Available for new projects Replies within 1 business day Direct with me · no agency handoff CISA · CISM · ISACA

Build it. Defend it.
Zero-finding audits,
by design.

I'm the rare engineer who builds your AWS & Kubernetes platform and defends it in the SOC 2, PCI DSS & ISO 27001 room. One accountable owner — no hand-off gap between engineering and compliance. CISA · CISM · AWS Pro · 16+ years.

PCI DSS · ISO 27001 · SOC 2 · HIPAA · DPDP — clean-report track record across fintech, AI-lending & regulated SaaS.

Book a 30-min Strategy Session View Case Studies

Download my resume

16+
Years engineering
200+
Projects delivered
100%
Job success score
★ CISA ★ CISM AWS · Pro Top Rated Plus
SECURE.● AUTOMATE.● COMPLY.● FROM INFRASTRUCTURE TO AUDIT READINESS● BRIDGING DEVOPS · SECURITY · COMPLIANCE● PCI DSS·ISO 27001·SOC 2·HIPAA·GDPR●
★ CISA · ISACA / AWS Solutions Architect — Professional / EKS · Terraform · CI/CD · Linux / Top Rated Plus · 100% JSS · 5,900+ hrs ↗ verify on Upwork / Zero-finding audits / PCI DSS · ISO 27001 · SOC 2 · HIPAA · DPDP
// 01 · Credentials that pass an audit room

A rare combination:
build it, then defend it.

Most cloud engineers can't pass an audit. Most auditors can't deploy infrastructure. The credentials below mean you don't have to choose.

Audit Authority
CISA
ISACA
★ ACTIVE
Certified Information
Systems Auditor

Governance, risk, audit and control of enterprise information systems — the credential auditors and CISOs trust.

IS Audit · Risk · Governance · Controls
Advanced Architecture
AWS Pro
AMAZON
Solutions Architect
— Professional

Complex, multi-account AWS architecture: VPC topology, EKS, IAM federation, KMS, Transit Gateway, multi-region DR.

VPC · EKS · IAM · KMS · DR
Foundation
AWS · SAA
AMAZON
Solutions Architect
— Associate

Core AWS service mastery — the foundation every senior architect should hold first. Validated and current.

EC2 · S3 · RDS · Lambda · Route 53
// The rare intersection

CISA + AWS Solutions Architect Professional is held by a vanishingly small number of engineers worldwide. It means I can architect infrastructure that doesn't just survive a PCI DSS or SOC 2 audit — it walks the auditor through the evidence themselves.

// Audit readiness check

Know your score before the auditor does.

Answer 9 quick questions and get your audit-readiness score, your top gaps, and a realistic timeline to a clean report — in about 60 seconds. No email required.

Step 1 of 9
// 02 · About

The audit room is where engineering meets the truth.

I've spent sixteen years in the trenches of production AWS — building multi-AZ VPCs for fintech platforms moving millions of transactions, hardening EKS clusters for AI lending startups, and rebuilding cardholder data environments from the ground up after failed PCI assessments.

The pattern I kept seeing: brilliant engineering teams that couldn't pass an audit, and capable auditors who couldn't write Terraform. Compliance documentation lived in one universe, the actual cloud account in another, and every audit became a six-week scramble to reconcile them.

The CISA changed how I work. I stopped designing infrastructure for engineers and started designing it for auditors — IAM policies that map cleanly to ISO 27001 Annex A, CloudTrail configurations that satisfy SOC 2 CC7, KMS hierarchies an assessor can trace from key policy to encrypted volume in three clicks.

The result is infrastructure that doesn't just happen to be compliant. It's compliant by construction. Engineers ship faster because the security gates are in the pipeline. Auditors finish faster because the evidence is automated. And founders sleep better because the next renewal isn't a fire drill.

Currently
Full-time independent consultant
Techtweek Infotech · freelance
Notable
SOC 2 Type 2 — zero findings
Zest.ai · 2024–25
// 03 · Three pillars · one architecture

Security, automation,
and the audit-ready evidence chain.

