Nothing unscanned or unsigned reaches production.
DevOps & System Support Engineer with 3.5+ years running high-availability production systems across AWS, Azure and on-premises estates — with a DevSecOps focus: secure SDLC gating, SBOM and supply-chain security, container image scanning and signing, CIS server hardening and SIEM-backed monitoring.
An engineer who understands what happens after code leaves Git.
I started as a developer building business platforms, then moved to the side of the wall where those platforms have to actually run, stay up, survive an audit and come back after a failure. That path is the whole point of how I work now.
I've shipped the software
CRM, HRMS, e-commerce and SaaS platforms in Java, Node.js, React/Next.js and PHP. I know what a release contains before I'm asked to deploy it.
I run what it runs on
Linux estates, AWS and Azure, private Docker networks, Nginx, TLS, DNS, load balancing, databases and site-to-site tunnels — cloud and bare metal.
I gate the path between them
Blocking pipeline gates, not advisory checks. Secret scanning, SAST, SCA, SBOM, image scanning and signature verification before deploy — plus CIS hardening and SIEM on the other side.
I'm there when it breaks
Disks filling, registries refusing pushes, sockets dropping behind Nginx, tunnels flapping, voice containers restarting — and the disaster recovery when something is genuinely gone.
I don't just deploy applications.
I understand the infrastructure behind them.
Infrastructure automation
Role-based Ansible playbooks and shell/Python tooling standardising server build-out across AWS, Azure and bare-metal estates — removing manual steps rather than documenting them.
High-concurrency tuning
Linux kernel, file-descriptor and ulimit tuning plus Nginx parameters for real-time VoIP workloads — reverse proxy, rate limiting, SSL termination and load balancing under peak call load.
Audit-ready operations
A maintained security evidence pack — gate results, SBOMs, scan and signature-verification reports, patch compliance and restore-test records — used to answer client and audit questionnaires.
I've built the applications, which is why I understand the infrastructure under them.
Before and alongside the infrastructure work I delivered production business software — CRM, HRMS, e-commerce, business websites and multi-tenant SaaS. Today I own the platforms that run them: 9+ concurrent production platforms, plus a contact-centre system where my work is deployment, security and server optimisation rather than application development.
Writing the application taught me what to instrument. Operating it taught me what to fix.
Client and product brand names are deliberately omitted; the platform category describes the work.
Pipeline-as-code, artefacts promoted — never rebuilt per environment.
Jenkins declarative pipelines and AWS Code services covering build, artefact publishing, approval gates and controlled release across Testing, UAT and Production.
Docker, Compose, Swarm
Dockerfiles and multi-stage builds, Compose stacks, Swarm services across manager and worker nodes, overlay networks, persistent volumes, CPU and memory limits and restart policies. Images published to Amazon ECR and a private OVH registry, with the image lifecycle and versioning managed rather than improvised.
Ansible, Kubernetes, GitOps
Role-based Ansible playbooks for server configuration, patching and repeatable deployments, removing manual build-out. Kubernetes and EKS at a deploy-and-debug level — pods, deployments, services, requests and limits — with ArgoCD for GitOps-style reconciliation.
Stated honestly: I deploy to and troubleshoot Kubernetes. I have not architected a large-scale multi-tenant Kubernetes platform.
// Jenkinsfile — stage shape across services pipeline { agent any environment { CREDS = credentials('runtime-bound') } stages { stage('Set Environments') { /* per-env config */ } stage('Application Build') { /* deps · compile */ } stage('Security Audit') { /* BLOCKING — sheet 5 */ } stage('SBOM') { /* syft → cyclonedx */ } stage('Docker Build & Push') { /* build · sign · push*/ } stage('Deploy Application') { /* verify · roll out */ } } }
Blocking gates, not advisory checks.
Most pipelines run security tools and email the findings. Mine stop the build. Select a gate to see what it checks and what specifically fails the pipeline.
