$ whoami
$ cat role.txt
Senior DevOps Engineer building secure, cost-efficient cloud platforms across AWS, Azure, and GCP._
Senior DevOps Engineer with 8+ years designing, securing, and operating cloud-native infrastructure across AWS, Azure, and GCP for fintech, SaaS, e-commerce, healthcare, and AI-driven platforms. Deep hands-on expertise in Kubernetes (EKS/AKS/GKE), Terraform-driven infrastructure as code, and end-to-end CI/CD pipeline design with Jenkins, GitHub Actions, AWS CodePipeline, and ArgoCD. Strong DevSecOps focus — integrating SIEM, vulnerability management, penetration-testing workflows, and secrets management into pipelines aligned with PCI-DSS, SOC2, HIPAA, and ISO 27001. Experienced across cloud and on-premises (VMware vSphere/ESXi) environments, building highly available, observable, cost-optimized systems for both monolithic and microservices workloads.
A short personal introduction covering my background, the kind of infrastructure problems I like solving, and how I work with teams — recorded for Toptal.
Multi-region failover, event-driven autoscaling, landing zones, security gates and cost guardrails. Each project is labeled by where it comes from and what code is published.
01
Active/passive EKS across two regions with a managed promotion path
A warm-standby disaster recovery design for a stateful Kubernetes workload: two regional EKS clusters, an Aurora PostgreSQL Global Database, replicated object storage and an explicit, runbook-driven failover.
02
Queue-mode n8n with KEDA scale-to-zero workers
n8n split into main, webhook and worker workloads on Kubernetes, with Redis/Valkey as the job queue, PostgreSQL for state, and KEDA scaling workers on queue depth — including down to zero when idle.
04
Multi-account foundation with guardrails, central logging and IaC
An AWS Organizations layout with security, logging, shared-services and workload accounts, SCP guardrails, IAM Identity Center access, centralized CloudTrail and a VPC baseline — all from Terraform modules.
06
Security gates from commit to registry
A pipeline that runs secrets scanning, SAST, dependency and image scanning, DAST against a preview environment and SBOM generation, and blocks promotion on policy failures.
10
API Gateway, Lambda, SQS and EventBridge with idempotency and DLQs
An order-style event pipeline: an API that accepts requests, a queue that absorbs bursts, idempotent consumers, fan-out through EventBridge, and dead-letter queues with alarms.
11
Metrics, logs and traces with SLOs that drive alerting
Prometheus, Grafana and OpenTelemetry with SLIs defined per user journey, multi-window burn-rate alerts instead of threshold noise, and an incident process tied to error budgets.
14
Reproducible cost analysis over a billing export, plus Terraform guardrails
A local, dependency-free toolkit that reads a FOCUS-style billing export and produces cost allocation, rightsizing and Graviton candidates, Savings Plans sizing, a budget gate and a forecast — with Terraform for AWS Budgets and anomaly detection.
19
Test before traffic, shift gradually, roll back on alarms
Multi-environment ECS Fargate services on Graviton deployed with CodeDeploy blue/green: new tasks are smoke-tested on a test listener before any user traffic, traffic shifts all-at-once in dev, linearly in staging and by canary in production, and alarms on error rate or latency roll back automatically.
20
No secrets in images, env vars or etcd — mounted files that rotate live
Applications on EKS read credentials from AWS Secrets Manager as read-only mounted files through the Secrets Store CSI Driver, authenticated with EKS Pod Identity and an IAM role that can read exactly two secrets. Rotated values are picked up without a restart, and CI scans for secrets that slipped into manifests or code.
I work with startups and engineering teams as a hands-on DevOps partner, from a one-time architecture review to owning your infrastructure end-to-end. Here's what that typically looks like.
Let's talk about your infrastructure
Multi-account landing zones, VPC topology, and IAM governance across AWS, Azure, and GCP, designed for security and scale from day one.
Production-grade EKS/AKS/GKE clusters with Helm, autoscaling, and GitOps-driven deployments for monolithic and microservices workloads.
End-to-end pipelines with GitHub Actions, Jenkins, and ArgoCD for fast, repeatable, drift-free releases from commit to production.
Security gates built into every pipeline: SAST/SCA, secrets management, and controls aligned with PCI-DSS, SOC2, and HIPAA.
Full-stack monitoring, alerting, and incident response with Prometheus, Grafana, and the ELK stack to sustain 24x7 uptime.
Rightsizing, autoscaling, and infrastructure-as-code discipline that cuts cloud spend without cutting reliability.
I combine hands-on engineering with architecture and consulting, translating business requirements into secure, scalable cloud solutions for fintech, SaaS, e-commerce, and AI-driven platforms.
