I build the infrastructure, then I secure it
I'm a platform engineer with 15+ years building and running data systems at enterprise scale — Kafka, Hadoop and CDP in production, including at MNC scale. I came to security from the side that has to keep the thing running.
- AWS Certified Security – Specialty
- AWS Certified Solutions Architect – Associate
- CNCF Certified Kubernetes Administrator
Most cloud security content is written from the attacker's chair or the career-changer's. Mine is written from the chair of the person who has to ship the infrastructure, secure it, and then prove to somebody else that the control works. Those are three different jobs and they are usually taught by three different people.
So I went deep on AWS Security and specialised in the part almost no individual practitioner owns end to end: Australian financial-services compliance on AWS — APRA CPS 234, CPS 230, and the Essential Eight. Securing data at scale taught me what an auditor actually asks for, which is rarely what a dashboard shows.
AiOpsOne is where I publish that work in the open — free, ungated, and run against a deliberately broken AWS account so every claim is demonstrable.
What I practise
Four disciplines, in the order work moves through them. Each one is written up on this site — this is a map, not a list of claims.
DevOps
Infrastructure as code, pipelines, and the boring reliability work security depends on. You cannot gate a pipeline you do not have, and you cannot secure infrastructure nobody can rebuild. Terraform state, CI runners and their blast radius, environments that are actually reproducible.
15+ years running this in production, including at MNC scale.
Foundations trackDevSecOps
Gates that stop known-bad reaching the account: secrets scanning before commit, SAST in the pull request, dependency and container scanning, and IaC checks that block a merge rather than an apply. The point is not owning every tool — it is knowing which finding to act on and which to suppress honestly.
Every gate demonstrated against the same three deliberately broken artifacts.
Secure the Pipeline trackSecOps
Detection and response in the live account, because prevention leaks. GuardDuty, Security Hub and Config correlated into something a human can triage, posture assessed continuously with Prowler, and remediation automated through EventBridge and Lambda where the fix is unambiguous.
Written up against a real account with real findings, not a screenshot tour.
Detection & responseCompliance
Turning what the pipeline and the account already produce into evidence an auditor accepts. APRA CPS 234 and CPS 230, the Essential Eight, ISO 27001 and SOC 2 — mapped to specific AWS controls rather than restated as policy. SBOMs, scan results and signed provenance are the evidence; almost nobody connects them.
The strongest cluster on this site — nine lessons and counting.
Compliance & evidenceHow the lessons get made
Nothing here is written from documentation alone. Each lesson is built against the Range — a deliberately vulnerable app, image and Terraform stack — then run end to end, corrected where reality disagreed with the plan, and only then published. When a lesson says a command works, it worked on the date shown against it.
The data-platform years are the bridge, not baggage
Kafka ACLs, Hadoop delegation tokens and CDP access control are the same problems as IAM and encryption at rest, wearing different names. The free Big Data tools built in that period — YARN calculator, HDFS planner, Spark sizer, queue designer — are still live and still free. Use the tools →