Secret scanning
Gitleaks runs on every commit, so a credential that reaches the repository is caught at the point it enters rather than during a later audit. Findings are redacted in pipeline output so the scan itself doesn't leak the secret it just found.
Security belongs in the pipeline, not in a review at the end.
Every release knows exactly what it is made of.
An automated CycloneDX/SPDX SBOM per build, stored as a versioned artefact tied to the release number, scanned for known vulnerabilities and tracked in a central inventory portal — with a defined process for sharing SBOMs with clients under NDA.
A CVE lands on a Tuesday
With a per-release SBOM inventory, "are we affected?" is a query, not an archaeology project. Dependency-Track already knows which releases carry the component and which platforms are running them.
Generation & scanning
Syft and cdxgen for generation, trivy image --format cyclonedx for container inventories, Grype for vulnerability matching against the SBOM.
Inventory & disclosure
OWASP Dependency-Track as the inventory and tracking portal, SBOM artefacts versioned against build and release numbers, and a defined NDA-bound process for sharing them with clients.
Four clouds and bare metal, one set of fundamentals.
Compute, networking, storage, identity and cost look different in each console and behave the same underneath. What I operate, what I work with, and what I know at an architecture level — separated honestly.
Amazon Web Services
- Compute
- EC2 · AMIs · instance sizing · EBS · ENIs · user-data bootstrapping · Auto Scaling Groups
- Networking
- VPC · public & private subnets · route tables · Internet Gateway · NAT Gateway · Security Groups · NACLs · CIDR planning · VPC peering · VPC endpoints · Route 53
- Load balancing
- ALB and NLB · target groups · listeners · health checks · host- and path-based routing · ALB in front of Auto Scaling Groups
- Delivery services
- CodePipeline · CodeBuild · CodeDeploy · Elastic Container Registry with scan-on-push
- Storage & edge
- S3 · presigned URLs · CloudFront · AWS WAF
- Identity & security
- IAM users, roles and least-privilege policies · AWS Secrets Manager · GuardDuty · Security Hub · CloudWatch metrics, logs and alarms
- Data
- RDS · EKS for containerised workloads
The listener terminates TLS on :443. Rules are evaluated in priority order and the first match wins — a path condition on /api/* forwards to tg-api, whose health check (GET /healthz, 200 expected) decides which registered instances are eligible. Only healthy targets receive traffic; the Auto Scaling Group registers and deregisters them as it scales.
VMs, networking & AI services
Virtual Machines, Load Balancer, Virtual Networks, subnets and NSGs, public/private IPs, Azure Storage and Blob Storage, Key Vault. Subscription and resource management, monitoring, billing and cost analysis — plus Azure OpenAI deployments and token-usage analysis as production AI infrastructure.
Lean VM infrastructure
Droplets with public and private networking and Spaces object storage; OVH virtual machines running production workloads behind a private container registry, including registry authentication and image-publishing troubleshooting.
Where there is no managed service
Bare-metal and on-prem estates where there is no cloud load balancer, no managed database and no console — so high availability, load distribution and backup have to be built rather than enabled. FortiGate firewalls handle point-to-point links and IPsec tunnels out to client networks and Azure.
Most "application bugs" in production are network problems.
Routing, name resolution, certificates, proxy headers and firewall rules account for a large share of what actually breaks.
Addressing & transport
IPv4 addressing, CIDR and subnetting, network and broadcast addresses, TCP/IP, ports and sockets, routing tables, DNS resolution and firewall rule design across cloud security groups and host firewalls.
# VPC address plan — a worked example VPC 10.20.0.0/16 65,536 addresses public-a 10.20.1.0/24 .0 network · .255 broadcast 251 usable (AWS reserves 5) private-a 10.20.10.0/24 no IGW route → NAT egress private-db 10.20.20.0/24 reachable only from app SG
The tools I reach for first
Before reading application logs I establish whether the packet arrived at all — resolution, reachability, listening socket, TLS handshake, then payload.
