-and-Spoke
Scalable hub-and-spoke on Google Cloud VPN that overcomes VPC Peering limits and enables transitive connectivity across many spoke networks.
Hiring for this? Get in touchVPC Peering Hub-and-Spoke
Secure inter-VPC communication via Network Peering on the Google backbone, with Cloud NAT for egress and optional VPN for forwarded routes.
Hiring for this? Get in touchEnterprise App on Compute Engine (Oracle DB)
Regional managed instance groups behind a load balancer with Oracle Data Guard HA — Cloud NAT, Hyperdisk and Cloud Storage for performance and backups.
Hiring for this? Get in touchAWS Multi-Account Landing Zone
Governance at scale with AWS Organizations and Control Tower: Security, Infrastructure and Workloads OUs, SCP guardrails and centralized CloudTrail/Config.
Hiring for this? Get in touchEvent-Driven Serverless on EventBridge
Decoupled serverless flow: API Gateway and Lambda publish to EventBridge, which routes by rule to SQS, Step Functions and DynamoDB — with DLQ safety nets.
Hiring for this? Get in touchZero-Trust Private Connectivity (PrivateLink + TGW)
Segmented hub-and-spoke on AWS Transit Gateway with PrivateLink endpoints to S3, KMS and Secrets Manager — east-west traffic never touches the public internet.
Hiring for this? Get in touchAzure Enterprise-Scale Landing Zone
Cloud Adoption Framework landing zone: management-group hierarchy, Azure Policy guardrails, hub-and-spoke networking with Firewall and Bastion, and Entra ID.
Hiring for this? Get in touchSecure CI/CD for AKS (GitHub Actions + Key Vault)
GitHub Actions builds, scans and signs images into ACR, then deploys to a private AKS cluster. Pods pull secrets from Key Vault via Workload Identity.
Hiring for this? Get in touchGCP Secure Landing Zone / Org Blueprint
Organization blueprint with folder hierarchy, VPC Service Controls perimeter, Org Policies, Shared VPC and centralized logging with Security Command Center.
Hiring for this? Get in touchEnterprise RAG on Vertex AI
Retrieval-augmented generation: documents embedded in Vertex AI Vector Search; Cloud Run retrieves context and calls Gemini for grounded, cited answers.
Hiring for this? Get in touchBigQuery Lakehouse Data Platform
Streaming and batch ingestion via Pub/Sub and Dataflow into a BigQuery lakehouse, ELT with Dataform and unified governance with Dataplex — analytics-ready.
Hiring for this? Get in touchAnthos Multi-Cluster Service Mesh
Hybrid fleet of GKE and on-prem clusters under Anthos: Multi-Cluster Ingress, Anthos Service Mesh with mTLS everywhere and GitOps config sync.
Hiring for this? Get in touchGlobal Web App — Cloud CDN + Cloud Armor
Global HTTP(S) Load Balancer with Anycast IP fronts serverless backends: Cloud CDN caches at the edge and Cloud Armor blocks WAF and DDoS threats.
Hiring for this? Get in touchHybrid Connectivity — Interconnect + NCC
High-bandwidth Dedicated Interconnect with encrypted HA VPN failover and Cloud Router BGP, unified through Network Connectivity Center transitive routing.
Hiring for this? Get in touchEvent-Driven Serverless on Eventarc
Eventarc routes CloudEvents from 90+ sources through Pub/Sub to autoscaling Cloud Run services, with dead-letter topics for at-least-once safety.
Hiring for this? Get in touchSecure Software Supply Chain
Cloud Build scans, SBOM-tracks and signs images into Artifact Registry; Binary Authorization gates unverified images before Cloud Deploy progressive rollouts.
Hiring for this? Get in touchZero-Trust Access with IAP / BeyondCorp
Identity-Aware Proxy authorizes every request by identity and device context via Access Context Manager — no VPN and no network perimeter to trust.
Hiring for this? Get in touchMulti-Region Resilience with Cloud Spanner
Active-active app tiers in two regions behind a global load balancer share one Cloud Spanner instance with synchronous replication and a 99.999% SLA.
Hiring for this? Get in touch100%
Selected Work
Delivered in Production
Platform, security and cost work I have owned end to end — led by the production Google Cloud platform at Deutsche Telekom — plus the AI workloads that run securely on it. Each taken from architecture to a measurable outcome.
