Work Experience

Client project

DevSecOps Engineer

Normies

Jan 2026 – Present · 8 mos

Remote

• Implemented Cloudflare edge security across production APIs, reducing exposure to common web attack vectors
• Conducted penetration testing on production APIs and IDOR vulnerabilities
• Built a private Istio service mesh with AWS Private CA, ACM wildcard certificates, private NLB, and Route 53 private hosted zone, eliminating public exposure of internal service traffic — chart repos and Helm home treated as pipeline state, not something that already existed on a laptop
• Evaluated and integrated security tooling (Wazuh, MISP, Velociraptor) into the EKS stack to strengthen threat detection and incident response capability
• Implemented OpenTelemetry instrumentation for NestJS services with correlated trace/log/metric data, cutting down mean time to diagnose production issues
• Set up Checkly-based uptime monitoring for critical third-party API dependencies with credit-efficient check configurations
• Ran load and stress tests with JMeter against production-shaped paths so capacity and failure modes showed up before launch traffic
• Evaluated self-hosted vs. managed (Chainstack) Base L2 blockchain node architectures against current RPC volume, weighing OVH bare-metal hardware costs against managed service fees to inform infrastructure spend decisions
• Tracked cloud spend with AWS Budgets and Cost Anomaly Detection guardrails, spend alerts, and consistent resource tagging so cost could be attributed per service and environment
• Leveraged Karpenter for node autoscaling, optimizing compute costs against variable workload demand
• Built reusable GitHub Actions CI/CD pipelines — scan, GitOps deploy, health checks, rollback, and notifications — so services shared one deploy path instead of per-repo YAML
• Built Kubernetes infrastructure with GitOps (Argo CD and FluxCD) for consistent, repeatable deployments and faster recovery from failed releases
• Implemented EKS Pod Identity, Pod Security Admission, Vault, and External Secrets Operator (ESO) patterns to support secure, highly available multi-tenant cluster operations — IAM names namespaced per env so Terraform modules did not collide on globally unique policy names
• Designed dual-provider email infrastructure (AWS SES and Twilio SendGrid) with separate IP pools and subdomains for transactional vs. marketing traffic, protecting sender reputation and deliverability at scale
• Architected domain warmup and DKIM authentication strategy per subdomain to maintain consistent email delivery availability ahead of a large-scale launch

Client project

DevOps Engineer

ChainGPT

Mar 2025 – Present · 1 yr 6 mos

Islamabad, Pakistan · Remote

• Modernized legacy infrastructure and cut cloud spend by around $10K
• Designed the target platform in Terraform — EKS, VPC isolation (private subnets, NAT, security groups, private DNS) — migrated workloads, and carried production releases
• Administered production databases — including sizing application pools so pod count × pool size would not exhaust Aurora/RDS max_connections — and configured Defguard VPN access for private services
• Stood up telemetry — traces and logging — with kube-prometheus-stack and the ELK stack
• Built reusable GitHub Actions CI/CD templates with Trivy, Semgrep, GitOps deployment, automated health checks, rollback, and notifications; also shipped through GitLab CI, Jenkins, AWS CodePipeline, and Azure DevOps where those were already the client’s system of record
• Ran load and stress tests with JMeter against critical paths so bottlenecks and failure modes showed up before they hit production
• Enforced cost guardrails with AWS Budgets and anomaly alerts, tagged resources per service and environment, and traced surprise bills to the product that was actually meterable — not a nearby IAM or directory label
• Kept secrets in HashiCorp Vault and AWS Secrets Manager (ESO into the cluster) instead of long-lived keys on nodes
• Separated AWS authentication from authorization when debugging access denied — caller identity vs IAM and KMS key policies, instead of rotating keys until something stuck
• Managed multiple production Amazon EKS clusters — multi-tenant microservices with Karpenter autoscaling, KEDA event-driven scaling, and Argo CD / FluxCD GitOps
• Used KEDA to scale occasional-call services to zero between requests so they did not hold idle compute
• Shipped frontends on Cloudflare Pages and Workers, and on Vercel, including edge delivery and the CI path to those platforms
• Hardened the edge with Cloudflare WAF, custom rules, and bot/rate-limit controls so abuse and common web attacks were stopped before they reached origin