Lead Platform
Engineer

Senior technical lead for platform engineering and SRE across a HITRUST-aligned SaaS platform, setting the CI/CD, IaC and observability standards adopted by every engineering squad as an individual-contributor technical authority.

• ▸

  Azure Landing Zones & policy-as-code: Designed and delivered a reusable Azure Landing Zone architecture as a shared platform capability in Terraform/OpenTofu: hub-and-spoke networking, management group hierarchies and custom Azure Policy guardrails enforcing tagging, SKU restrictions and private endpoints. Cut policy non-compliance by 80% and produced continuous HITRUST audit evidence.

• ▸

  Containerised & serverless platforms: Operated 20+ Azure Container Apps in production: revision strategies, HTTP/event-driven scaling, Dapr integration and managed identity bindings with zero-downtime deployments. Led an AKS proof-of-concept deploying SonarQube as a Kubernetes-native workload with Helm; the resulting ADR was adopted as the platform’s forward migration path.

• ▸

  CI/CD security guardrails: Embedded SonarQube and Snyk SAST/SCA as mandatory, self-service quality gates in every Azure DevOps pipeline: coverage thresholds, code-smell limits and security hotspot policies enforced across all squads without slowing delivery.

• ▸

  Secrets management platform: Owned enterprise secrets management as a shared capability across every Azure environment: RBAC access policies, managed identity integration and automated rotation for credentials, connection strings and API keys, eliminating hardcoded secrets across 15+ microservices and all CI/CD pipelines.

• ▸

  HashiCorp Vault SME: PoC & architecture: Designed and delivered a Vault Enterprise proof-of-concept on Azure evaluating dynamic secret issuance, PKI certificate automation and AppRole/Managed Identity auth, producing a formal security architecture recommendation and migration roadmap adopted by security and platform leadership.

• ▸

  CA & SAML certificate lifecycle: Owned all CA and SAML signing/encryption certificates and OIDC client credentials across platform environments: rotation cycles, Auth0 SSO certificate updates and Key Vault-based automated renewal, reducing SSO certificate incidents by over 90% and manual renewal effort by ~60%.

• ▸

  SRE observability & reliability: Built SRE observability foundations (Azure Monitor, Log Analytics, KQL) as reusable dashboards and alerting frameworks contributing to a 30% MTTR reduction; automated RBAC provisioning for Azure SQL, cutting manual effort ~85% with audit-ready compliance reporting.

• ▸

  IaC modernisation: Led the full migration from ARM templates to Terraform/OpenTofu, standardising 15+ Azure DevOps pipelines around reusable modules, approval gates and integrated security checks, materially reducing onboarding time for new services.

• ▸

  Platform operations & FinOps: Ran a FinOps review cadence (Azure Cost Management, KQL dashboards) surfacing idle VMs, orphaned disks and over-provisioned resources; acted as de-facto DBA for Azure SQL and PostgreSQL (schema changes, indexing, failover testing) maintaining 99.9%+ availability on HITRUST-compliant workloads.

• ▸

  Cross-team leadership & mentoring: Represented platform engineering in architecture forums with Software Architects, Product Engineering Leads and the Head of Security; presented infrastructure risk plans and platform roadmaps to CTO/VP stakeholders; authored runbooks and architectural guidance while mentoring engineers through weekly coaching sessions and workshops.

Built and operated the core GCP platform and the global HashiCorp Vault Enterprise secrets platform serving 20+ international engineering teams in a regulated financial services environment.

• ▸

  Platform engineering (GCP): Built and operated the core GCP platform with Terraform and Terragrunt as reusable, product-like infrastructure: GKE cluster provisioning, VPC design, Cloud NAT and IAM Workload Identity Federation; the IaC patterns were adopted globally across 20+ engineering teams.

• ▸

  CI/CD platform migration: Bamboo & CircleCI → Jenkins: Sole lead migrating 30+ pipelines from Atlassian Bamboo and CircleCI onto a centralised Jenkins platform on GCP, delivered with zero production outages and ~70% reduction in configuration overhead, producing a single auditable delivery platform with RBAC-enforced approval gates and integrated Vault dynamic credential injection.

• ▸

  GitHub Actions & Helm chart deployments: Designed GitHub Actions workflows for GCP-native microservices: Docker build/push to GCR, Helm chart templating and deployment to GKE with HPA and PodDisruptionBudget; maintained a Helm chart library for all Kubernetes-native workloads with Vault secret injection via vault-action.

