I build, secure, and operate
the platforms that can't fail.

• Own the AWS foundation as code — eight Terraform/Terragrunt environments across two regions, promoted DEV → STG → PRD through CI on self-hosted runners inside each account. No manual production changes.
• Replaced the orchestrator under a live federal-reporting workload. Ran a two-tool bake-off, selected the winner, and cut over all workstreams with the state security office signing off: "No issues were detected in any aspect of testing."
• Hardened deployment safety. Shipped deploy drain/wait, job reconnect, and stale-run cleanup so an in-flight load can never be severed by a routine deployment.
• Eliminated legacy credentials. Removed password seeding, moved service users to key-pair-only auth, and built a service that discovers and rotates embedded BI-to-warehouse credentials automatically.
• Compliance is part of the job, not overhead. Contributing author on the disaster-recovery, configuration-management, incident-response, and supply-chain risk plans; monthly vulnerability audits and the patch rollout that follows.

Outcome. Three consecutive annual DR exercises completed well inside the 24-hour contractual recovery objective. The most recent incident-response tabletop closed with "no significant procedural gaps" and zero corrective actions, reviewers crediting the network segmentation as a control. Every inherent supply-chain risk reduced to a lower residual.

AWSSnowflakeTerraform / TerragruntDagsterdbt ECS FargateAWS DMSPrivateLinkTableau ServerDatadogPython

• Authored the target-state Snowflake design — account topology, the RBAC role model, warehouse sizing, SSO with SCIM provisioning, PII row-access policies, PrivateLink networking with segmented network policies, and tiered backup retention.
• Broke the monolith. Redesigned a single Redshift database into a multi-database, layered Snowflake structure aligned to workload isolation and data ownership — a redesign, not a lift-and-shift.
• Built the refresh engine. An asynchronous parallel Python utility with S3 staging that kept Snowflake current from Redshift throughout the migration, so both platforms stayed live and validation ran against real data.
• Made the evidence automatic. A reconciliation harness producing row counts, field-level comparison, and exception reports — nothing advanced until it was clean.
• Unblocked the network. Drove the PrivateLink and NAT connectivity problem to resolution with state network staff and the vendor.

Outcome. Row-count reconciliation returned zero delta and 0% variance — first in the support environment, then again in production a year later. The Snowflake foundation now carries workloads well beyond the original migration scope.

SnowflakeAmazon RedshiftPythonDataComPySnowConvert InformaticaEntra ID SAML + SCIMPrivateLinkS3

• Designed a tiered matching pipeline that generates vector similarities, auto-accepts above a confidence ceiling, auto-rejects below a floor, and spends AI_CLASSIFY only on the ambiguous middle. The point of the design is cost containment, not novelty.
• Harmonized ~32M raw records down to ~15.6M as dbt views with reusable normalization macros, preserving source lineage end to end.
• Made the results defensible. Authored the labeling standard, co-built the gold test set, and stood up precision/recall/F1 measurement with split-cluster diagnostics and per-run persisted metrics, so every linkage decision was explainable.
• Found what the data actually was. Commercial freight-forwarder addresses were silently linking a dozen-plus unrelated people into one identity — a false-merge risk that needed a safety net, not better matching. Nearly a million marketplace-channel orders carried proxy email domains and no real addresses at all.
• Priced it. Modeled both platforms at production volume; the Snowflake-native path came in roughly 48% cheaper per month. That number, not the demo, drove the decision.

Outcome. A working resolution pipeline, an explainable validation framework, a quantified two-platform cost comparison, and a data-quality picture that changed how the client understood their own customer data.

Snowflake Cortex AIVector embeddingsAI_CLASSIFYdbt AWS Entity ResolutionApache IcebergGlue Data CatalogSQL

Connector one — SaaS analytics source

• Designed and built the full connector: source-API retrieval, metadata transformation, and bulk indexing — structured so retrieval, transform, and index stay separately extensible.
• Ran it as a Kubernetes CronJob deployed through ArgoCD with Vault-backed secrets; 15–60 second runs at a small memory footprint.
• Shipped four production fixes post-launch, published the documentation set, and handed the team full operational ownership.

Connector two — global engineering firm

• Sole technical resource on a CIO-sponsored pilot to make CAD, PDF, and Office work product searchable — content extraction with quality filtering across genuinely messy mixed formats.
• Designed default-deny outbound egress for the container subnet, permitting only DNS, private database traffic, and allowlisted destinations. This was the security centerpiece, and I drove the client for the private ranges needed to finish it.
• Authored the complete cloud resource-provider and RBAC specification their IT team provisioned from, and delivered everything through their own source-control org with passing CI and security scanning.
• Reused a requirements questionnaire I'd built on the first engagement to compress discovery.

Outcome. Both connectors delivered to production and handed off. The second concluded with a follow-on phase scoped directly with the CIO — the practical measure of a successful pilot.

Python 3.11DockerKubernetes CronJobArgoCDHashiCorp Vault Azure Container AppsTerraformPostgreSQLEnterprise-search indexing APIsCodeQL

• Ran the funnel honestly — 20+ candidate technologies researched, 15 scored against weighted criteria, 3 deployed and tested hands-on, 2 taken to head-to-head validation. I stood up each candidate platform myself.
• Built ground truth before measuring anything — 1,000 curated person clusters and 1,000 organization clusters, hash-stratified 70/20/10 into train, test, and validation.
• Reported the inconvenient result. On organization data the recommendation inverted — a different tool outperformed. I put that in the report and let it shape a phased recommendation rather than burying it.
• Designed the target state — resolution data flow across ten source systems, an entity graph with traceable source-to-identity relationships, persistent cross-agency identifiers, and a governance model covering rule ownership, exceptions, audit, and data-drift management.

Outcome. A clear recommendation on decisive quantitative separation: 98.9% F1 against 71.8% for the nearest alternative, with 89 of 92 validation clusters matched perfectly versus 47. Delivered with a phased roadmap and a governance model the agency could actually run.

SnowflakeAWS Entity ResolutionAWS GlueTilores TerraformKMSPythonPrecision / recall / F1

• Built and operationalized the gateway across dev, test, and production — API Gateway, a Node.js Lambda reverse proxy, Cognito as the OAuth 2.0 / OIDC authorization server with custom SMART scopes, and WAF, deployed with AWS SAM through CI.
• Designed the group-to-scope mapping that enforces limited-access behavior, separating a restricted test user from the full-access group so scope enforcement was provable to the auditor.
• Diagnosed production failures across a four-vendor boundary — access errors on production patient records, cross-vendor client authentication, and compression handling for large clinical payloads — driving vendor-side remediation.
• Authored the disaster-recovery control response for the client's system security plan, documenting the gap in native backup capability and specifying the export approach. A compliance artifact, not just an engineering one.
• Wrote and delivered the troubleshooting runbook and both client-facing runbooks, then led knowledge transfer across the client and vendor teams.

On the role. A colleague was technical lead; I was the implementation arm. The compliance artifact, the runbooks, and the knowledge transfer are mine — and the standard was new to the whole team at kickoff, which is rather the point.

SMART on FHIRHL7 FHIR R4OAuth 2.0 / OIDC / PKCEAmazon Cognito API GatewayLambda (Node.js)AWS SAMAWS WAF