Summary
AWS-certified cloud engineer who owns infrastructure end to end — architecture, migration, security, monitoring, incident response, and cost. Sole technical owner of an institutional web platform, where I cut AWS spend ~35% while adding threat detection and alerting, and migrated a production WordPress multisite with ~10 seconds of user-facing downtime. Also run a consulting practice building and operating serverless products across six AWS accounts.
Experience
- Architect and operate AWS across 6 accounts for 5 client organizations: ~90 Lambda functions, 23 CloudFront distributions, ~40 S3 buckets, 26 DynamoDB tables, RDS PostgreSQL 17, and 4 Cognito user pools, with per-account budgets and governance (CloudTrail, GuardDuty, Secrets Manager).
- Built a multi-tenant client portal and agency CRM (SST v3, Next.js, RDS PostgreSQL 17, ~31,000 LOC): Stripe invoicing with webhook settlement, MediaConvert transcoding wired into approval flows, an Amazon Bedrock AI concierge, and company-scoped RBAC enforced on JWT claims and server actions.
- Built CI/CD on GitHub Actions using OIDC role assumption with zero static AWS credentials, deploying via SST with automated database migrations that fail the build on error.
- Shipped a white-label file-sharing platform in ~3 weeks (SST v4 / Pulumi IaC) — Cognito with Google OAuth, chunked multipart upload proven on a 440 MB video, EventBridge media processing, tokenized share links — then productized it into one-command multi-tenant provisioning.
- Run a self-hosted automation server on Graviton EC2 (Caddy, n8n, PostgreSQL in Docker) with SSH closed in favor of SSM Session Manager, daily snapshots, and automated patch-advisory monitoring.
- Sole infrastructure engineer for the institution's web platform (~2.4M CDN requests and 5.11 TB egress monthly); consolidated the portfolio from roughly 20 properties to 8 across AWS, GoDaddy, and DigitalOcean.
- Cut AWS spend ~35% (~$220 to ~$143/month) by proving over-provisioning with 30 days of telemetry and rightsizing in a 3-minute window — while adding threat detection, tiered backups, and 20 alarms.
- Migrated a production WordPress multisite off a sunsetting Bitnami AMI to Amazon Linux 2023 with ~10 seconds of user-facing impact and no DNS change; cut homepage TTFB from 1.046s to 0.0085s and HTML payloads ~87%.
- Led response to a production traffic-abuse incident: isolated a bot issuing 162,852 requests/day, contained it reversibly at the network ACL, then shipped root-cause fixes eliminating ~8,300 daily PHP process spawns and taking ~11,600 daily errors to zero.
- Built monitoring from zero (CloudWatch agent via SSM, 20 alarms, GuardDuty, IAM Access Analyzer, operations dashboard) and decommissioned an abandoned 104-Lambda stack via archive-before-delete, reclaiming ~88 GB.
- Authored and am executing a four-property consolidation off Duda, Squarespace, Cloudflare, and Flywheel onto owned AWS infrastructure; delivered the first full cutover end to end (S3, CloudFront, ACM, Route 53, registrar transfer).
- Delivered a paid website diagnostic driving a relaunch that moved GTmetrix from D to A and cut Largest Contentful Paint from 4.7s to 665ms.