Edge stack: Nginx reverse proxy with SSL/TLS termination, routing, caching, rate limiting and an API gateway layer; Let's Encrypt certificates; WebSocket and WSS upgrade handling; DNS and Route 53; StrongSwan IPsec and FortiGate site-to-site tunnels.
# Nginx — the WebSocket upgrade that quietly breaks WSS location /ws/ { proxy_pass http://127.0.0.1:8088; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $host; proxy_read_timeout 3600s; # long-lived sockets } # API gateway — rate limiting on auth and OTP endpoints limit_req_zone $binary_remote_addr zone=auth:10m rate=5r/m; location /api/auth/ { limit_req zone=auth burst=3 nodelay; }
The server is a control surface, not just a host.
Production servers hardened to CIS benchmarks and kept that way — with a SIEM watching for drift rather than an annual review discovering it.
CIS benchmarks, enforced
Dedicated non-root users, key-only SSH through a bastion/jump server, UFW default-deny mirrored at cloud security-group level, MFA on privileged access, ulimit and file-descriptor tuning, and patch SLAs rather than ad-hoc updates. Assessed with Lynis and OpenSCAP.
SIEM, FIM & drift detection
Wazuh across the server estate for SIEM, file-integrity monitoring and CIS configuration assessment, with alerts correlated to MITRE ATT&CK and Falcon runtime protection alongside. Fail2Ban and Nginx rate limiting for brute-force, plus OpenVAS and scheduled OWASP ZAP baseline scans.
Nothing lives in the repo
HashiCorp Vault, AWS Secrets Manager and Azure Key Vault for credential storage, with runtime-bound Jenkins credentials so secrets are injected at execution rather than baked into images or pipeline definitions.
The Docker estate, minimised
Minimal pinned base images, non-root containers, private Docker networks, databases kept off public interfaces entirely, and registry scan-on-push enabled in Amazon ECR. The attack surface is reduced at build time, not patched at runtime.
Know it broke before someone tells you.
Fleet-wide metrics, alerting, and custom checks for the things off-the-shelf exporters don't cover.
# cron → textfile collector: turn any check into a metric code=$(curl -s -o /dev/null -w '%{http_code}' "$URL") up=$([ "$code" = "200" ] && echo 1 || echo 0) cat > "$DIR/site_health.prom.$$" <<EOF # HELP site_up 1 if the endpoint returned 200 # TYPE site_up gauge site_up{site="$NAME"} $up EOF mv "$DIR/site_health.prom.$$" "$DIR/site_health.prom" # atomic
Hosts, containers, services, calls
CPU, memory and disk across the fleet; container state and resource use; website and endpoint health; FreeSWITCH and Asterisk service health; log analysis to trace call failures, latency and resource exhaustion; and cron-driven automation for checks that must run on a schedule.
A backup you have never restored is a hypothesis.
High availability, database replication, encrypted off-server backups and scheduled restore testing — recorded as audit evidence, and proven once in a real recovery.
Removing single points of failure
Load balancing built on on-premises infrastructure, distributing traffic across multiple backend nodes where no managed cloud load balancer was available — plus ALB/NLB and Auto Scaling in the cloud estate.
MySQL and MongoDB
Database replication across MySQL and MongoDB with encrypted, off-server backups and scheduled restore testing, so recovery capability is verified rather than assumed.
Executed, not just planned
A real disaster-recovery operation — production services and data restored from replicas and backups, 90% faster than a manual rebuild, with no permanent data loss.
I/O layout under load
Server file-system and disk I/O layout optimised to separate call-recording, logging and application workloads so they stop contending — clearing slowdowns that previously appeared only at peak call volume.
Rate limiting & API gateway
An Nginx-based API gateway with stricter limits on authentication and OTP endpoints, burst handling and per-IP controls — protecting upstream services from brute-force and API abuse.
Real incidents, traced to root cause.
A tool list says what I've touched. These say how I think — problem, investigation, root cause, solution, outcome.
