Migrations · Terraform · Hybrid networking · Cost optimization
AWS cloud engineer and technical account manager.
Over a decade in infrastructure and more than eight years hands-on with AWS. I build multi-account estates in Terraform, design identity that holds up under review, and run migrations where every step has a verification and a way back.
Open to remote roles in technical account management, IT operations, technical project management, and cloud engineering.
Certifications
Verify on Credly ↗Active
Selected figures
How to read the tagsWhat I do
Hands-on AWS engineering, and the technical account work around it: cost reviews, design options put in writing, vendor coordination, and handover.
Cloud migrations
Full on-premises estates moved to AWS one application window at a time, with the identity core last. Each runbook step has its own verification and rollback, and destructive steps disable before they delete.
Infrastructure as code
Terraform first, on reusable modules and AMI patterns, delivered through GitHub Actions and HCP Terraform across a 100+ account AWS estate. CloudFormation where a vendor ships it.
Identity and access
IAM least privilege, permissions boundaries, policy simulation before deploy, and OIDC workload federation across clouds. On the directory side: forest migrations, FSMO topology, and AD Certificate Services.
Technical account management
Four years as the technical contact on client environments: quarterly Well-Architected cost reviews, TCO models behind migration decisions, vendor coordination through change windows, and handoff documents written for the people who run the system next.
Case studies
Each one covers the problem, the key decision, what broke, and the figures with their sources. They’re a sample, not the full record.
-
Identity · Cross-cloud federation · Amazon Bedrock
Cross-cloud workload identity for Amazon Bedrock
OIDC federation from AKS into AWS, with trust conditioned on the exact service-account subject and the audience, and permissions checked with the policy simulator before go-live.
0quota tickets; applied quotas already met the target4IAM defects caught before production -
Migration · Active Directory · AWS networking
Migrating a full on-premises estate to AWS
A full on-premises estate moved to a three-AZ, Terraform-provisioned VPC in one vendor-coordinated change window per application, with the identity core last.
5 of 5FSMO roles transferred and verified6 daysbake gated on a single signal -
Active Directory · Discovery · Change safety
Retiring a domain controller that held every forest role
A log sweep of 480,000+ authentication events found twelve dependencies no inventory contained, and the fix went into the platform layer instead of every host.
480,000+site-less authentication events surfaced12undocumented dependencies found -
Storage · Cross-cloud · Cost-aware design
Moving compliance log archives into S3 Glacier
About 20 TiB of retained logs, a disposable zero-inbound transfer host, and a storage tier chosen for how the data might have to come back out.
~20 TiBsource-side baseline, two organizations~81%below hot-tier monthly cost -
IAM · VPC endpoints · Production change
Least-privilege S3 access and a gateway endpoint in production
Least privilege scoped as tightly as the use case allows, a blast radius verified at one route table, and a documented decision on which policy to leave for its own review.
1route table in the proven blast radius7design defects fixed before production -
PKI · Active Directory · Discovery
Consolidating certificate authorities and domain controllers
A discovery script that changed the plan, a certificate the standard listing showed as unused, and a CA recovery runbook in place before the consolidation took effect.
2 → 1enterprise root CAs4hidden consumers of a certificate listed as unbound
Other work
- Terraform-first delivery on reusable module and AMI patterns through GitHub Actions and HCP Terraform, across a 100+ account estate.
- Lambda failover for an SD-WAN appliance in AWS: health checks, route-table swaps across six subnets, and SNS alerts only on real failover or failback.
- Quarterly Well-Architected cost reviews: right-sizing, storage-class transitions, and Savings Plans.
- A monolithic metadata-ingestion batch process re-architected as serverless, later the foundation for business-intelligence reporting.
How the figures are sourced
Every figure on this site has a tag for the kind of evidence behind it.
- measured
Read from a live system during the work: command output, an API response, a console.
- documented
Recorded in something produced during the work: a runbook, a change record, an export.
- calculated
Arithmetic on other tagged figures.
- estimated
A model with a stated assumption. Always written with a tilde or a range.
- not measured
No baseline existed, so no number is given.
Savings figures
Hours and dollars saved only appear where a baseline was measured. For most of this work there wasn’t one, so those numbers are left out.
What broke
Each case study includes what went wrong and what was changed because of it.
Confidentiality
No employer, client, or colleague is named, and client details are generalized.
Background
I’m Gabe. I’ve spent more than ten years in infrastructure: seven in-house, working up from the help desk to owning the architecture and the budget, and four at a managed cloud provider as the technical contact for client environments, most of them in regulated industries.
In-house, I learned what it takes to own a system for years. At the provider, I worked across far more environments than one company has, and spent a lot of that time explaining options and risk to the people who had to make the call.
What I’m looking for
A remote role connecting the engineering to the people who depend on it: technical account management, IT or cloud operations, or technical project management. Hands-on cloud engineering fits too. AWS preferred, with an infrastructure focus: migrations, networking, hosting, backup and DR, and cost.
-
2022 – 2026
Cloud Infrastructure Engineer
Managed cloud provider · remote
- Delivered AWS environments Terraform-first through GitHub Actions and HCP Terraform, across a 100+ account estate.
- Lead engineer on full-estate AWS migrations, identity core included.
- Technical contact for client environments: quarterly Well-Architected cost reviews, TCO models, and vendor coordination through multi-year modernizations.
- SOC 2 and audit evidence, DR testing, and Tier-3 escalation for the team’s hardest AWS problems.
-
2022
Systems Engineer, contract
Five months · remote
- Migrated multi-site practice-management systems from on-premises servers to Azure.
-
2015 – 2022
IT Technician → IT Manager / Systems Architect
In-house · global music distributor
- Promoted through system administrator and system engineer to owning infrastructure, security posture, the IT roadmap, and budget.
- Hands-on with AWS from 2017: S3, Glacier, and Snowball for backup and recovery, and a cloud-based secure SFTP replacement stood up in under two weeks.
- Migrated and upgraded 98 Hyper-V servers and took the network backbone to 40 Gbps.
- Remote work for 90+ staff, and vendor coordination across four countries.
Contact
Email is the fastest way to reach me. My full résumé, with employers and dates, is available on request.