Cloud Platform & Security Services on GCP

Profile

What I Do

Cloud Platform · Cloud Security · DevSecOps on Google Cloud

Get in Touch

12+Years Experience

3Cloud Platforms

FIFA '26Peak-load proven

20+Certifications

Multi-regionActive-active architecture

As a Senior Cloud Platform & Security Engineer with 12+ years of experience, I design and deliver enterprise-grade, compliant, highly available cloud architectures. I have delivered mission-critical platforms that withstood the peak traffic of the FIFA World Cup 2026 and a third-party DDoS resilience test — with measurable reliability and cost optimization.

I specialise in Google Cloud — with production AWS and Azure experience where the business needs it — with Infrastructure as Code, zero-trust, and automated compliance. I ensure scalability, regulatory alignment (e.g. GDPR, ISO 27001) and resilience across distributed systems.

I implement Security as Code, advanced vulnerability scanning, threat modelling and CI/CD hardening, aligned with NIST, CIS Benchmarks, OWASP and other standards.

Current Tech Stack

DevOps & Cloud Architecture

GCP (primary) AWS Azure Kubernetes GKE ArgoCD Config Sync Helm Istio Calico Terraform OpenTofu GitLab CI GitHub Actions Jenkins

Security & Policy Enforcement

GCP IAM IAM policy design Workload Identity Secret Manager Cloud KMS Security Command Center SCC HashiCorp Vault Organization Policy VPC Service Controls OPA Gatekeeper Kyverno IAP cert-manager Zero Trust Architecture SIEM threat detection and response vulnerability management GDPR ISO 27001 ISO 42001

Monitoring & Observability

OpenTelemetry Prometheus Managed Service for Prometheus Grafana Loki Tempo ELK Stack Splunk SIEM Cloud Monitoring Cloud Logging Log-based Metrics Alerting Policies SLO/SLI Dashboards Uptime Checks Cloud Trace Cloud Profiler Error Reporting

Data Layer & Storage

Cloud Spanner (PostgreSQL/Cassandra) Cloud SQL Memorystore (Redis) AstraDB over PSC Pub/Sub BigQuery CMEK backup and RPO/RTO validation

Networking & Edge Security

Cloud Load Balancing (Internal/External, Global/Regional) Cloud Armor WAF Cloud CDN Cloud DNS (Public/Private) DNS Peering VPC design and segmentation Shared VPC Firewall rules Private Service Connect Private Google Access Cloud NAT Cloud Router BGP HA VPN and Interconnect Ingress and Egress Multi-Cluster Ingress Gateway API TLS and mTLS Network Policies Calico Service Mesh IAP-secured access

Tools & Platforms

Docker Git GitLab GitHub Argo CD Helm kubectl K9s Terraform OpenTofu HashiCorp Vault cert-manager ServiceNow (ITIL: Incident/Change/RCA)

Languages & Scripting

Python Golang Bash TypeScript SQL HCL Rego CEL

Infrastructure & Testing

Terratest k6 Locust Chaos Mesh Litmus Trivy OWASP ZAP

Methodologies

GitOps DevSecOps SRE principles Agile Scrum Kanban

Cloud & DevSecOps

I design, implement, and secure multi-cloud, cloud-native architectures across AWS, GCP, and Azure — mission-critical platforms proven under FIFA World Cup 2026 peak load and a third-party DDoS resilience test, with measurable reliability and cost optimization.

Infrastructure as Code: Terraform / OpenTofu with reusable modules, peer-reviewed change workflows
GitOps and CI/CD: Argo CD, Config Sync, GitLab CI and GitHub Actions with security gates
Policy as Code and governance: Kyverno, OPA Gatekeeper, Organization Policy, VPC Service Controls
Kubernetes platform engineering: Multi-region, multi-cluster GKE, Helm, Istio, Calico NetworkPolicy
Observability and SRE: OpenTelemetry, Prometheus, Grafana, Cloud Monitoring, SLOs, on-call and RCA
Zero Trust and identity: Least-privilege IAM, Workload Identity, OIDC/SSO, KMS and Secret Manager
Edge and network security: Cloud Armor WAF, Global External LB, Shared VPC, Private Service Connect

40%Cloud spend cut with SLOs intact

100%Availability held under external DDoS test

50+Secure CI/CD pipelines automated

12K+req/s sustained peak on Global External Load Balancer

Selected Enterprise Delivery Highlights

Selected delivery outcomes from large-scale Deutsche Telekom platform work across multi-region GKE, cloud security, GitOps automation, and production reliability.