01Production disk usage climbing until it threatened the serviceLinux · Storage · Log management+
Problem
Investigation
df -h to find the pressured mount, then du depth by depth through /var. Examined application logs, Docker container and JSON log files, Nginx access and error logs, Asterisk call recordings and container data directories, and identified which services were writing most.Root cause
Solution
Outcome
02Container registry rejecting image push and pullDocker · Private registry · CI/CD+
Problem
Investigation
- Registry authentication and credential state
- Image naming and tags against the registry namespace
- Docker daemon behaviour and configuration
- Network reachability to the registry endpoint
- Layer upload behaviour — where transfers stalled
- Registry availability and storage state
Root cause
Solution
Outcome
03MongoDB reachable from Compass, refusing the applicationDatabases · Docker networking · Auth+
Problem
Investigation
- Authentication mode and auth database
- Users, roles and per-database grants
- Connection string construction including authSource
- Docker network topology — service name vs host vs published port
- Process state and persistent volume mounts
Root cause
Solution
Outcome
04WebSocket connections failing behind Nginx over TLSNginx · TLS · WSS · DNS+
Problem
Investigation
- DNS resolution for the hostname the client actually used
- Certificate validity and SAN coverage for that exact hostname
- TLS handshake with
openssl s_client - Nginx location matching and proxy configuration
UpgradeandConnectionheaders on the proxied request- Upstream reachability and read timeouts
Root cause
Solution
Outcome
05Built incident capture around containerised FreeSWITCHVoice infrastructure · Automation · Observability+
Problem
Investigation
Root cause
Solution
Outcome
06IPsec tunnels dropping on a periodic cycleVPN · StrongSwan · FortiGate+
Problem
Investigation
- Tunnel and security-association state over time
- IPsec configuration on both peers, including proposal agreement
- IKE and child SA lifetime and rekey behaviour
- Whether disconnects correlated with a fixed interval
- Service state and what recovery actually restored
Root cause
Solution
Outcome
07Client website had to clear a major platform's security auditApplication security · Remediation · Release approval+
Problem
Investigation
Root cause
Solution
Outcome
Real-time infrastructure, where latency is not negotiable.
Voice shapes how I think about everything else: media has to arrive in tens of milliseconds, signalling and media take different paths, and there is no retry. This is infrastructure engineering for contact-centre and voice systems — not telecom application development.
Asterisk · FreeSWITCH · SIP
Deploying and operating voice servers including containerised FreeSWITCH and Asterisk/FreePBX estates. SIP trunking and inter-server routing, dialer and contact-centre workloads, recording storage, audio streaming, and the networking voice depends on — NAT behaviour, RTP port ranges, ACLs and VPN routing between sites. Includes deploying and commissioning an outbound dialer on client premises, from on-site install to live production.
On the contact-centre platform the scope is explicitly infrastructure, not the product: release deployment, server security hardening, and the kernel, file-descriptor, I/O and Nginx optimisation that keeps the call experience smooth at peak volume.
Deployment, integration, operation
Provisioning and wiring the services this loop depends on — Azure OpenAI deployments, speech-to-text and text-to-speech, self-hosted models via Ollama, TTS voices for IVR prompts, and the Node.js services stitching telephony to those APIs. Then keeping the path observable and within budget.
Not an AI researcher
I don't train models or do ML research. I deploy them, integrate them into real-time telephony, size the infrastructure they run on, track token consumption against cost, and debug the path when a call goes silent.
That distinction matters — the value I add is that the AI actually works on a live call.
What changed because the work was done.
Two figures I can stand behind, and the rest stated as outcomes rather than invented percentages.
Figures shown are the two I can substantiate. Nothing else here is expressed as a percentage, and no uptime, traffic, user or cost-saving number is claimed.
Systems I keep running.
Infrastructure ownership rather than one-off project delivery.
Convoze
Own the infrastructure and the DevSecOps toolchain for a speech-analytics platform — secure-SDLC gates, container image scanning and signing, the SBOM inventory and the evidence pack presented in client security due-diligence reviews.
Xeny
Infrastructure architecture connecting voice systems to AI services for real-time interaction — telephony into audio streaming into STT, LLM and TTS and back to the caller, inside a conversational latency budget.