• ▸

  HashiCorp Vault Enterprise: platform lead: Architected and operated Vault Enterprise HA clusters on GCP as the authoritative self-service secrets platform for 20+ global engineering teams: dynamic secrets with TTL-based lease rotation, a PKI engine for internal CA/TLS issuance, and AppRole and LDAP auth backends.

• ▸

  Vault governance & security hardening: Designed enterprise namespace policies and RBAC models enforcing separation of duties across production, staging and development secret paths; implemented Vault audit logging to Splunk for real-time anomaly detection and compliance evidence; integrated MFA and LDAP auth meeting PayPal’s regulated financial services controls.

• ▸

  Observability & reliability: Built full-stack observability as a foundational platform capability (Prometheus, Grafana, Nagios, Splunk and Slack alerting) across GCP hybrid environments, covering access anomalies, platform health and security signals for faster incident detection and response.

• ▸

  Supply chain security: Embedded Vault-based dynamic credential injection into every Jenkins template, eliminating static credentials from all CI/CD workflows; implemented Snyk and SonarQube quality gates plus ACL IP-blocking and just-in-time IAM role vending for ephemeral build access.

• ▸

  DNS migration: Route53 → Cloud DNS: Led the DNS migration workstream of the AWS-to-GCP product migration: audited all Route53 hosted zones, scripted zone replication in Python and Terraform, and executed a zero-downtime cutover using TTL pre-lowering strategies.

• ▸

  DevOps leadership & mentoring: Primary DevOps point of contact for multiple Hyperwallet squads; mentored 4 engineers (2 promoted to senior); collaborated daily with security architects and SRE teams across time zones, representing the platform in engineering leadership forums alongside senior managers and architects.

Delivered multi-cloud migrations and standardised hybrid CI/CD for client platforms across AWS and Azure, acting as the primary technical contact through delivery.

• ▸

  Multi-cloud migrations: Led on-prem-to-AWS migrations re-hosting 50+ Linux servers onto EC2 with multi-AZ, ELB and Auto Scaling; delivered greenfield Azure environments (VNets, NSGs, App Services, Azure SQL) for new client onboardings.

• ▸

  Hybrid CI/CD & security hardening: Built CI/CD pipelines across AWS and Azure using Jenkins and Azure DevOps as standardised delivery patterns; implemented Ansible config-as-code, Azure Policy, AWS Config rules and SELinux hardening.

• ▸

  Container orchestration & customer-facing delivery: Deployed and operated Kubernetes on AWS EC2 with HAProxy load-balancing; served as primary technical contact across both platforms, presenting migration progress to client IT management.

• ▸

  Incident management & runbooks: Led incident response and maintenance windows for critical workloads across AWS and Azure; maintained a post-incident learning library and runbooks to reduce repeat failures.

Owned the on-premise server estate and built the Azure data platform and reporting layer serving senior stakeholders.

• ▸

  Azure data platform: Built Azure Data Factory and Databricks pipelines for ETL across CRM/ERP sources; delivered Power BI dashboards using DAX, Power Query and Power Pivot over 100k+ record datasets for senior stakeholders.

• ▸

  Infrastructure: Designed and maintained LAN/WAN and 50+ on-premise servers: provisioning, SELinux patching, capacity management and monitoring; provided technical support ensuring data delivery SLAs were met.

Performed daily fund valuation and regulatory reporting for UK-domiciled funds. That grounding in regulated controls and audit trails still shapes how I design platforms.

• ▸

  NAV calculation & Bloomberg: Performed daily Net Asset Value calculations for UK-domiciled mutual funds and OEICs, reconciling holdings, accruals and corporate actions; used Bloomberg Terminal to validate market pricing and reference data; prepared FCA/UCITS regulatory reports with full audit trail.

• ▸

  Blockchain & digital assets: Contributed to an internal POC evaluating blockchain-based settlement infrastructure for fund transactions, analysing DLT applicability to NAV reconciliation and cross-border payment flows.

• ▸

  Data integrity & stakeholder coordination: Maintained data governance standards across fund accounting systems, reconciling custodian records, Bloomberg feeds and portfolio data as front/middle-office liaison.