Pillar 01

Cloud Security
Architecture

  • ›Multi-AZ VPC topology with private-by-default subnets, no 0.0.0.0/0 on data tier
  • ›IAM least privilege, IRSA for EKS workloads, no long-lived access keys
  • ›Zero Trust segmentation — east-west controls via SG + NACL layering
  • ›KMS CMKs everywhere, secrets in Secrets Manager with rotation
  • ›WAF, GuardDuty, Inspector, Security Hub — wired into incident workflow
Pillar 02

DevSecOps
& Automation

  • ›Modular Terraform — networking, compute, data, security, observability
  • ›CI/CD with security gates: SAST, Trivy, OPA policy-as-code, image scan
  • ›Blue/green and canary deploys on ECS & EKS, automated rollback on 5xx
  • ›GitOps with Argo CD — drift detection & reconciliation every 3 minutes
  • ›Conftest blocking public S3, unencrypted RDS, open SGs at plan time
  • ›Python — Boto3 automation, Lambda handlers, evidence collection & compliance scripts
Pillar 03

Compliance
& Audit

  • ›PCI DSS — segmented CDE, encryption, key rotation, quarterly scans
  • ›ISO 27001 — Annex A control mapping, ISMS evidence automation
  • ›SOC 2 Type 2 — Trust Services Criteria, AWS Config conformance
  • ›HIPAA — PHI segmentation, BAA-aligned services, audit logging
  • ›GDPR — data residency, DPIA support, right-to-erasure tooling
// 04 · The complete stack

Fifteen years of
hands-on tooling.

Not a keyword list — every tool below is something I've shipped to production, debugged at 3AM, or walked an auditor through. Organised the way a hiring manager scans a stack: capability first, tool second.

01 · Cloud & Containers

Multi-cloud, container-native

AWSAzureGCP EKSECS FargateKubernetes DockerHelmdistroless HPACluster Autoscaler

AWS is primary — Solutions Architect Professional certified. Azure & GCP for multi-cloud client work.

02 · IaC & CI/CD

Infrastructure-as-Code, pipeline-driven

TerraformCloudFormation AWS CodePipelineGitHub ActionsGitLab CI JenkinsArgo CDFlux Fastlane

Modular Terraform across 11+ repos. Blue/green, canary, GitOps reconciliation every 3 minutes.

03 · Observability & SRE

SLOs, alerting, incident response

DatadogPrometheusGrafana CloudWatchOpenSearch / ELK PagerDutySNS SLOs / SLIsError budgets

Led NOC team at Zest.ai — 99.99% uptime, MTTR reduced 30%, RTO reduced 50%.

04 · Security & DevSecOps

Shift-left, policy-as-code

TrivyOPA / ConftestSAST IAM / IRSAKMSSecrets Manager WAFGuardDutyInspector WazuhSecurity Hub

Image scanning in CI, OPA blocking unsafe Terraform at plan time, east-west controls on every tier.

05 · Compliance & Audit

Dual-certified, audit-led

CISA CISM PCI DSSISO 27001SOC 2 Type 2 HIPAAGDPRNIST 800-53 AWS ConfigCloudTrail

Zero-finding outcomes across PCI DSS, ISO 27001, SOC 2 Type 2 audits. Risk assessment, evidence automation, auditor liaison.

06 · Data & Databases

Production scale, financial data

RDS / AuroraPostgreSQLMySQL MS SQL (6TB+)DynamoDBElastiCache / Redis S3 Object LockAWS BackupDMS

Managed 6TB+ MS SQL production with backup/DR for NZ banking clients (BNZ, KiwiBank, ANZ, Westpac).

07 · Languages & Scripting

Automation-first

PythonBoto3 BashPowerShell Node.jsGo (ops) Lambda handlersevidence scripts

Python for AWS automation, compliance evidence collection, Lambda event handlers, audit data extraction.

08 · Leadership & Delivery

Ran the team, not just the stack

Team lead (14+)Risk assessment Vendor managementStrategic planning Auditor liaisonStakeholder reporting MentorshipHiring

Built and led 12 and 14-engineer DevSecOps teams across two organisations. Reported to CTO/CISO level.

09 · Network & Platform

Foundations that still matter

VPC / Transit GatewayRoute 53 CloudFront + OAIAPI Gateway LinuxWindows Server Active DirectoryNginx / Apache / IIS OpenVPN

Migrated 150+ servers from Auckland colo to AWS Sydney with <4hrs downtime. Still the decade that taught me how things break.

// 03a · Technical stack

The full toolbox.
15 years of production scars.

What you actually get when you hire a DevOps, DevSecOps, and Compliance lead in one person. Every tool listed has been run in production under audit.

