Contributor to the Kubernetes and cloud native ecosystem, with merged changes in three CNCF projects and a maintained OpenTofu module library.

• CoreDNS: authored new `timeouts` plug-in, making DNS server connection and read timeouts configurable allowing for better resilience on mobile and other high latency networks. Merged and now part of the default cluster DNS server for Kubernetes.
• Prometheus: identified that AWS EC2 service discovery silently dropped IPv6 only instances. Authored the fix that is now now merged and released.
• external-dns: added automatic AAAA Route 53 alias record support, resolving two long-standing upstream issues and reviving an abandoned PR.
• OpenTofu module library: author and maintainer of 30 published modules covering compute, networking, identity, storage, databases, ingress and CDN across AWS, Azure and Cloudflare, plus ArgoCD and cert-manager deployment resources. Actively used in production client work.

Built the company's first environment-agnostic modern infrastructure as code capability, converting a manually configured, virtual machine–based Azure estate into code using OpenTofu (Terraform) and Terragrunt, with remote state managed in Azure Storage.

• Designed code to be reusable, so new environments could be provisioned rapidly to meet changing business needs rather than hand-built - including three development environments and the short-lived infrastructure that unblocked a major Microsoft SQL Server upgrade.
• Rolled the capability out incrementally, from the initial QA environment through development and into parts of production, with a clear path to full production ownership as the business adopted it.
• Implemented a granular delegated access model using Azure resource groups and Azure AD groups: only administrators could bootstrap a new project, after which only authorised groups could provision resources into it - enforcing least privilege by default.
• Introduced HashiCorp Packer to build a hardened Ubuntu base image with the required security agents and tooling baked in, then layered service images for SFTP, SMTP and other Linux services on top. This delivered consistent, up-to-date images rolled out in a controlled manner.
• Automated the build and deployment chain with YAML pipelines in Azure DevOps. Documented the platform thoroughly - architecture, run books and decision records - to keep it maintainable by others.
• Trained existing engineers onto the new tooling and working practices, leaving the business with a team able to continue developing the platform without external dependency.

Delivered across two concurrent engagements: a greenfield Kubernetes platform on Amazon EKS and middleware integrations for a major student records system replacement.

• EKS Platform:
• Designed and delivered a greenfield Kubernetes platform on Amazon EKS end to end, owning all technical decisions and working directly with the IT manager to ensure the platform met business requirements.
• Migrated workloads off on-premises and EC2 onto the platform, including 4 public web services, the entire Prometheus/Grafana/Loki monitoring stack and internal developer tooling, with new services deployed natively from day one. EC2 and some on-premises servers were then retired.
• Managed all infrastructure as code using Terraform and Terragrunt with S3 remote state, with Helm used for cluster bootstrap and ArgoCD for GitOps based application deployment.
• Hardened the platform with least-privilege workload access using IAM Roles for Service Accounts (IRSA) and KMS-backed envelope encryption of Kubernetes secrets.
• Enabled developer self-service for two development teams, who could deploy via ArgoCD and diagnose issues directly with Grafana, Prometheus and Loki without waiting on infrastructure engineers - measurably reducing support tickets and unblocking delivery.
• Benchmarked and validated IPv6 and ARM (Graviton) support, leaving both implemented and ready behind feature flags pending business readiness.
• Trained a second DevOps engineer to operate and extend the platform whilst supporting developers through on-boarding.
• SITS Integration Programme:
• Delivered more than 10 event-driven integrations in the middleware layer for a business-critical student records system replacement, as part of a much larger successful multi-team programme.
• Integrated SaaS, off-the-shelf and in-house products across AWS and Azure using Lambda, SNS, SQS, Azure Functions, Logic Apps and Service Bus, implementing dead-letter handling and tuned concurrency to manage downstream throttling.

• Implemented Azure Front Door for a multi-tenant application (~450 tenants), using caching, compression and a CDN to serve static content from regional edge locations and improve both performance and resilience.
• Deployed a Web Application Firewall in audit mode first, then progressively enabling rules - identifying multiple attack patterns and scraping activity against the application. Advisories also produced for application changes needed to enable stricter filtering.

Took ownership of an established multi-tenant Kubernetes platform on Azure (AKS) serving three customers and led its stabilisation and evolution.

• Automated recurring manual support work, including TLS certificate life-cycle management with cert-manager, plus a Prometheus exporter providing alerting on manually issued certificates used for client authentication into customer systems.
• Stabilised a legacy estate where application containers were built as virtual machines - complete with init systems, cron daemons and multiple processes per image - leaving them hard to patch and prone to expiry. Rebuilt them as proper single-process containers so runtime components could be updated independently of the image.
• Brought the hand-built clusters under management, defining them properly in Terraform so upgrades were repeatable and no longer a matter of tribal knowledge.
• Consolidated sprawling Azure DevOps build pipelines into shared YAML libraries. Introduced Terraform for all new service provisioning.
• Introduced ArgoCD, extending the existing self-service model so developers could version control their application configuration and deploy through to production without DevOps intervention.
• Implemented Thanos to federate metrics across eight clusters and offload historical data to S3. This addressed a genuine scalability problem rather than a convenience one: heavy use of micro services was forcing in-cluster Prometheus instances to consume more memory than their nodes had available.
• Worked with a small development team (2–3 developers) to take a new product from inception to launch in around four weeks, with production-ready infrastructure - ArgoCD project and applications, CI pipelines and Azure AD service principal integration - available within hours of request, using the IaC foundation already established.

• Built a greenfield Kubernetes platform on AWS from scratch, containerising SAP Commerce (Hybris) e-commerce workloads for major UK retailers including Mammas & Papas, Evans Cycles and Joules - delivered as two clusters per customer (development and production) using kOps, before managed EKS existed.
• Reduced steady-state infrastructure for the flagship account from 16 always-on on-premises servers to roughly three server-equivalents of containers running on smaller, cheaper instances.
• Designed for elasticity at peak sales events, scaling automatically from that baseline to more than 25 nodes with no queueing or latency and no manual intervention, supporting seven figure trading days.