Justtawk
I don't build the product — I run what it runs on. Deployments and release rollout, server security hardening, and the optimisation that keeps calls smooth under load: SIP routing, recording storage, monitoring and the networking that holds it together.
Ringingo
Administer and operate a multi-tenant cloud PBX on FreeSWITCH and Asterisk, including a second regional deployment — VPN routing, inter-server SIP trunking and ACL work between sites, plus the tuning that keeps concurrent call volume stable.
HRMS Platform
Deployments, infrastructure and environment stability for the employee lifecycle, payroll and internal operations modules of an enterprise human-resource management system.
Platform Portfolio
Cloud and server operations for a portfolio spanning hospitality feedback and stay-experience SaaS, B2C and global e-commerce, an angel-investment funding platform, an international export-trade portal, an event and voting system and a healthcare wellness platform — deployment pipelines, capacity planning and traffic-peak readiness.
Sorted by depth, not by a progress bar.
A percentage next to a technology name means nothing. What matters is whether I run it in production, work with it, or understand it at an architecture level.
Production
Operated dailyTechnologies I run, break, fix and maintain in live environments.
Working knowledge
Used, not owned end-to-endTechnologies I deploy to and debug without claiming platform-level ownership.
Architecture
Design-levelPatterns I can reason about and design against, stated as knowledge rather than operating history.
Cloud
- AWS — EC2, ASG, ALB/NLB
- VPC, Route 53, S3, EBS
- RDS, IAM, ECR, CloudWatch
- Azure — VMs, LB, Storage
- DigitalOcean · OVHcloud
- On-premises / bare metal
DevOps & Automation
- Jenkins (pipeline-as-code)
- AWS Code services
- GitHub Actions
- Ansible (role-based)
- Docker · Compose · Swarm
- Kubernetes · EKS · ArgoCD
- Shell · Python · Git
DevSecOps
- Gitleaks (secret scanning)
- Semgrep · SonarQube (SAST)
- OWASP Dependency-Check
- Trivy (image + filesystem)
- Cosign / Sigstore
- OWASP ZAP (DAST)
SBOM & Supply Chain
- Syft · cdxgen
- CycloneDX · SPDX
- Grype
- OWASP Dependency-Track
- Versioned SBOM artefacts
Hardening & SecOps
- CIS benchmarks
- Lynis · OpenSCAP
- Wazuh (SIEM · FIM)
- Falcon runtime protection
- Fail2Ban · UFW
- ModSecurity · AWS WAF
- OpenVAS
- GuardDuty · Security Hub
Secrets Management
- HashiCorp Vault
- AWS Secrets Manager
- Azure Key Vault
- Runtime-bound Jenkins creds
Infrastructure & Edge
- Linux administration
- Nginx (proxy, TLS, caching)
- Rate limiting · API gateway
- DNS · Route 53
- FortiGate firewalls
- IPsec · point-to-point
- VPC / VNet · security groups
Databases & Messaging
- MySQL
- MongoDB (replication)
- Encrypted backups
- Scheduled restore testing
- RabbitMQ
- Amazon RDS · Redis
Observability
- Prometheus
- Node Exporter
- Grafana
- Alertmanager
- Amazon CloudWatch
- Textfile collector
Voice
- Asterisk · FreePBX
- FreeSWITCH
- SIP · RTP · VoIP
- Outbound dialers
- Recording storage
AI Infrastructure
- Azure OpenAI
- Whisper
- Ollama
- TTS
- Audio streaming
Application Stack
- Java
- Node.js · TypeScript
- React · Next.js
- Python
- PHP (Laravel, CodeIgniter)
- REST APIs
Production is the real test.
Build
Create infrastructure applications can reliably run on.
Gate
Nothing unscanned or unsigned gets past the pipeline.
Deploy
Automate the path from source code to production.
Harden
Reduce the attack surface at build time, not at runtime.
Observe
Know when something breaks before a user reports it.
