Cloud, DevOps & infrastructure
How I think about cloud architecture, platform teams, and DevOps in regulated, high-growth environments.
Pillars
Multi-cloud landing zones
Account/subscription structure, SCPs, paved roads, and the boring guardrails that pass audits cheaply.
CI/CD & GitOps
Pipelines as product, signed builds, progressive delivery, and rollback you can trust at 2am.
Platform engineering
Internal platforms run like real products — roadmap, NPS, paved roads, tiered support.
DevSecOps
Shift-left controls that don't slow shipping: SAST, SBOMs, secret scanning, policy-as-code.
Reliability & SRE
SLOs that match revenue, error budgets engineers actually respect, on-call you can sustain.
FinOps & cost
Tagging that holds up, unit economics per workload, rightsizing as a recurring practice.
Reference stack
- AWS (primary)
- Azure
- EKS / Kubernetes
- ECS Fargate
- Lambda
- GitHub Actions
- ArgoCD
- Terraform
- Helm
- OpenTofu
- Datadog
- OpenTelemetry
- Grafana
- PagerDuty
- Sentry
- Wiz
- Snyk
- OPA / Gatekeeper
- Vault
- AWS Security Hub
Related writing
All cloud & DevOps postsAWS Cost Levers That Actually Moved the Needle
Cutting ~35% off a multi-region AWS footprint with no capability loss — the levers in the order they paid back, best first.
Security and DevOps Under One Roof: Why I Stopped Apologizing for It
The case for the dual mandate, and why org-chart distance doesn't create security.
Pick the Model Like You Size a Cluster, Not Like You Pick a Sports Team
Most teams pick a frontier model like a sports team and never revisit it — but model selection is a routing, capacity, and risk decision you already know how to make.
Design Your AI Inference Like the Model Could Vanish Tomorrow, Because One Just Did
A frontier model went dark three days after launch; here's how I make AI inference survivable on AWS when the provider is a dependency you don't control.
The Eight-Domain Azure Security Review for Regulated Environments
An automated tool scores your Azure posture; an assessor walks your architecture. The eight domains I review, in the order an audit walks them, and the evidence each one has to produce.
Cloud FinOps for the Mid-Market: Where 25–40% of Spend Actually Hides
The press-release version of cloud savings cancels workloads and books compliance debt. The version that lasts is commitment management and SaaS rationalization.
Building or rebuilding a cloud platform?
I advise fintech and regulated SaaS teams on cloud architecture, DevOps maturity, and platform engineering.
