Featured Projects

Authored a 63K-line Rust desktop application (Tauri): an offline-first sync engine with a hybrid logical clock, and a versioned AEAD envelope designed on audited primitives (AES-256-GCM, HKDF, Argon2id, HPKE). Owns the signed, notarized four-target release pipeline. 769 tests.

Built a repo-local multi-agent audit harness that fans out read-only reviewers, then forces an adversarial verify pass on every finding. One run distilled 204 raw findings to 44 real ones. The same method reviews production infrastructure-as-code before it applies, catching real defects pre-deploy.

Rebuilt domain-controller monitoring for a hybrid Windows estate from blind service pings to real Windows Event Log alerting, redesigning Data Collection Rules across AD DS, DFS Replication, DNS Server, and Kerberos/NTLM/LDAP security events routed to a dedicated security action group. Proved the pipeline on a live Sev0 incident, root-causing a DNS Server failure across two domain controllers to resolution in 48 minutes with zero false-positive noise, then canary-tested the same pattern against 39,000 live security events before porting it to a second tenant.

Designed, built, and personally verified a closed-loop MLOps platform end to end: ingest, classify, compute, ledger, monitor, retrain, backed by 900+ tests at 95% coverage. Its centerpiece is a five-independent-budget promotion gate spanning quality, slice, latency, cost, and calibration that blocked a challenger model with a better quality score outright because its unit cost ran 3.4x the champion cost against a pre-declared ceiling. Backed by a hash-chained, append-only ledger where corrections are recorded as restatements, on a Terraform/Terragrunt-managed Azure estate with a CI validator that fails the build if documentation claims outrun their own evidence.

Built a native macOS security scanner solo over one weekend: a Go engine paired with a SwiftUI client, architected around real privilege separation, an unprivileged daemon owns the only database and serves JSON-RPC over a Unix socket, while a minimal root helper is the only component allowed to touch raw sockets. Relies on FileVault for at-rest encryption instead of adding a database-level cipher, and a monotonic, saturating risk-score design instead of a naive average. An end-to-end scan against a real target returned working findings and a computed risk score, retrieved purely over the API.

A freshly provisioned production VM domain-joined cleanly in a lower environment but failed in production with a bare transport error. Rather than requesting box access, pulled effective routes and ran in-guest port probes remotely, proving the firewall passed LDAP but silently dropped Kerberos, RPC, and SMB. Handed the network team a precise, actionable ticket instead of a vague failure report, and had the VM fully joined within days.

Led complete replacement of legacy monitoring platform for 500+ VMs across hybrid infrastructure. Implemented 31 alert rules, 5 Data Collection Rule types, and 8 team-specific Action Groups, all via Bicep IaC. Achieved real-world validated alerting with automated resolution and zero false negatives.

Leading phased migration of 8 GCP projects across organizational tenants for a global advertising & media holding. Scoping secure-tenant onboarding with strict policy compliance, IAM hardening (auditing 99+ service accounts), standardized CI/CD pipeline design, cost governance, and naming convention enforcement, while preserving development team deployment autonomy and rapid release cycles.

Leading end-to-end migration of revenue-critical applications between Azure tenants with zero-downtime requirements. Standardizing IaC with Terraform/Terragrunt, implementing OIDC/Workload Identity authentication, and establishing unified naming conventions and security policies across global deployments.

Onboarded 500+ hybrid VMs (SLES, RHEL, Windows) to Azure Arc across production and non-production environments. Deployed Azure Monitor Agent with Data Collection Rules, VM Insights integration, and resource group segmentation by region. Established repeatable onboarding scripts and validation procedures for enterprise-scale hybrid governance.

Led enterprise-scale migration of 1500+ users from on-premises to Azure hybrid infrastructure. Implemented phased migration approach with automated PowerShell scripts, achieving seamless transition with zero downtime and improved operational efficiency through optimized resource allocation.

