02

Delivered at Scale.

Cloud Architecture

Two production-style AWS builds: one focused on fault tolerance under load, the other on independent deployability and cost efficiency.

CloudAWS
Fault-Tolerant AWS Admissions Architecture
Problem: a university application needed production-grade cloud infrastructure capable of surviving component failures without downtime, with no existing AWS architecture in place to build from. Designed and deployed a fault-tolerant architecture across two Availability Zones. EC2 instances run in private subnets behind an Application Load Balancer, with Auto Scaling validated to four instances under simulated peak traffic and Amazon RDS Multi-AZ synchronous replication providing database high availability.
2 AZ
Fault Tolerant
4x
Auto Scaling Validated
Multi-AZ
RDS Replication
AWSRegulated Industry
Pipeline Risk Modeling Platforms (Oil & Gas)
Directed multimillion-dollar, AWS-hosted SaaS implementations supporting probability-based risk modeling across transmission, distribution, and storage pipeline assets for major U.S. pipeline operators. Led cross-functional squads of 8 through requirements, UAT, and production deployment in full compliance with PHMSA, the federal framework governing U.S. hazardous liquid and gas pipeline operations.
⚡Transmission ›
🏠Distribution ›
🏭Storage ›
8→5 mo
Cycle Compressed for Filing Deadlines
8
Cross-Functional Squad Size
IntegrationsJira
LMS & Data Integration Programs
Problem: Canvas LMS operated in isolation from key institutional tools, leaving academic integrity, reporting, and student communications as manual, disconnected processes. Led a strategic vendor integration program on the Canvas LMS platform, used across hundreds of universities and colleges worldwide, coordinating directly with third-party vendors to deliver integrations (Turnitin, Power BI, SMS) aligned to institutional priorities and roadmap planning, managed and tracked through Jira.
🎓Canvas LMS ›
🔗Vendor Integrations ›
3
Vendor Integrations Shipped
Global
Platform Scale (Canvas LMS)
AnsibleIaC
Configuration Automation with Ansible
Extended a Terraform-provisioned infrastructure with a full Ansible configuration layer: four parameterized roles handling user and group provisioning with SSH key generation, data disk partitioning, and load-balanced Apache web server deployment across three Linux VMs. The Terraform provisioner triggers the Ansible playbook automatically, combining infrastructure provisioning and configuration into one non-interactive terraform apply. Troubleshooting included repointing end-of-life CentOS repositories to the archive mirror and resolving firewall configuration gaps blocking HTTP traffic.
4
Parameterized Roles
3 VMs
Non-Interactive Deploy

Simulated Attack Chain Case Studies

Three simulated AWS attack chains: privilege escalation via Lambda, privilege escalation via EC2 instance profiles, and a full SSRF to breach simulation modeled on the 2019 Capital One incident. The common thread is dangerous permission combinations, not single misconfigurations, being what actually gets exploited.

IAMLambda
Privilege Escalation via Lambda
Starting from a read-only IAM user, chained sts:AssumeRole, Lambda management permissions, and iam:PassRole to reach an overprivileged Lambda execution role. Deployed a payload that attached AdministratorAccess to the original low-privilege user, fully escalating access.
Read-Only
Starting Access
Admin
Ending Access
IAMEC2
Privilege Escalation by Attachment
Exploited a combination of iam:PassRole, ec2:RunInstances, and iam:AddRoleToInstanceProfile to swap a low-privilege role for an admin role on an EC2 instance profile. Stole temporary administrator credentials from the Instance Metadata Service and used them to terminate a protected EC2 instance, proving real impact.
IMDS
Credential Theft Path
Verified
Impact Proven
MFA / SSOPayments
Secure Portal & Authentication Enhancements
Implemented Multi-Factor Authentication and Single Sign-On across enterprise portals, and led the integration of a secure payment API with CIBC, one of Canada's largest Schedule I chartered banks, enabling students to transact directly within institutional platforms. Coordinated across security, engineering, and banking vendor teams, with the full payment flow validated through Figma prototyping before build. Production security work, not a simulated environment.
🔐MFA & SSO ›
🏢CIBC Payment API ›
MFA+SSO
Enterprise Auth Hardening
CIBC
Bank-Grade Payment API

Applied Agentic AI Case Studies

AgentsMulti-Model
AI Agent Enhancement Project
Expanded an existing AI agent from a basic prototype into a more product-oriented application. Added multi-model testing across OpenAI and Claude to compare response quality, performance, and operating cost, and scoped a usage dashboard covering token consumption, latency, and estimated spend.
2
Providers Compared
Cost
Aware Reporting
RAGAWS Bedrock
Intelligent Document Q&A System
Built a second, separate RAG pipeline on AWS: a Bedrock Knowledge Base with S3 Vectors for retrieval, Claude Sonnet 4.6 for grounded generation, and Titan embeddings, backed by Lambda, API Gateway, and DynamoDB for per-session conversation history, all provisioned through Terraform. Built to cloud security fundamentals from the start: least-privilege IAM roles, blocked public access on the source bucket, and scoped service-to-service trust relationships. Verified end-to-end via direct API calls, not just console testing, and confirmed the system correctly declines out-of-scope questions rather than hallucinating. Infrastructure was torn down immediately after testing to avoid ongoing charges.
S3 Vectors
Bedrock Knowledge Base
0
Hallucinated Out-of-Scope Answers
MLXGBoost
Binary Classification: Churn & Fraud Detection
Applied the same supervised-learning and imbalance-handling lens to two different rare-outcome business problems: telecom customer churn (roughly 26.5% positive class) and credit card fraud (roughly 0.17% positive class). Compared Logistic Regression and XGBoost across class weighting, SMOTE, undersampling, and threshold tuning for both. For fraud specifically, threshold-tuned XGBoost was selected as the practical business-balanced model: recall improved from 75.5% to 85.7% (missed fraud cases dropped from 12 to 7), trading precision down to 71.2% (false positives rose from 1 to 17), a deliberate, quantified trade-off rather than an unqualified win.
75.5%→85.7%
Fraud Recall, Threshold-Tuned
0.17%
Fraud Rate in Dataset