Cloud Architect & Infrastructure Leader — the complete record: eighteen years of roles, the systems built along the way, credentials, and the full technical inventory.
Last updated August 2026Cloud Architect with 18+ years of progressive IT and infrastructure experience, currently the sole cloud architect at a financial services firm — owning the full Azure and AWS footprint end to end: architecture, governance, security, cost, and day-to-day operations.
My work spans all three major clouds. I design and operate enterprise-grade multi-cloud environments across AWS, Azure, and GCP, bridging architecture, DevOps, security, and IT operations. That includes greenfield Azure landing zones built from nothing, production Kubernetes clusters on EKS, AKS, and GKE, and Terraform module frameworks that make deployments repeatable and audit-ready.
The path here ran through the whole stack. I started in technical support, where I learned the Windows, Linux, networking, and database fundamentals that still inform my architecture decisions. From there came infrastructure engineering — thousands of VMs across VMware vCenter and Hyper-V/SCVMM, HPE Synergy composable infrastructure, SAN storage administration, and PowerShell automation that cut VM deployment times by 70%. Then DevOps and platform work, and now architecture.
The through-line: I've been the person paged at 3am for every layer of the stack. That shapes how I design — a bias for simple, boring, reversible systems that don't wake anyone up.
Six areas where I've shipped production systems — not just certifications, but running environments with real users, real budgets, and real 3am pages.
Multi-cloud architecture across AWS, Azure, and GCP — landing zones, account and subscription hierarchies, network topology, and managed Kubernetes running production workloads on all three providers.
Terraform-first and module-driven, with Pulumi and Kustomize where they fit better. Everything reproducible; nothing clicked into a console. GitOps-style promotion across environments.
Pipelines for building, testing, and deploying both infrastructure and applications. GitHub Enterprise administration at the org level — policies, SAML enforcement, branch protections, access governance. Docker and Helm for portable runtime.
Entra ID, Okta, and Azure Policy for governance. Least-privilege RBAC, secret management via Key Vault, and conditional access rolled out to workforces that had to keep working through the change.
Thousands of VMs across VMware vCenter and Hyper-V/SCVMM. HPE Synergy composable infrastructure, Nimble all-flash SAN, Commvault backup across multiple sites — the layer under the cloud that still runs the business.
BGP peering, site-to-site VPN, DNS/DHCP, VLAN segmentation. MSSQL and PostgreSQL administration — including the migrations, the availability groups, and the awkward point-in-time restores.
Every role since 2007, at full detail — including the earlier support and infrastructure years that the one-page resume has to compress.
Personal and professional projects outside the day job — infrastructure, applications, and systems work, each one running or shipped rather than sketched.
The infrastructure serving this site. Four reusable Terraform modules provision two S3 origins (portfolio and resume) behind separate CloudFront distributions with Origin Access Control, a single wildcard ACM certificate with DNS validation, a CloudFront Function for clean-URL rewriting, and Route 53 A/AAAA alias records for apex, www, and subdomain. Deployment runs through GitHub Actions with OIDC federation — no long-lived AWS keys — and path-filtered jobs so only the changed site syncs and invalidates.
View sourceA production-flavored example of a containerized FastAPI service on AWS App Runner with least-privilege S3 access. Terraform provisions the ECR repository, a private SSE-S3 encrypted bucket with 30-day lifecycle expiration, and an IAM instance role assumed via tasks.apprunner.amazonaws.com — scoped to exactly one bucket. Includes health checks and environment configuration.
Terraform skeleton and helper tooling for standing up an AWS Organization with an OU and account layout suitable for bootstrapping Control Tower — the multi-account landing-zone problem, solved from code rather than the console.
A live commercial cleaning business site (cleanabit.com) plus an installable invoice and proposal PWA on its own subdomain (app.cleanabit.com). The app is a single-page tool with a service worker for offline support, a PWA manifest for Android install, localStorage persistence, the Web Share API for sending documents, and a dedicated print stylesheet. Both properties are static assets on S3 behind CloudFront, provisioned by Terraform.
An ongoing set of working reference implementations across providers and tools: AKS on Azure and Elastic Beanstalk on AWS in Terraform, WordPress on Azure, EKS and general AWS provisioning in Pulumi across TypeScript, Python, and C#, and Ansible playbooks for home-lab configuration management. Deliberately spread across stacks — the point is comparing how each tool models the same problems.
A browser-based administration interface for Dovecot/Postfix mail servers, built with FastAPI, HTMX, and Tailwind. Handles mail user administration, queue inspection and control (flush, delete, hold, release), multi-service log analysis, IP blocking via UFW with a CIDR allowlist, disk and per-mailbox capacity tracking, and threshold-based alerting with email/webhook delivery and cooldown enforcement. Security-hardened by design: an unprivileged web process communicates with a root-level helper daemon over a Unix socket, with strict input validation and command allowlisting rather than shell interpolation.
View sourceA self-hosted network monitoring dashboard — FastAPI backend, React frontend, packaged as a single Docker container. Monitors HTTP, HTTPS, and TCP services with live updates, seven-day uptime history, incident tracking, and webhook alerting. A multi-architecture image (linux/amd64 and linux/arm64) is published to the GitHub Container Registry on every push, so it runs unchanged on x86 servers, Raspberry Pi, and Apple Silicon with no build toolchain on the host.
A privacy-first, self-hosted platform for managing properties, assets, vehicles, and maintenance schedules. Next.js 15 and React on the front, tRPC for end-to-end type safety, PostgreSQL with PostGIS for spatial data, Redis and BullMQ for the job queue, and MinIO for object storage. Features include an AES-256 encrypted document vault, SVG floor plans and Leaflet yard maps, NWS/OpenWeatherMap freeze alerts, irrigation controller integrations, multi-user households with role-based access, and SMS/Slack/Discord notifications with quiet hours. Runs on Docker Compose behind Traefik with automatic SSL.
A Windows desktop application that consolidates per-user Immich sync shares into a single canonical family archive, deduplicating by content rather than by timestamp. Because Immich rewrites mtimes, sync state is a SQLite content-hash manifest — size prefilter, then SHA-256 — plus a per-user ledger, never a "last copied" watermark. Files are classified as new, duplicate, or conflict (surfaced for human review); placement is driven by EXIF DateTimeOriginal with folder and mtime fallbacks, and Live Photo pairs move as an atomic unit. Every copy runs as temp write → hash verify → atomic rename → journal, so a failed run halts cleanly and resumes, and any run can be undone with per-file hash verification. Source shares are opened read-only. Split into a UI-free core library and a WPF MVVM app, with an xUnit suite including an end-to-end scenario test.
Working implementations of six AI agent protocols — Model Context Protocol (MCP) for tool and data connectivity, Agent-to-Agent (A2A) for discovery and inter-agent communication, AG-UI for SSE streaming of agent events to frontends, and three more — each as a self-contained runnable module. Built as a hands-on study of how the emerging agent interoperability stack actually fits together.
Ongoing hands-on evaluation of self-hosted and local-first AI tooling: running Qwen models locally, wiring local inference into VS Code and OpenCode, and deploying and troubleshooting a self-hosted LibreChat stack. The theme is the same as the rest of the home lab — understand the operational reality of a technology by running it yourself.
The complete technology index, by category — everything above, flattened for scanning and keyword search.