Recover
Test the restore. A backup you've never restored is a hypothesis.
Troubleshoot
Find the root cause instead of applying a temporary fix.
Automate
If the same operational task happens twice, it shouldn't happen a third time by hand.
Build it. Gate it. Deploy it. Observe it. Break it. Fix it. Automate it.
Developer first, then the infrastructure under it.
3.5+ years of hands-on experience operating cloud and on-premises infrastructure for business-critical, high-availability production systems.
DevOps Engineer
- Own DevOps and DevSecOps operations across AWS, Azure and on-premises servers for a portfolio of 9+ concurrent production platforms plus a live contact-centre system.
- Provision and maintain AWS compute and networking — EC2, Auto Scaling groups, ALB/NLB, VPC, Route 53, S3, EBS, RDS and least-privilege IAM policies.
- Build and deploy Dockerised application stacks on private Docker networks, managing image lifecycle and versioning through Amazon ECR.
- Automate server configuration, patching and repeatable deployments using role-based Ansible playbooks, removing manual build-out steps.
- Design and maintain CI/CD pipelines with Jenkins and AWS Code services covering build, artefact publishing, approval gates and controlled release.
- Govern promotion across Testing, UAT and Production, coordinating release windows with development and QA.
- Engineer blocking security gates into the pipeline — Gitleaks on every commit, Semgrep and SonarQube SAST with enforced Quality Gates, OWASP Dependency-Check, and Trivy image scanning with Cosign signature verification before deploy.
- Generate a CycloneDX/SPDX SBOM on every build using Syft, stored as a versioned artefact tied to the release number, scanned with Grype and tracked in OWASP Dependency-Track — with a defined process for sharing SBOMs with clients under NDA.
- Harden production servers to CIS benchmarks — dedicated non-root users, key-only SSH through a bastion host, UFW default-deny mirrored at cloud security-group level, MFA on privileged access.
- Operate Wazuh across the estate for SIEM, file-integrity monitoring and CIS configuration assessment, with alerts correlated to MITRE ATT&CK alongside Falcon runtime protection.
- Run Fail2Ban and Nginx rate limiting with OpenVAS plus scheduled OWASP ZAP baseline scans against staging.
- Manage MongoDB and MySQL backup, retention, encryption and replication, with scheduled restore tests recorded as audit evidence.
- Stand up fleet-wide monitoring with Prometheus Node Exporter, Grafana and Alertmanager alongside CloudWatch, analysing logs to trace call failures, latency and resource exhaustion.
- Tune Linux kernel, file-descriptor/ulimit and Nginx parameters for high-concurrency real-time VoIP traffic, improving stability under peak call load.
- Maintain the security evidence pack — pipeline gate results, SBOMs, scan and signature-verification reports, patch compliance and restore-test records — used to answer client and audit questionnaires.
Backend Developer
- Built and maintained backend services and REST APIs supporting production web applications.
- Handled application deployment, environment configuration and post-release stability on Linux servers.
- Worked across MySQL and MongoDB data layers — schema changes, query tuning, backups and replication setup.
PHP Developer
- Developed and maintained web applications using PHP (Laravel, CodeIgniter) with MySQL backends.
- Deployed builds to staging and production, configured Nginx/Apache virtual hosts, SSL and routing, and resolved live defects.
Apprentice
- Completed a structured apprenticeship covering systems administration, networking fundamentals, server setup and application support.
B.E. Computer Science & Engineering
Sagar Institute of Research, Technology & Science (SIRTS), Bhopal · 2016 – 2020 · 7.1 CGPA
Soft skills
Ownership in production-critical environments · cross-functional collaboration with development and QA · analytical troubleshooting under pressure · clear incident communication · documentation and audit discipline.
Bhopal, India
English · Hindi. Working across Indian and international regions, including a Middle East deployment and client-network integrations abroad.
Let's build infrastructure that works in production.
Open to DevOps Engineering, CloudOps, DevSecOps, Site Reliability Engineering and Cloud Infrastructure Engineering roles and conversations.