selected work / 7 sheets
Systems I would put my name on.
Each one is a real system from my resume, drawn the way I would draw it on a whiteboard for you: the problem, the constraints, the architecture, and the calls I made. No invented numbers.
A Golden AMI factory, from nothing to GovCloud
The Virtual Appliance Builder: one pipeline that builds the image, proves upgrades still work, and lands it in every commercial region customers need plus both AWS GovCloud regions.
Read the case2GovCloud regions1release account0manual copy stepsGitLab on Kubernetes, staged and reproducible
A GitLab platform cluster that Flux brings up in order, every time, with no public origin. Plus the less glamorous half of Kubernetes: upgrading EKS from 1.33 to 1.35 without anyone noticing.
Read the case3staged rollout phases0public origins1.35EKS, from 1.33MCP servers for product data, before anyone asked
I spotted that models could answer questions about product data and support bundles directly, built MCP server prototypes for both, and demoed them to the team ahead of any roadmap item. Then put agents to work writing and running tests on AWS Bedrock.
Read the case2MCP servers prototyped0roadmap items waited onAIagents write + run testsCompliance for the SEC and the DoD
Two government programs, one stance: the infrastructure and the control story get built together. AWS infrastructure as code for a U.S. SEC data program through ATO prep, and before that, a DoD IL4 data warehouse that survived C5ISR testing.
Read the caseIL4DoD environmentr5NIST 800-53ATOpreparedCellebrite's first SaaS product, secure from day one
Three roles in just over a year: integrate an acquisition, architect the company’s first SaaS product, then run it. Weekly releases ended up with 85% less user downtime.
Read the case-85%release downtime3compliance programs1stGovCloud accountsFrom 88.3% uptime to five-nines
I founded the IT team at a digital forensics company, moved it from on-prem to a secure cloud, and raised uptime from 88.3% to 99.999%, while building new forensic capability on the same foundation.
Read the case99.999%uptime, from 88.3%-96%QA + dev test time$1Mbudget, -10%/yr44 sites, one engineer, a fleet of agents
A portfolio of 44 domains on Cloudflare Workers, kept alive by scheduled agent roles that cost nothing when things are healthy and cannot ship without passing the same gates I do. This site is one of them.
Read the case44domains on Workers5 minerror-scan interval0laptop deploys
also shipped
Worth a line, not a page.
IPv6, in production
Led the dual-stack migration at Anchore: VPC and ALB dual-stack enablement, ADS service conversion, and importing in-production tool buckets into Terraform state.
Usage tracking on Firehose
The Enterprise Data Service usage pipeline: a Firehose delivery stream to S3 CSV output, custom IAM roles, SHA-prefixed log format and header logging, documented with diagrams.
ARM64 for the whole product
Multi-arch aarch64 builds for the enterprise product, the on-prem UI and anchorectl, with self-contained CI build scripts per binary.
Helm releases, 5.14.1 to 5.23.0
Maintained Anchore Enterprise Helm chart releases, added Prometheus and Grafana observability to the chart, and coordinated nightly appVersion bumps with CI.
Remote Command ↗
A browser artillery game on Cloudflare Workers, shipped end to end: PixiJS, GSAP, Playwright tests, gitleaks and semgrep in CI, five portal builds.
Cloudflare, day to day
DNS, WAF rules and rate limiting, Workers routes, and Access application and IP policies across the Anchore account.