Cloud & Containers
Where workloads live
AWSAzureGCP EKSECSFargate DockerHelmArgo CD HPACluster Autoscaler
IaC & Automation
Code defines reality
TerraformCloudFormation AnsiblePython Boto3Bash eksctlOPA / Conftest
CI/CD & GitOps
Ship fast, ship safely
GitHub ActionsGitLab CI JenkinsAWS CodePipeline CodeBuildFastlane Blue/GreenCanary
Observability & SRE
See it before users do
PrometheusGrafana DatadogCloudWatch ELK / OpenSearchPagerDuty SLO / SLIError budgets
Security & Compliance
Audit-room grade
PCI DSSISO 27001 SOC 2 Type 2HIPAA GDPRNIST WAFGuardDuty TrivyWazuh KMSVuln Mgmt
Data & Databases
6 TB+ under management
RDSAurora PostgreSQLMS SQL DynamoDBElastiCache S3Backup & DR
Leadership & Governance
Not just the stack — the practice around it.
Team Lead · 14+ engineers Vendor Management Risk Assessment ISMS Programs Audit Liaison Policy Authoring Incident Response DR / BCP Planning Cost Optimization Tech Documentation Stakeholder Reporting
// Automation in action

Every commit
runs the audit.

Compliance isn’t a document I write at the end — it’s a gate in the pipeline. Static analysis, image scanning, policy-as-code and evidence capture run on every push, so the audit trail builds itself.

tfsecCheckovTrivyOPA / Conftestcosign
sahil@prod:~/audit-pipeline
// 05 · Selected case studies

Real systems.
Real auditors. Real outcomes.

Six engagements drawn from a portfolio of 200+ delivered projects. Names anonymized where required.

SOC 2 TYPE 2 · ZERO FINDINGS
2024 — 2025

AI Lending Platform
— private-subnet EKS

Problem

High-growth AI lending platform needed 99.99% uptime, SOC 2 Type 2 certification, and elimination of all internet egress from sensitive workloads — under aggressive timeline.

Technical architecture

Designed private-subnet-only EKS with VPC Endpoints for ECR, S3, STS, Secrets Manager. Multi-account AWS Org. SLO-driven SRE practice. Automated evidence collection via AWS Config conformance packs.

EKSVPC EndpointsPrometheusPagerDutyAWS Config
Result
0
Audit findings
−30%
MTTR
−$1.8k
Monthly NAT cost
PCI DSS · ZERO FINDINGS
2017 — 2020

Fintech Migration
— colo to AWS Sydney

Problem

Mission-critical fintech serving NZ banks (BNZ, KiwiBank, ANZ, Westpac) needed full migration from Auckland colocation to AWS Sydney with zero PCI DSS audit findings and minimal downtime.

Technical architecture

Segmented cardholder data environment into isolated VPC with dedicated SGs/NACLs/WAF. AWS SMS + DMS for migration. KMS-managed key rotation. Always-On SQL replication.

VPC SegmentationKMSAWS SMSDMSWAF
Result
<4h
Total downtime
150+
Servers migrated
0
PCI findings
TERRAFORM · IaC
PECTUS FINANCE

Static Finance Site
— OAI-locked CloudFront

Problem

Finance client needed a hardened static site delivery layer plus secure remote access to private database resources — fully reproducible via code.

Technical architecture

Terraform-deployed CloudFront with S3 origin restricted via OAI, ACM certificates, Secrets Manager for sensitive values, and OpenVPN Access Server for engineer access to private RDS.

TerraformCloudFront + OAIACMSecrets ManagerOpenVPN
Result
100%
IaC coverage
0
Public S3 objects
∞
Reproducible
WAF · AUTOSCALING
PAYKICKSTART

Wallet API Platform
— scalable, hardened

Problem

A wallet-based payment API faced unpredictable traffic spikes and hostile bot traffic. Required a scalable backend, automated DR, and layered security from edge to database.

Technical architecture

EC2 ASG behind ALB, ElastiCache Redis for session/cache, RDS MySQL with multi-AZ, AWS WAF with custom rules, GuardDuty + Inspector + Wazuh monitoring, AWS Backup for DR.

ASGALBRedisWAFGuardDutyWazuh
Result
99.9%
Uptime
3 AZ
HA spread
L7
WAF rules
EKS · CI/CD
RIA

Java on EKS
— GitOps pipeline

Problem

Engineering team needed a hands-off CI/CD pipeline that could push Java application changes to EKS on every commit, with rotating database secrets and edge-layer WAF protection.

Technical architecture

CodePipeline-driven build → ECR → EKS deploy. Cluster-mode Postgres RDS with Secrets Manager rotation. ALB + WAF + API Gateway. Amplify front-end. OpenVPN for private resource access.

EKSCodePipelineRDS PostgresAPI GatewayAmplify
Result
Push
→ deploy
Auto
Secret rotation
L7
Edge WAF
ISO 27001 · 4× AUDITS
2022 — 2024

DevSecOps Practice
— zero major findings

Problem

Six client AWS accounts, twelve-engineer DevOps team, recurring PCI DSS and ISO 27001 audits — each previously a fire drill consuming weeks of engineering capacity.