Built multi-cloud FinOps platform achieving 25% cost reduction across AWS, Azure, and GCP. Implemented unified cost monitoring, automated optimization recommendations, and ML-based forecasting, significantly improving cost visibility and resource efficiency.

Architected enterprise-scale migration of 22+ repositories from legacy CI/CD (Jenkins/Bitbucket) to GitLab CI. Built an enterprise-grade modular pipeline framework with multi-stage build/test/coverage/deploy, security gates, health checks, retry policies, and manual deployment controls. Achieved 100% test coverage and seamless multi-environment progression.

Implemented Azure OpenAI integration with Commercetools platform, enabling natural language interaction with products through a chat interface. Enhanced user experience for non-technical users accessing product information, pricing, and other data without navigating complex interfaces.

Implemented comprehensive Azure OpenAI DevOps integration platform for Bosch, featuring automated AI model deployment pipelines, advanced KQL monitoring dashboards, and cost optimization strategies. Reduced AI model deployment time by 60% and improved resource efficiency by 25% through intelligent automation.

Serving as DevOps point of contact across multiple enterprise engagements, coordinating between product, TechOps, cloud engineering, and security teams to align migration timelines, define ownership boundaries, and unblock cross-functional dependencies. Managing stakeholder communication, technical decision-making, and delivery alignment across 5+ concurrent workstreams in FinTech, AdTech, and manufacturing domains.

Production monitoring silently dropped to 22 of 246 VMs after a change broke Microsoft-managed VM Insights bindings. Detected it within 24 hours, remediated via Azure Policy within 48, and wrote the immutability rule into the runbooks so the same class of failure could not recur.

About $30 a day in wasted log ingestion: information-level noise from 200+ servers, all billed and never read. Redesigned the Data Collection Rules to filter at the source and restrict AD / DNS / DFS logs to the domain controllers, eliminating redundant ingestion across the fleet.

The entire Azure monitoring stack (data collection rules, alert rules, action groups) packaged as seven reusable Bicep modules and deployed with a single command. Reproducible, reviewable, and portable across subscriptions and tenants.

Implemented comprehensive DevSecOps solutions integrated into CI/CD pipelines, including SonarQube, Trivy, and RBAC. Enhanced security and compliance across Azure and AWS environments with detailed documentation and implementation guides.

Designed and implemented enterprise secrets management strategy, migrating credentials from CI/CD variables to Azure Key Vault with UAMI-based authentication. Analyzed 55+ pipeline variables, identified and removed 30 unused entries, and established a reusable pattern for all future service migrations.

Implemented automated cost anomaly detection across 62 Azure subscriptions. Built automation runbooks with auto-expiration policies, daily scheduling, and multi-team notification routing. Enabled proactive cost governance for enterprise-scale cloud environments.

Designed and deployed Azure Policy-driven health check automation across 26 App Service resources with zero downtime. Implemented phased rollout strategy with validation at each stage, achieving 100% successful configuration across production workloads and establishing a repeatable pattern for future resources.

Deployed a Proxmox-based virtual data center, managing virtual machines and ensuring high reliability with regular backups. This setup guarantees performance and security for all services.

Implemented comprehensive virtualization automation platform with Terraform IaC, achieving 99.5% uptime. Created self-service portal reducing VM provisioning from 2-3 hours to 10-15 minutes, optimized resource utilization by 25%, and improved infrastructure efficiency through intelligent automation.

Automated MikroTik network infrastructure using Terraform and Python, achieving 99.5% network uptime. Reduced configuration time from 2-3 hours to 15-20 minutes per device, significantly reduced manual errors, and enabled scaling from 5 to 25+ network devices through standardized automation.

Designed and implemented secure Azure infrastructure using Infrastructure as Code principles. Configured networking, security groups, and automated deployments. Achieved 99.9% uptime and reduced deployment time by 70%.

Built CI/CD pipelines for Bosch's e-commerce platform using Jenkins and Azure DevOps, integrated automated testing, and accelerated microservices deployments with Commercetools.

