On-Prem Grafana to GitOps: Migrating Dashboards as Code
A deep dive into migrating a large set of on-prem dashboards to a GitOps workflow using the Grafana Operator.
Custom-home
DevOps Engineer • Security Researcher (TCM PJPT • MSc Cybersecurity)
Shaz's DevOps & Security Hub
Building Resilient Cloud Infrastructure, Hardened CI/CD Pipelines & Secure Architectures
Hands-on engineering across AWS, Kubernetes, Terraform, Go, Python, and Cloud & Network Security.
Systems & Security Engineering
Flagship Engineering Projects
Production-grade tools, automated security pipelines, and cloud native architectures.
Cloud Native Infra Production Architecture
Production EKS GitOps with ArgoCD & ESO
Declarative Kubernetes infrastructure deployed via Terraform on AWS. Features ArgoCD ApplicationSets for multi-environment syncing, External Secrets Operator (ESO) syncing with AWS Secrets Manager, and Trivy automated container vulnerability gating.
Zero-Tracking & Privacy Production Web Platform
Digital Amannah — Values-Based Digital Wellness Platform
A privacy-first digital safety platform built with Next.js App Router and React Server Components for zero client-side tracking. Features automated markdown content delivery, strict TypeScript type safety, and localized moderation workflows.
Full-Stack Architecture Open Source Web App
SubTrackr — Go Backend & Supabase RLS Subscription Engine
A full-stack subscription and recurring expense management platform engineered with a high-performance Go (Gin) REST API, React 18 frontend, PostgreSQL Row Level Security (RLS) policies, and automated email notification jobs.
Pipeline Security DevSecOps Automation
Hardened CI/CD & Keyless AWS OIDC Pipeline
Zero-long-lived-credentials CI/CD architecture replacing static AWS IAM keys with OpenID Connect (OIDC) identity federation in GitHub Actions, combined with automated Trivy vulnerability scanning and security regression checks.
Tech Stack & Core Expertise
Cloud & Infrastructure
- AWS (EKS, IAM, S3, NLB, VPC)
- Azure (Batch, SP, Blob)
- Google Cloud Platform
- Kubernetes & Kustomize
- Docker & Containerd
Security & Hardening
- TCM Security PJPT Certified
- Vulnerability Scanning (Trivy)
- Secrets Management (ESO, Vault)
- Hardened CI/CD (GitHub Actions)
- IAM OIDC & Least Privilege
Tools & Languages
- Terraform & OpenTofu
- Go (Golang) & Python
- Bash Scripting & Linux Hardening
- Grafana, CloudWatch, Kuma
- Tailscale WireGuard Mesh
Current Focus & Credentials
Professional Engineering
- DevOps Engineer at Seqera Labs
- Building secure CI/CD pipelines with Trivy automated vulnerability gating
- Automating secrets management with External Secrets Operator (ESO)
- Multi-cloud infrastructure as code automation with Terraform
Education & Research
- MSc Computer Science with Cybersecurity at University of York
- TCM Security PJPT (Practical Junior Penetration Tester)
- Verified Certifications: Credly Badges
- Active HackTheBox penetration testing & red-teaming labs
- Infrastructure as Code & Cloud Native Security Automation
My DevOps Journey
May 2025 - Present
DevOps Engineer
Seqera Labs
Building secure CI/CD pipelines with integrated security scanning, automating secrets management with ESO, and implementing infrastructure as code with embedded security baselines.
Kubernetes Terraform CI/CD Security
2024 - 2025
Cloud Support Engineer
Seqera Labs
Provided technical support for cloud infrastructure, troubleshooting complex deployment issues, and optimizing system performance across multi-cloud environments.
AWS Azure GCP Troubleshooting
2023 - 2024
IT Administrator
Cloudbeds
Managed enterprise IT infrastructure, implemented automation solutions, and maintained 99.9% system uptime while reducing support ticket volumes by 40%.
System Administration Automation Infrastructure
2022 - 2023
Infrastructure Technology Helpdesk Administrator
TractionOnDemand
Specialized in infrastructure support, network troubleshooting, and user technical assistance while building foundational DevOps skills.
Infrastructure Networking Technical Support
2021 - 2022
Application Support Analyst & Service Desk Analyst
Impellam Group
Started my tech journey in application support and service desk roles, developing problem-solving skills and technical foundation.
Application Support Service Desk Problem Solving
Expected August 2026
MSc Computer Science with Cybersecurity
University of York
Advanced studies in cybersecurity, focusing on threat detection, security architecture, and defensive strategies.
Cybersecurity Threat Analysis Security Architecture
Latest Technical Articles
Dynamic Node Provisioning on EKS: Migrating from Cluster Autoscaler to Karpenter
Scaling worker nodes in Kubernetes has historically relied on the Kubernetes Cluster Autoscaler. While Cluster...
Sep 22, 2026
Zero-Trust Pod Networking on EKS: Replacing kube-proxy and iptables with Cilium eBPF
As Kubernetes clusters scale to hundreds of microservices and thousands of active pods, traditional networking...
Sep 14, 2026
How We Sharded GitHub PR Previews: Dynamic Isolation and Zero Stale Infrastructure
Few things improve the developer feedback loop like ephemeral preview environments. Being able to open...
Sep 07, 2026
Replacing Static AWS Keys with OIDC: A CI/CD Publisher Walkthrough
How to harden GitHub Actions CI/CD by migrating from static AWS credentials to OIDC, scoped to specific S3 prefixes and branches.
Cross-Account S3 Access: Bucket Policies vs. Role Chaining
Best practices for cross-account S3 access in cloud-native compute environments, comparing bucket policies and IAM role chaining.
Debugging Azure Batch: Resolving Silent Failures with Healthy Service Principals
A troubleshooting guide for cases where Azure Batch jobs fail to run despite healthy identity logs and active service principals.
IRSA to EKS Pod Identity: Migrating a Multi-Controller Stack
A deep dive into migrating from IAM Roles for Service Accounts (IRSA) to EKS Pod Identity, featuring common cluster controllers like Load Balancers and Storage CSI drivers.
Firewall Configurations for Cloud-Native Enterprise Platforms: A Guide to Secure Network Access
A comprehensive guide to configuring firewalls, DNS allowlisting, and dynamic IP ranges for secure enterprise middleware and cloud-native application deployments.
My Approach to Securing CI/CD Pipelines (And Why I Stopped Focusing Just on Speed)
My journey from focusing on speed to embedding security into CI/CD pipelines, with practical tips for GitHub Actions.
Security Checklist for Service Account Tokens and PATs
A practical security checklist for managing service account tokens and GitHub PATs in DevOps workflows.
How to Purge Cloudflare Cache When Your CDN Serves Stale Files
A practical runbook for diagnosing stale Cloudflare edge cache and purging specific URLs with API or dashboard.
A Deep Dive into Kustomize for Multi-Env Setups
How I use Kustomize to manage Kubernetes configurations across different environments without duplicating YAML.