Platform work, told plainly.

Teams needed new AWS accounts quickly, and every new account was one more place for a security gap to hide.

I designed the landing zone with AWS Organizations and Control Tower and set up account vending, so a new account arrived with its networking, IAM and logging already in place. Service control policies stopped risky changes at the organisation level. Connectivity ran through Transit Gateway, with Direct Connect and site-to-site VPN for the hybrid links, and every account sent its logs to a central security account watched by Security Hub, GuardDuty and AWS Config.

Infrastructure changes were slower than they should have been, hard to audit, and environments had a habit of drifting apart.

I built a library of reusable Terraform modules for VPCs, EKS and ECS, Aurora, S3 and WAF, each with pinned versions and clear inputs and outputs, and kept CloudFormation where it made more sense. Every change went through the same gate: format, validate, plan, a human approval, then apply. Scheduled drift checks flagged anything that had been changed by hand.

When a release went wrong, rolling it back took hours. That makes people nervous about shipping at all.

I standardised the pipelines across GitLab CI, AWS CodePipeline, Jenkins and GitHub Actions. Each one ran unit and integration tests, scanned container images, checked the SBOM, and released with blue/green or canary deployments, so a bad version could be switched off without drama.

Getting a new service from a Dockerfile into production took too long, and there was not enough control over what went into the images.

I containerised the services and designed them on ECS, using Fargate and EC2 where each fitted best. I wrote the task definitions with autoscaling and least-privilege IAM roles, and put artifact governance in front of everything with CodeArtifact and ACR, so vulnerable packages were blocked in CI before they could ship.