Built automated backup solution for Commercetools using Azure Logic Apps, featuring scheduled backups, data validation, and recovery, ensuring reliability and rapid restoration.

Implemented Azure API Management to reduce time and costs. By Infrastructure as Code, optimizing performance, reducing costs, and achieving scalable deployments.

Optimized microservices deployments using MACH Composer and GitHub Actions, enabling reusable workflows, environment-specific configs, and automated testing for faster, error-free releases.

Migrated e-commerce platform to Google Kubernetes Engine, implementing microservices, automated scaling, and monitoring. Reduced response times, enhanced reliability, and lowered infrastructure costs.

Built Kubernetes infrastructure on Google Cloud Platform, including autoscaling clusters, pod security policies, load balancing, and integrated Cloud Monitoring for enhanced observability.

Architected secure cloud infrastructure using Terraform, implementing VPCs, Security Groups, and automated DNS management. Presented solutions to 500+ attendees at EPAM conference.

Implemented comprehensive monitoring solution using Prometheus and Grafana, reducing incident response time by 60%. Managed infrastructure serving 100+ users with 99.9% system uptime. Integrated alerting and automated response systems.

Built proactive monitoring platform with automated daily reporting via Azure Logic Apps. Implemented KQL-driven analytics covering 100+ production disks with Windows/Linux split reporting, email automation, and threshold-based alerting. Enabled teams to act before incidents occur.

Implemented centralized artifact management by migrating NuGet packages, deployment artifacts, and database DACPACs to GitLab Package Registry. Configured deploy token authentication, CI_JOB_TOKEN integration, and PowerShell-based artifact retrieval, eliminating scattered package sources and reducing dependency management overhead across multiple services.

Implemented seamless repository synchronization between BitBucket and GitLab, enabling efficient cross-team collaboration, real-time code consistency, and simplified access management.

Optimized Git workflows across multiple teams, implementing efficient branching strategies and repository mirroring. Achieved 40% faster collaboration and 60% storage reduction through advanced Git LFS implementation.

Developed a unified tool to automate import jobs across multiple environments. Improved operational efficiency by simplifying complex processes, reducing time from 15-20 minutes to 1-2 minutes per import. Leveraged Azure Automation for secure execution with proper error handling.

Developed automated tool for release branch management, enabling efficient identification and locking of release/hotfix branches across repositories. Implemented comprehensive reporting system and standardized release workflow, ensuring code stability during production rollouts.

Developed a Python tool for identifying unused API clients across multiple Commercetools projects, reducing security risks and improving client lifecycle management. Automated previously manual audit processes, cutting analysis time from hours to minutes and providing comprehensive reports.

Created a user-friendly web application for accessing AKS cluster logs, enabling support teams to quickly access and analyze logs without Azure Log Analytics knowledge. Reduced log access time from 5-10 minutes to 30-60 seconds and introduced one-click log downloading.

Successfully migrated 50+ AWS Lambda functions to Python 3.11, implemented security assessments, automated testing, and presented expertise at AWS Weeks 2024 events.

Led technical team growth from 5 to 15+ engineers, establishing comprehensive mentoring programs and competency frameworks. Reduced onboarding time from 4 months to 8 weeks, achieved 85% retention rate, and increased team productivity by 35% through structured leadership development.

Recovered live cloud service-principal credentials from a legacy CI system's internal encrypted secret store, which had no documented plaintext copy anywhere. Extracted the master key and encrypted secret files directly from the running container, then wrote a from-scratch Python implementation of the platform's proprietary two-layer AES scheme to recover the plaintext. Verified the result by authenticating against the cloud identity provider's live OAuth2 endpoint rather than trusting the decryption output on its own.

Built a self-contained capture-the-flag backend for an internal AWS security training exercise: Terraform provisions a fresh, scoped IAM user per scenario, a bot handles player login and status checks, and a templated mailer sends each participant their own credentials. A DynamoDB-backed, S3-hosted leaderboard updates live as scenarios are solved, with infrastructure, bot, and scoring wired together end to end.