Designing VPC topologies, network segmentation, and IAM governance across AWS, Azure, and GCP for secure, scalable multi-account environments.
Standardizing Helm-based deployments and ArgoCD-driven GitOps workflows across EKS, AKS, and GKE for consistent, drift-free releases.
Embedding SAST/SCA, container scanning, and secrets management into CI/CD pipelines aligned with PCI-DSS, SOC2, and HIPAA.
Building observable, highly available systems with Prometheus/Grafana and driving FinOps initiatives to sustain 24x7 uptime at lower spend.
A cross-cloud toolkit spanning infrastructure, containers, security, and observability, built over 8+ years operating production systems.
EC2, EKS, ECS, Fargate, Lambda, S3, RDS/Aurora, VPC, Transit Gateway, IAM, CloudFront, Route 53, CloudWatch, SQS, SNS, Secrets Manager, SES, API Gateway, CodeBuild, CodeDeploy, CodePipeline, ECR, ElastiCache
VMs, AKS, App Service, Azure DevOps, Azure AD, Blob Storage, Key Vault
GKE, Compute Engine, Cloud Build, Cloud Run, Cloud SQL, Secret Manager, Pub/Sub, IAM
DockerKubernetes
HelmTerraform
Ansible
Jenkins
GitHub Actions
GitLab CIArgoCD
SonarQube
SnykOWASP ZAP
PrometheusGrafana
Amazon CloudWatch
ELK Stack
Datadog
Python
Bash
n8n
OpenVPN
WireGuard
Tailscale
pfSense
MySQL
MongoDB
PostgreSQL
Redis
VMware vSphere / ESXi
Linux
Windows Server
Java
Node.jsPython
PHP
GitHubGitLab
BitbucketNine years across fintech, SaaS, advertising, and ERP platforms, moving from foundational AWS environments to multi-cloud, multi-region production systems.
Architect and operate multi-cloud infrastructure (AWS, GCP) across a diverse portfolio of production platforms — fintech SaaS, social media, e-commerce, and AI-driven applications — owning DevOps strategy end-to-end from network design through observability and security.
Owned DevOps, infrastructure architecture, and security operations for two production fintech applications (OneLoad, OneZapp) on hybrid AWS and on-premises infrastructure with 24x7x365 availability requirements.
Delivered DevOps and infrastructure support across AWS cloud and on-premises VMware vSphere environments, managing ERP, CRM, and client-facing web applications.
Supported infrastructure and DevOps operations for a digital advertising platform (Pinpoint), administering AWS and Linux/Windows server environments for high-availability production workloads.
Riphah International University, Lahore
COMSATS Institute of Information Technology, Sahiwal
Designs and runs the platform software is delivered on: cloud accounts and networks, Kubernetes, infrastructure as code, CI/CD, observability and security controls. The senior part is judgement — choosing designs that are secure, recoverable and affordable, and making them repeatable so teams ship safely without waiting on infrastructure.
Spread every tier across at least two Availability Zones, keep compute stateless behind a load balancer, use managed multi-AZ data stores, and alarm on user-facing symptoms. Then decide explicitly how much regional failure you need to survive — multi-AZ covers most outages; multi-region is a cost and complexity decision driven by RTO and RPO.
Landing zone with isolated environments →Run a warm-standby cluster in a second region from the same Terraform modules, replicate data (for example Aurora Global Database and S3 replication), and fail over with a runbook: fence the old primary first, promote the database, scale up the standby, then shift DNS. Guard against split-brain and duplicate processing, and rehearse it in game days.
Multi-region EKS DR with a failover orchestrator →All three run upstream Kubernetes; the differences are in the platform around it — how pods get cloud identity (EKS Pod Identity or IRSA, Entra Workload ID, GKE Workload Identity), networking modes, ingress controllers, upgrade cadence, logging integration and control-plane pricing. Workloads packaged as containers and Helm charts move between them; identity, networking and data do not.
Multi-cloud Kubernetes comparison →KEDA watches an event source such as a queue length, activates a deployment from zero to one replica when work appears, and hands scaling between one and the maximum to a standard Horizontal Pod Autoscaler using that metric. After a cooldown with no work, it scales back to zero — useful for queue workers that are idle much of the day.
n8n workers scaled by queue depth →Keep secrets out of code and state, check plans with policy as code before merge, give CI short-lived OIDC credentials instead of stored keys, pin and scan everything that runs (actions, images, dependencies), and run workloads as non-root with read-only filesystems, network policies and least-privilege workload identity.
DevSecOps supply-chain pipeline →Open to senior DevOps, cloud infrastructure, and DevSecOps roles. Reach out directly or connect on LinkedIn.