Technical architecture

Standardized modular Terraform VPC templates across all accounts. AWS Config rules + automated compliance dashboards. Quarterly evidence reviews. Security gates baked into every CI/CD pipeline.

Terraform ModulesAWS ConfigSASTImage ScanAuto Evidence
Result
4×
Audits passed
−75%
Vulns to prod
−15%
Cloud cost
// 06 · Control mapping

Every AWS service
maps to a control.

Engineers think in services; auditors think in controls. Click any AWS service to see exactly which SOC 2, PCI DSS, ISO 27001 or HIPAA control it satisfies — and the evidence an assessor will ask for.

Identity layer
IAM · Identity Center · IRSA
Satisfies · SOC 2
CC6.1–6.3 Logical Access
Evidence an auditor asks for
Access-review exports, MFA-enforcement policy, zero long-lived keys, and role-trust policies.
Failure mode if misconfigured
Long-lived access keys in CI, or wildcard “*” IAM policies.
// 07 · Sixteen years · the timeline

Built it. Broke it. Fixed it. Audited it.

2025 — PRESENT
TECHTWEEK INFOTECH
Tech Lead — DevOps & Cloud Architecture
Multi-AZ VPCs for fintech (The Soft Pay) and SaaS (Platformz.us). Modular Terraform. Zero-NAT private workloads. AI-driven log correlation reducing investigation time 40%.
2024 — 2025
ALPHA NET · ZEST.AI
Senior Site Reliability Engineer
99.99% uptime SLA. Led SOC 2 Type 2 audit with zero major findings. Reduced cloud spend 20%, MTTR 30%. Designed cross-region DR achieving RTO <15 min / RPO <1 hr.
2022 — 2024
TECHTWEEK INFOTECH
Head of IT Infrastructure, DevOps & Compliance
Built and led a 12-person DevSecOps team. PCI DSS + ISO 27001 — zero major findings across 4 consecutive audits. Reduced deployment errors 40%, infrastructure cost 15%.
2020 — 2022
COGNEESOL
Team Lead — Cloud, DevOps & Compliance
Led 14-engineer infra team. Migrated 500+ employees to remote work in 72 hours during COVID using AWS WorkSpaces, ClientVPN, Zscaler. Reduced deploy time 35%.
2017 — 2020
ZUPE / FLO2CASH GROUP
Senior Cloud & DevOps Engineer
Migrated 150+ servers from Auckland colocation to AWS Sydney with <4 hours total downtime. Zero-finding PCI DSS audits across NZ banking integrations (BNZ, KiwiBank, ANZ, Westpac).
2011 — 2017
EARLIER
Foundations — System & Infrastructure Engineering
Net Solutions, Edutopia. AWS EC2, VPC, Active Directory, Group Policy. 30+ educational institutions. The unglamorous decade where the instincts were forged.
// Why hire me

One engineer.
Build it, secure it, pass the audit.

Most teams need three vendors: one to build the AWS & Linux platform, one to automate and harden it, and one to survive the audit. You get all three in a single senior engineer — no handoffs, no junior ramp-up, no dashboard that still leaves the work to you.

Work directly with me
The engineer who does the work
  • ✓AWS architecture, Terraform/IaC, EKS/ECS & CI/CD pipelines — built and owned by me
  • ✓Linux hardening, observability, FinOps cost & performance tuning
  • ✓PCI · ISO 27001 · SOC 2 · HIPAA · GDPR — I write the controls and sit with your auditor
  • ✓One accountable owner · 16+ yrs · 100% Upwork job success
A dev agency
Sold by seniors, built by juniors
  • ✗Sold by seniors, delivered by juniors on your budget
  • ✗Account managers and handoffs between you and the work
  • ✗Builds infra — but rarely carries you through a real audit
  • ✗Compliance treated as someone else’s problem
A compliance tool
A dashboard, not a delivery
  • ✗Shows gaps — doesn’t implement controls or harden infra
  • ✗No one to build the AWS/Linux platform behind it
  • ✗Auditor still needs evidence someone has to produce
  • ✗You (or a new hire) still do all the actual work
// 08 · Engagements

Packaged around outcomes, not hours.

Fixed-scope programs and retainers that bundle senior cloud engineering with CISA-led compliance — one owner, one accountable outcome. Most teams start with the Audit-Readiness Sprint.

Fixed-scope engagements
Audit-Readiness Sprint
2–3 WKS
For teams with a SOC 2 / PCI / ISO deadline

A full control-gap register, prioritized remediation roadmap, and a go/no-go verdict — so you walk into the audit knowing the outcome before it starts.