Root-caused an intermittent federated sign-in failure on cloud-hosted virtual desktops to a specific protocol-level error at the session-host logon stage, distinct from the gateway and MFA leg everyone initially suspected. The investigation spanned eight months across three separate ticketing systems, along the way catching a phishing-simulation email mistaken for a real incident and identifying a single orphaned virtual desktop that was silently holding capacity behind a stale pool metric, reclaimed only after confirming no live owner would be affected. Separately designed and executed a zero-downtime cutover to a dedicated static egress IP, sequencing the allow-list before the attach to avoid any access gap; a related vCPU quota increase for the desktop pool was filed and closed by a different engineer, not him.

During an evening production deploy under time pressure, disabled delete protection to force a Terraform resource recreation and applied the change without redeploying the dependent service afterward. The recreated resource regenerated its service credentials, and the dependent service kept authenticating with the stale ones until alerting caught the failed requests within minutes. Identified the root cause as his own change, not a coincidence, diagnosed it to the underlying mechanism rather than the symptom, and fixed the process so the same failure class could not recur.

Held a three-instance production Jenkins estate alone for a full week, diagnosing a "VM unreachable" alert as a network allow-list miss rather than an outage via a full DNS/ICMP/TCP/SSH probe matrix, and bisecting an expired SSH key silently blocking two engineers' builds down to its exact expiry window from build history alone. Weeks later, correctly distinguished a second, superficially identical credential failure as a different root cause, and documented plainly what was and wasn't fixable on that side.

Built and unit-tested a token-based RBAC permission evaluation tool after discovering that a cloud portal's displayed permissions and a live access token can legitimately disagree about effective access, modeling nine real Azure role shapes including PIM-eligible versus PIM-activated. While building it, caught two scripting bugs in the underlying query logic, one of which scored roles wrong in the unsafe direction ahead of a planned 76-resource production write. Caught and fixed before the write executed, turning a routine access-review script into a verified safety gate.

Diagnosed a documented Azure scaling anti-pattern on a live production App Service plan: scaling out on CPU-or-memory but scaling in on CPU-only, letting sustained memory pressure permanently block scale-in on a plan that had flapped over 2,000 times in a week. Designed a symmetric four-rule fix and deployed it across 76 non-production plans spanning 22 subscriptions with zero deployment failures, verifying every setting by re-reading it back from Azure. Presented the change alone at a Change Advisory Board after discovering an undocumented approval gate mid-week.

Designed and rolled out policy-as-code remediation for Key Vault purge protection across two affiliated Azure tenants, treating the control's irreversibility as the central design constraint. An 8-round adversarial review caught a naive full-resource replace that would have silently dropped a property from every live policy assignment. Rehearsed the full audit-to-enforce-to-rollback lifecycle on an isolated subscription first, then self-audited the finished rollout and corrected his own coverage figure before anyone else caught it.

Designed and shipped four reusable Bicep modules automating IP address management via Azure Virtual Network Manager, replacing manual CIDR allocation with policy-driven automatic subnet assignment. Verified the deployment end to end in an isolated subscription before merge: a clean sub-2-minute run auto-assigned address blocks to a VNet and all three subnets, with a legacy VNet deploying from the same module in the same run with zero regression.

Migrated pipeline authentication from long-lived service-principal secrets to federated Workload Identity, with no flag-day. Verified the credentials being retired still worked before removal, and shipped a backward-compatible rollout so each service moved on its own schedule. Zero secrets left in the pipeline.

Four Logic Apps migrating across two tenants on the same morning; two failed with a Graph 404. A 20-agent, 3-round investigation traced it to an OIDC domain-ownership change after an acquisition, verified independently against the live tenant. Clean same-day rollback and a decision framed for the architect.

A production service behind a CDN edge returned HTTP 200 but HTTPS 503. Isolated the fault to the edge with layered curl / dig / openssl probes, proved TLS terminated cleanly client-to-edge, and located the real fault at the origin gateway's 443 listener. Disabled the check on one resource first, so the fix could not bounce a live app.