Operated a mission-critical multi-region GKE platform for a global enterprise that sustained FIFA World Cup 2026 peak traffic
Sustained 12,000+ req/s peaks via Global External Application Load Balancer across a multi-backend active-active topology
Built and modernized multi-region GKE platforms (DEV/PROD/SANDBOX), including Argo CD management clusters, workload clusters, and cross-region rollout patterns
Implemented enterprise GitOps at scale: Argo CD, Config Sync, dedicated infra repositories, reusable CI templates, and environment-driven tfvars workflows
Designed and migrated internal/external HTTPS load balancing with Cloud Armor in multi-cluster topologies, including policy hardening, Adaptive Protection, and incident tuning
Delivered secure access architecture for developers: OIDC/WIF, IAP jump-host patterns, least-privilege IAM, group-based access, and audited access flows
Led platform data-layer engineering with Cloud Spanner (PostgreSQL/Cassandra adapter), Memorystore Redis Cluster, Astra DB over PSC, CMEK and backup strategy
Implemented certificate lifecycle improvements: Google-managed certs, TeleSec ACME automation, cert-manager flows, DNS validation, and TLS policy hardening (HSTS, cipher controls)
Migrated critical network and security controls from manual ops to Terraform + CI/CD (Cloud Armor, firewall baselines, address groups, external LB modules) for DEV and PROD parity
Improved operational excellence through runbooks and deep-dive guides (Cloud Armor, Multi-Cluster, VPC Firewall, incident response), plus on-call readiness and RCA support

Security & Compliance Outcomes

DDoS resilience
The platform withstood independent external stress-testing across multiple attack categories — volumetric SYN/ACK floods, high-bandwidth traffic bursts, TCP connection exhaustion and application-layer HTTP floods — with Cloud Armor WAF and Global External Load Balancing keeping full service availability throughout
Privacy & Security Assessment (PSA)
Policy controls aligned across cloud services, with implementation patterns mapped into platform delivery
IAM hardening
Least-privilege roles, Workload Identity/WIF, group-based access and reduced long-lived credential exposure
TLS hardening
Deprecated protocols removed on load balancers, stronger cipher posture and HSTS enabled
WAF tuning
Targeted Cloud Armor exclusions and policy refinement that cut false positives while preserving protection
Security as Code
Terraform/OpenTofu and CI/CD rollout for repeatable controls in DEV and PROD
Operational maturity
Incident runbooks, troubleshooting guides, RCA support and on-call readiness

What I Bring to a Team

End-to-end platform ownership

From Terraform and GitOps to on-call, RCA and runbooks — one person who knows the whole stack

Security by design

Least-privilege IAM, Workload Identity, policy-as-code, WAF and network segmentation built in from day one

Production-proven at scale

Multi-region active-active GKE, 12,000+ req/s peaks, independently DDoS-tested

Root-cause debugging

Identified a hidden bottleneck and cut request latency from 500ms to 24ms (20× faster)

FinOps with SLOs intact

Cut cloud spend by 40% in a cross-cloud review (GCP, AWS, Azure) — right-sizing, autoscaling, storage tiering, commitment planning

Enablement, not gatekeeping

Internal Google Cloud training for 150+ engineers, docs and guides teams actually use

Clear communication

Works across product, security and ops teams; documents decisions so they survive handovers

Multi-cloud pragmatism

GCP-first, with production AWS and Azure experience where the business needs it

Focus Areas

Legacy-to-cloud migration and modernization

Moving legacy and on-prem systems to GCP, AWS, or Azure with a risk-controlled, phased plan — containerization, re-platforming, and Infrastructure as Code — with zero-downtime cutover and measurable cost and reliability gains.

Cloud architecture and platform strategy

Designing GCP-first platforms that scale, stay reliable and meet security and compliance requirements — from landing zone to multi-region GKE.

FinOps and cloud cost governance

Cross-cloud cost reviews — right-sizing, autoscaling, storage tiering, commitment planning, billing export and showback — that cut spend (40% in the last review) without trading away SLOs.

Security-focused code review and team mentoring

Improving code quality, secure-by-design practices, and delivery reliability via standards, automation, and CI/CD hygiene.