A selection of infrastructure and platform work I've led, from cloud migrations and cost optimization to automation and open source contributions.
Ongoing
Platform teams hand-write the same VNet, subnet, and PaaS Terraform over and over, and mistakes like overlapping RFC 1918 subnet CIDRs, missing NSG associations, or publicly exposed PaaS resources usually get caught in PR review or after deploy. VisualTF shifts those checks to design time: lay out an Azure topology on a drag-and-drop canvas, and a client-side graph-to-HCL compiler runs policy validation passes across the resource graph (checking CIDR bitmask overlaps, Private Endpoint wiring, and TLS/SKU baselines) while emitting idiomatic Terraform HCL in real time. Runs 100% client-side in the browser with zero cloud credentials required.
Outcome: Azure topology compiler and real-time guardrail engine live today (try the interactive demo below). Next on the roadmap: custom module import and AWS/GCP provider targets.
Related: How I Built VisualTF: Catching Terraform Misconfigurations Before Code is Written
2025-Present
Recurring infrastructure degradations (hung terminating pods, node-level kubelet/CNI pressure, and transient upstream connection pool exhaustion) were generating repetitive on-call pages, while feature deployments occasionally landed during active reliability incidents. I engineered event-driven Go and Python remediation workers triggered via Alertmanager webhooks with bounded retry budgets and circuit breakers, and integrated Prometheus multi-window error budget burn-rate checks directly into CI/CD pipelines alongside policy-as-code (OPA/Conftest) and container vulnerability scanning.
Outcome: Eliminated 12+ hours per week of manual operational toil, prevented risky releases during high error-budget burn periods, and ensured on-call engineers are only paged when automated remediation cannot restore SLI health.
Related: SLIs, SLOs, and Error Budgets: The Foundation of SRE
Ongoing
I use the AzureRM Terraform provider every day, for work and personal projects, so when a feature the Azure REST API supports isn't yet exposed in Terraform, I contribute the fix upstream rather than falling back to fragile ARM/CLI workarounds outside of state. The provider is written in Go, so each contribution involved implementing resource schemas, state migration/import functions, Azure SDK API mappings, and end-to-end acceptance tests provisioned against live Azure subscriptions.
Outcome: 5 merged pull requests in hashicorp/terraform-provider-azurerm adding new resources, runtime version parity, import fixes, and state consistency patches.
Related: I Contributed to the AzureRM Terraform Provider Instead of Waiting for Someone Else To
2022-2025
Architected and scaled a multi-tenant Azure Kubernetes Service (AKS) platform across 600+ Linux nodes and 120+ production services using modular Terraform and Helm. Solved key scale constraints including Azure CNI subnet IP exhaustion, outbound SNAT port exhaustion via managed NAT Gateways, noisy-neighbor isolation through namespace ResourceQuotas and NetworkPolicies, zero-trust secret delivery via Azure Key Vault CSI Driver, and zero-downtime Kubernetes upgrades using PodDisruptionBudgets and surge node pools.
Outcome: Maintained 99.99% multi-region availability, standardized blue/green and canary Helm rollouts, and cut new service onboarding time from days of manual ticket handoffs to self-service InnerSource PRs.
Related: Building SRE-Grade Observability: Deploying Grafana and Prometheus on AKS
2021-2024
Led the infrastructure architecture and cutover from deprecated Azure Cloud Services (Classic) Web/Worker Roles (which suffered from 20+ minute redeployments, manual OS patching, and legacy TLS 1.0/1.1 dependencies) to a modern multi-region Azure App Service topology. Built the target environment from scratch in reusable Terraform modules with VNet integration, Private Endpoints, and staging deployment slots for side-by-side synthetic and golden-signal verification before weighted DNS cutover, while mentoring 2 to 4 engineers on the new IaC patterns.
Outcome: Migrated a platform generating tens of millions in annual revenue with zero customer-facing downtime, maintaining 99.99% uptime across US and EU regions and reducing on-call escalations to roughly once every six months. The reusable modules became the organization's default IaC standard.
Related: Beyond 'You Build It, You Run It': Why Collective Ownership Scales Better
2021-2024
Production compute, AKS node pools, App Service Plans, and managed databases had accumulated significant over-provisioning from legacy peak-load estimates. Rather than blindly downsizing based on average CPU, I analyzed 30-day P95/P99 resource utilization alongside latency and saturation SLIs in Prometheus and Azure Monitor, right-sized compute and storage tiers within safe error-budget margins, and automated cleanup of unattached disks, orphaned snapshots, and idle non-production capacity.
Outcome: Reduced recurring Azure cloud spend by $12K+ per month ($144K+ annualized) with zero degradation to P99 latency or availability SLOs.
2021-2024
Owned end-to-end cloud lifecycle and deprecation governance across multiple product teams so platform retirements landed systematically rather than as emergency scrambles. Built automated inventory queries using Azure Resource Graph and audited client TLS handshakes via Log Analytics (KQL) to pinpoint services still negotiating TLS 1.0/1.1 before enforcing TLS 1.2 minimums across Azure Cache for Redis and upgrading legacy Azure Storage accounts.
Outcome: Completed 100% of fleet migrations ahead of Microsoft's enforcement deadlines with zero unplanned outages across all affected applications.
2021-2024
Monthly capacity planning required 10+ engineers and product leads to manually pull compute, memory, storage growth, and regional subscription quota metrics across subscriptions, taking 30+ minutes per report and frequently introducing spreadsheet errors. I built a Python automation tool that queried Azure Monitor and resource utilization APIs, aggregated 30-day growth trends and headroom projections, and generated standardized capacity reports on demand.
Outcome: Cut report generation time from 30+ minutes of manual spreadsheet work to under 2 minutes across 10+ monthly stakeholders, eliminating human error and surfacing quota bottlenecks weeks earlier.