Took live ownership of an undocumented, business-critical SQL transactional-replication flow (Managed Instance to Azure SQL) after the owning team rolled off. Built a recovery ladder runnable under pressure, onboarded a new enterprise client, and left the runbook the prior team never wrote. New client came up at 00:00:00 latency.

A production deploy pipeline had no dry-run, so green runs were the only signal. Built a what-if twin that validates against real subscriptions with the same identity that deploys. It caught a defect a green run had hidden: a tag re-write on an existing resource group that violated a touch-nothing constraint.

A GitHub Actions system that plans by default, gates apply behind two separate confirmations, arms its own budget alarms, and tears everything back down to zero with an audited teardown. About $0.15 per cycle. Lets a small team rehearse real infrastructure end-to-end without waiting on anyone.

Implemented comprehensive DevSecOps pipeline with 10+ security tools integration, achieving significant vulnerability reduction. Automated security compliance for SOC 2, PCI DSS, improved incident response time by 75%, and established proactive security monitoring across multi-cloud infrastructure.

Solo-built and rebuilt four times over 18 months, ending in a full architectural reset onto Next.js, PostgreSQL, and Prisma completed in three days. Implements a working spaced-repetition algorithm and an event-sourced XP and streak engine with an append-only transaction log, backed by nearly 1,200 seeded questions and 320+ passing tests. Infrastructure runs on Terraform-provisioned Azure with a destroy workflow that backs up the database before tearing infrastructure down; an earlier self-hosted iteration on a personal Proxmox server surfaced and fixed a MongoDB/CPU-instruction-set incompatibility.

Built and operates the full content pipeline behind a 118-video public catalog: headless-browser frame capture at 12fps, an FFmpeg assembly stage with broadcast-standard loudness normalization, and single-request text-to-speech generation to preserve natural prosody across a monologue. A separate catalog-management layer pulls the channel's own published videos back down, runs a deduplication pass across the full catalog, and uses a multi-agent fan-out pass to match each shipped video back to the project it was built from. Applies the same audit discipline across his content-production practice as on infrastructure work: a documented post-mortem after an early failed render on a sister pipeline, and an explicit budget cap on a later series that landed spend at exactly the target figure.

Configured Nginx for domain connection and SSL, enhancing web service security and efficiency. Adjusted server blocks for improved performance, installing SSL for encrypted data transfer.

Set up Jenkins for automated workflows and CI, customizing pipelines and integrating with version control systems. This enhanced development efficiency, speed, and consistency.

Created an infrastructure using Docker-compose, connecting a WordPress site with a MySQL database. Configured the WordPress server on port 8080 and set up MySQL for effective site interaction.

Deployed Jira for project management, customizing it with automated scripts for task tracking, sprint planning, and team workflows, thus boosting productivity and aligning with agile methods.

Developed a two-player chess game with React, integrating classic rules into a dynamic interface. Efficiently managed game state for enhanced strategic gameplay.

Developed a specialized CRM system for Pharmbiotest, enhancing service tracking, client database management, and loyalty programs. Optimized for improved client engagement and streamlined service delivery with advanced database tools.

Developed the Foxtar Store, a comprehensive online retail platform with user-friendly design. Incorporated e-commerce features like product listings and shopping cart for a complete shopping experience.

Developed a React application simulating an e-commerce experience with FakeStoreAPI. Features include browsing products, adding to cart, and understanding API integration.

Designed a web app for searching GitHub repositories, enabling users to search, view details, and save favorite repositories. Utilizes GitHub's API for real-time data retrieval.

Built an interactive calculator using Vue.js, featuring undo and redo functions. This project showcases Vue.js's capabilities in reactivity and state management.

Crafted an adaptive landing page using HTML and CSS, focusing on responsive design. Employed advanced CSS for flexibility across devices, ensuring a seamless user experience.