Network Engineer · Cloud Architect
CCNP and AWS SAA certified IT professional specializing in hybrid cloud connectivity for healthcare environments. BGP route policy, IPSec tunnels, and Terraform-provisioned infrastructure across AWS and Azure.
I design, build, and operate cloud infrastructure across AWS and Azure, from the network layer all the way up to the pipelines and applications running on top of it. That means Terraform and Bicep defining the environment, CI/CD through Azure DevOps and GitHub Actions shipping it, AKS and Azure Functions serving the workloads, and the BGP routing, IPSec tunnels, and firewall policy that connect on-premises systems to the cloud safely.
For the past several years I have done this work in healthcare, where the systems I run are part of clinical infrastructure and downtime is not an option. My CCNP background gives me a routing and switching foundation most cloud engineers do not have, and my AWS Solutions Architect certification formalizes the cloud and DevOps side. I work comfortably on both sides of the VPC boundary, which is exactly where hybrid-cloud problems tend to live.
Six reproducible labs. Every AWS resource provisioned with Terraform.
Two FRR routers peered over an IPSec tunnel in AWS. This is the exact protocol stack behind AWS Direct Connect: eBGP over encrypted transport, route advertisements flowing between autonomous systems. The terminal shows a captured snapshot from a real session that stayed established for over five weeks.
Spun down to keep cloud cost at zero between demos. The full stack (VPCs, EC2, FRR, IPSec, IAM, Lambda) redeploys from Terraform in a few minutes.
AS 65001 ←── eBGP / TCP 179 / IPSec ──→ AS 65002
IKEv2 IPSec tunnel between two AWS VPCs using strongSwan, simulating a production hybrid environment. Encrypted connectivity established, routes propagating across the tunnel, and end-to-end reachability verified between the networks.
View on GitHub →Hub-and-spoke topology across three VPCs: Shared Services at the center, Prod and Dev as isolated spokes. Each spoke reaches shared resources. They cannot reach each other. This is the standard segmentation pattern for enterprise-scale AWS environments.
View on GitHub →Production-grade fault tolerance: ALB distributing traffic across an Auto Scaling Group in two Availability Zones, with Multi-AZ RDS in private subnets. Failover tested by terminating instances and verifying automatic recovery.
View on GitHub →A parameterized Terraform module that provisions a complete VPC from a single definition. Instantiated with different inputs for prod and dev, eliminating configuration drift between environments. This is the pattern used in production IaC at scale.
View on GitHub →VPC Flow Logs piped to CloudWatch with custom Logs Insights queries for detecting rejected connections, unusual traffic patterns, and lateral movement. Rejection alarms and a live dashboard built for real incident investigation, not just log storage.
View on GitHub →Writing on cloud networking, infrastructure, and the work behind the portfolio.
From a Cardano stake pool on Linode to hybrid cloud infrastructure at scale. The journey from enterprise networking to cloud, and why 2026 is the right time to go deeper.
Read article →Most engineers have read about BGP. I wanted to show it. What building a queryable live routing lab in AWS taught me about the gap between certifications and production networking.
Read article →Have a question or want to connect? Let's talk.