ProductionTelecom · Deutsche Telekom
Production Google Cloud Platform — Deutsche Telekom
Architected and operate Telekom's first production GCP platform — multi-region, active-active GKE with Terraform/OpenTofu, Argo CD GitOps, Cloud Armor WAF and zero-trust IAM — sustaining 12,000+ req/s at FIFA World Cup 2026 peak and passing an independent DDoS resilience test, for 5+ product teams.
ProductionEnterprise · regulated EU
FinOps Cost Optimization
Led a cross-cloud cost review across GCP, AWS and Azure — rightsizing, autoscaling, storage tiering and commitment planning — cutting cloud spend by 40% with SLOs and performance fully intact.
ProductionEnterprise · regulated EU
DevSecOps Hardening & Supply Chain
Hardened the pipeline with threat-aware CI/CD — SAST / DAST, SBOM, image signing and policy-as-code — cutting critical findings and delivering an audit-ready supply chain.
ProductionEnterprise · regulated EU
Grounded Enterprise Search on Vertex AI
Platform and security side of grounded enterprise search on Vertex AI — secure connectors, IAM scoping, relevance tuning and observability — with PII controls that keep every answer compliant and trustworthy.
ProductionEnterprise · regulated EU
LLM Guardrails & Evaluation
Shipped LLM guardrails & automated evals — toxicity, hallucination and jailbreak coverage — with production dashboards that turn safety into measurable, continuous quality.
AdvisoryEnterprise · regulated EU
AI Compliance Readiness
Ran a EU AI Act & GDPR gap analysis — data mapping, DPIA templates, model inventory and logging controls — and prepared audit-ready artefacts for internal and external reviews.
Also delivered
- Kubernetes platform on OpenStack & AWS (2022–2024)
- GitLab CI for 50+ services — ~40% faster releases
- AI voice & chat contact-center PoC (Agentspace)
- Centralized log analytics & SIEM forwarding
- TLS & certificate lifecycle automation
- Enterprise network hardening (Juniper, Cisco, Huawei)
Shipped & Published
Products & Open Source
Software I have designed, built and shipped end-to-end — from open-source packages live on public registries to private production services. Post-quantum security, risk analytics, protocol research, cloud automation and developer tooling.
ClawSec
A full encrypted-networking toolkit — AES-256-GCM with a post-quantum hybrid key exchange (ML-KEM-768), TUN VPN, TLS 1.3 camouflage and anti-censorship transport. Shipped to Docker Hub, AUR and GHCR.
Human Risk Graph
A quantitative model that gives leadership measurable visibility into key-person dependency, decision bottlenecks and human control-bypass risk — Bus Factor, Decision Concentration and Bypass Risk in one product. Published to PyPI with a citable DOI.
Open-IPv8-Lab
An educational pure-Python toolkit based on the experimental IPv8 protocol (draft-thain-ipv8-02) — 58 modules, 35 CLI commands and 1 827 tests spanning address parsing, packet construction, routing simulation and companion protocols. On PyPI with a DOI and full docs.
Dev Env Diff & Flight Recorder
A VS Code extension that kills "works on my machine" — one-click snapshot of runtimes, Docker, ports, env vars and git state, diffed against a teammate's and turned into a Markdown fix report with ready-to-run commands. 100% local, no telemetry.
Prompt Seal
A Chrome & Safari extension that keeps secrets out of AI prompts — it scans messages before they reach ChatGPT, Claude or Gemini using 110+ regex patterns plus Shannon-entropy analysis, then redacts or blocks API keys, tokens and PII. 100% local, zero telemetry.
Worta
A Chrome extension that turns everyday browsing into language learning — instant translation across 39 languages, a personal vocabulary and Leitner spaced-repetition flashcards with TTS and a side-panel mode. 100% local storage, no accounts, no tracking.
Certificate Reconciler
A Python service running serverless on Cloud Run that continuously reconciles TLS certificate state — detecting drift and upcoming expiry across environments and driving renewals automatically, so nothing silently lapses in production.
Private production service
App Checker
A lightweight Go service that probes applications and reports whether they are live — fast, dependency-free health checks with clear up/down signalling, built to slot into any deployment as a self-contained reliability watchdog.
Private production service