Gap registerRoadmapEvidence plan
Discuss this engagement →
Secure Cloud Landing Zone
FIXED
For teams building or re-platforming on AWS

A Terraform landing zone — multi-account, IAM Identity Center, guardrails, centralized logging and KMS — plus a policy-gated GitOps pipeline and the control-mapping doc that proves compliance from day one.

TerraformLanding zoneGitOpsControl map
Discuss this engagement →
Zero-to-Audit Program
MILESTONES
For startups going from nothing to a clean SOC 2

End-to-end — architecture hardening, policy authoring, evidence automation and auditor liaison through the report. One accountable owner from “no framework” to a clean opinion.

HardeningPoliciesEvidenceAuditor liaison
Discuss this engagement →
Ongoing retainers
Fractional Cloud & Compliance Architect
RETAINER
For funded teams needing senior ownership, not a full-time hire

Ongoing architecture oversight, drift and compliance monitoring, and quarterly control reviews — senior cloud + compliance ownership without the full-time headcount.

Architecture oversightDrift monitoringQuarterly reviews
Discuss this engagement →
Continuous Audit-Readiness
RETAINER
For teams post-first-audit who must stay compliant

Automated evidence pipelines, monthly control attestation, remediation SLAs and auditor-cycle support. SOC 2 Type II is not a project — it’s a state, and I keep you in it.

Evidence pipelineMonthly attestationRemediation SLAs
Discuss this engagement →

Every engagement is fixed-scope with a defined deliverable — investment scoped on the call.

// 09 · In their words

Founders on working with me.

Not a wall of stars — the actual people, on camera, on the outcomes.

James Kell
Co-Founder · Scratchie
Andrew Jurekic
Founder · Goinspect
Mark Thompson
Founder · Paykickstart & Builderpad
Book a 30-min Strategy Session →
// Free resource

Not sure you're audit-ready?
Grade your own setup in 5 minutes.

A 30-point Cloud Security & SOC 2 Readiness Checklist across the AWS controls auditors actually test — identity, network, data, logging, CI/CD and resilience. Every unticked box is a finding waiting to happen.

One page · maps to SOC 2 · ISO 27001 · PCI DSS · HIPAA

No spam — the checklist plus the occasional note on cloud security. Unsubscribe anytime.

// 09 · Frequently asked

Questions worth asking.

What does a CISA-certified DevSecOps architect actually do?+

Bridges three normally-disconnected worlds: cloud engineering, security engineering and audit. AWS environments aren't just secure on paper — they're auditable in evidence. IAM, encryption, logging, segmentation and CI/CD controls all map directly to PCI DSS, ISO 27001, SOC 2, HIPAA and GDPR requirements, so an external auditor walks through and finds no gaps.

Which compliance frameworks do you specialize in?+

PCI DSS, ISO 27001, SOC 2 Type 1 & Type 2, HIPAA and GDPR — with deep, repeated audit experience. Zero-finding outcomes across multiple PCI DSS, ISO 27001 and SOC 2 Type 2 audits, including for fintech and AI lending platforms.

Greenfield build or brownfield remediation?+

Both. Greenfield: modular Terraform, multi-AZ VPCs, EKS, blue/green CI/CD, KMS-everywhere baseline. Brownfield: gap assessment against the target framework, prioritized remediation roadmap, evidence collection automation and audit walkthrough support.

How long does a SOC 2 or ISO 27001 readiness engagement take?+

Most mid-market AWS environments reach audit-ready state in 8–14 weeks of focused engagement, depending on starting posture. SOC 2 Type 2 then requires the standard 3–12 month observation window — but the technical and evidence work is front-loaded so the observation period is uneventful.

Are you available for new engagements?+

Yes — currently available for select compliance readiness, AWS security architecture and DevSecOps engagements. Fastest path: the contact section below, LinkedIn or Upwork.

// 10 · Let's talk

Let's secure your infrastructure
and pass your next audit.

Whether you have a deadline on the calendar or you're just starting to think about compliance — the first conversation is on me.

Book a 30-min call Email LinkedIn → Upwork →
Based in
Mohali, India · Remote-first
Response time
Within 24 hours
// 11 · Book directly

Pick a time.
The calendar is live.

30-minute discovery call, Google Meet link auto-generated. Discuss compliance readiness (PCI DSS, ISO 27001, SOC 2, HIPAA, GDPR), AWS security architecture, or DevSecOps engagement. No cost, no obligation.

Live Calendar
Powered by Google Calendar
Calendar not loading? Open booking page in new tab →