GCP · CAF · IDP · Terraform
Cloud Adoption Framework — GCP Internal Developer Platform
Architected and deployed a GCP-based Internal Developer Platform (IDP) using Cloud Adoption Framework (CAF) principles — enabling standardised, self-service infrastructure provisioning for engineering teams, analogous to Backstage + Terraform Enterprise in the GCP ecosystem.
- Designed the CAF-aligned landing zone structure on GCP, establishing governance guardrails, project hierarchy, and IAM boundary policies across environments
- Provisioned infrastructure using Terraform with modular, reusable configurations — mapping workspace variables to environment-specific .tfvars for consistent multi-env deployments
- Configured Cloud Build CI/CD pipelines triggering on Git branch events, building container images, pushing to Artifact Registry, and deploying to Cloud Run automatically
- Integrated Secret Manager for runtime secrets injection and IAP (Identity-Aware Proxy) as the zero-trust access control layer — enforcing identity-based, not network-based, trust boundaries
- Evaluated CAF against Google Cloud Deploy, Backstage, HashiCorp Vault, and Terraform Enterprise — documented trade-offs for healthcare compliance posture and internal adoption friction
- Produced manager-facing architecture summaries and onboarding documentation for engineering teams joining the platform
Platform enabled self-service provisioning · healthcare compliance posture achieved
TerraformGCP CAF
Cloud BuildCloud Run
IAPSecret Manager
Artifact RegistryIAM
GCP · Cloud Run · Firestore · Node.js
Research Link Master (RLM) — Serverless Intranet Application
Designed and deployed a GCP-native intranet link recommendation engine for researchers — a controlled, internal application serving as a curated discovery layer over approved research resources.
- Built on Node.js/TypeScript Express running on Cloud Run — fully serverless, auto-scaling, zero infrastructure maintenance
- Used Cloud Firestore as the NoSQL persistence layer for link metadata, user preferences, and recommendation state
- Secured the application behind IAP (Identity-Aware Proxy) — only authenticated users with approved identities could access the intranet service
- Automated the full delivery lifecycle with Cloud Build + Artifact Registry: Git push → build → containerise → deploy to Cloud Run
- Managed all runtime configuration and credentials via Secret Manager — no secrets in code or environment variables
- Configured Cloud Logging for application observability and audit trail compliance
Fully serverless · zero-trust auth · production-ready compliance posture
Cloud RunFirestore
IAPCloud Build
Artifact RegistrySecret Manager
Node.jsTypeScript
Azure · CI/CD · Terraform · Bicep
Enterprise Azure Multi-Environment CI/CD Platform
Designed and operated a multi-stage CI/CD system automating build, test, and deployment across dev, staging, and production Azure environments for multiple product teams.
- Implemented multi-stage Jenkins and GitHub Actions pipelines with automated testing gates, deployment approval workflows, and environment promotion logic
- Provisioned all environments using Terraform and Bicep — repeatable, auditable IaC eliminating configuration drift across teams
- Built self-healing pipeline configurations with automatic rollback on failure, reducing manual intervention and protecting production stability
- Integrated Azure Policy and RBAC as security gates within the pipeline — enforcing compliance before any resource reached production
- Set up Azure Monitor and Log Analytics dashboards for real-time pipeline health, deployment frequency, and mean time to recovery tracking
↓ 30% cloud cost · ↑ 85% performance · 99.99% SLA maintained
JenkinsGitHub Actions
GitLab CITerraform
BicepARM Templates
Azure Monitor
Azure · Kubernetes · AKS · Docker
Kubernetes Workload Migration to AKS
Containerised enterprise workloads and migrated them to Azure Kubernetes Service — orchestrating deployments, configuring autoscaling, and ensuring high availability for distributed production services.
- Containerised legacy services into Docker images, restructuring configuration as environment variables and secrets via Azure Key Vault integration
- Deployed and managed AKS clusters — configuring node pools, autoscaling policies, rolling update strategies, and pod disruption budgets
- Defined all Kubernetes resources as Helm charts — enabling versioned, repeatable deployments across environments
- Integrated AKS deployments into the existing GitHub Actions CI/CD pipeline — image build → push to ACR → deploy to AKS on merge to main
- Monitored cluster health and resource consumption using Azure Monitor for containers and Grafana dashboards
High availability achieved · cluster autoscaling operational · manual ops eliminated
AKSDocker
KubernetesHelm
GitHub ActionsAzure Monitor
Terraform · Temporal · GitHub
Temporal Workflow Infrastructure — Terraform IaC Investigation
Investigated two independent Terraform repositories provisioning infrastructure for Temporal workflow runtime environments, clarifying the separation between infrastructure provisioning and workflow orchestration logic.
- Mapped .tfvars file patterns to Git branch naming conventions — establishing clear conventions for environment targeting across the two repos
- Documented variable passing patterns and confirmed the two repos (tfo-wf-configure-project and tfo-wf-configure-team) operate independently without chaining
- Clarified the architectural boundary: Terraform provisions infrastructure; Temporal handles workflow runtime logic — preventing teams from conflating the two
- Produced a manager-facing investigation summary used to unblock the engineering team and inform onboarding documentation
Engineering team unblocked · IaC conventions documented · onboarding accelerated
TerraformTemporal
.tfvarsGitHub
IaC PatternsDocumentation
SQL Server · Infrastructure · Migration
SQL Server Environment Migration — 46% Cost Reduction
Planned and executed a full SQL Server environment migration with zero business disruption, delivering significant infrastructure cost savings while improving availability and business continuity.
- Conducted risk assessment and migration planning — identifying dependencies, defining rollback procedures, and scheduling maintenance windows to minimise business impact
- Executed data migration with integrity validation at each stage — confirming consistency between source and target before cutover
- Managed stakeholder communication throughout — pre-migration briefings, real-time status updates during execution, and post-migration sign-off
- Delivered a 46% reduction in infrastructure costs and measurably improved system continuity through the new environment design
↓ 46% infrastructure cost · zero downtime · improved BCP posture
SQL ServerPowerShell
Backup & RecoveryChange Control
Risk Management