Cloud architecture
Account structure, networking, and how workloads sit inside it. Designing an environment so the shape of it makes the right thing easy and the dangerous thing awkward.
- Multi-account AWS
- VPC and connectivity
- Kubernetes platforms
Cloud architecture & security · Jakarta
I design cloud architecture and the guardrails that keep it standing .
Currently contracted as a Cloud Engineer. I spend my week on AWS architecture, access design, and the Terraform that makes it repeatable. Most of my attention goes to the security half of that.
Identity and access
IAM is the real perimeter now, and it is where most cloud incidents actually start. Roles, trust policies, and permission boundaries decided during design rather than patched afterwards.
- Role and trust design
- Permission boundaries
- Cross-account access
Infrastructure as code
Terraform for everything, so an environment is reviewable, repeatable, and explainable to whoever inherits it. Plus the small CLIs I write when a question keeps coming up.
- Terraform modules
- Review and drift
- Internal tooling
Experience
what I’ve actually done 2026 to present Jakarta
Cloud Engineer at Mastersystem
- Build and deliver AWS environments for clients, from infrastructure through networking and access.
- Write the Terraform, then the design doc that explains it to whoever inherits it.
- Conduct security assessments on client infrastructure to identify misconfigurations and hardening opportunities ahead of deployment
2025 Jakarta
Security Engineer at BCA Finance
- Strengthened the organization's security posture by balancing technical engineering with security governance, focusing on proactive monitoring, infrastructure hardening, and automation.
- Orchestrated External Attack Surface Management (EASM) and Vulnerability Assessment (VA) workflows with vendors.
- Engineered a custom document classification schema for LibreOffice PDF, replicating Titus standards.
Projects
mostly built to scratch my own itch Reference + Website
Cloud Rosetta
A dictionary for people who learned one cloud and got handed another. Maps AWS, Azure and GCP concepts across, and flags where the analogy quietly stops being true, which is the part that catches people out.
View App ↗ CLI
Terraform Rosetta
Translates AWS Terraform to Azure/GCP — deterministically, and honestly. Every resource gets one of 5 statuses (auto/partial/builtin/manual/unsupported); nothing is silently faked. No LLM guessing.
View on GitHub ↗ Template
Automated Zero Trust Data Perimeter IDS
AWS Security project implementing a Zero-Trust S3 perimeter with automated CloudTrail/EventBridge alerting. Built with CloudFormation
View on GitHub ↗ Template
AWS 3-Tier Highly Available WordPress Architecture
This project demonstrates a production-ready, Highly Available 3-Tier Web Architecture on AWS, fully automated with Terraform. It focuses on the Security and Reliability pillars of the AWS Well-Architected Framework by isolating layers into public and private subnets across multiple Availability Zones.
View on GitHub ↗Certifications
the paper side of it AWS Certified Solutions Architect – Associate
Certified Cloud Security Practitioner - AWS (CCSP-AWS)
Google Cybersecurity Professional Certificate
AWS Certified Security – Specialty
Certified Kubernetes Administrator - CKA
Writing
what I’m figuring out All posts →
Dependency order is the real EKS deployment problem
Most failed Kubernetes platform rollouts aren't a tooling problem — they're a sequencing problem. A tool-agnostic way to think about what has to exist before what.
Read post →
The cloud comparison chart lied to you (a little).
Every 'AWS to Azure to GCP' cheat sheet does the same thing: it gives you a table. S3 equals Blob Storage. EC2 equals Compute Engine. Done, ship it. Except it's not done. The table tells you where to start, not where you'll get burned.
Read post →
Decoupling & Securing Web App Storage: Building a Zero-Trust S3 Perimeter with Terraform
When hosting a scalable, multi-AZ 3-tier web application (like WordPress), storing media files locally on the EC2 instances is an architectural dead end. The moment your auto-scaler destroys an instance, your user uploads vanish.
Read post → Get in touch
If any of this is useful to you, say hi.
I like talking about this stuff. Email is the easiest way to reach me. I read everything, and I will be honest with you about whether I am the right person for what you need.
A role
Cloud or security engineering, in Jakarta or globally remote. If you are hiring and the work above looks like your kind of problem, get in touch.
Something you’re building
A project that needs another pair of hands on the infrastructure, or another pair of eyes on how it is put together before it goes live.
A question
Stuck on an AWS or Terraform thing and want to talk it through? Ask. I will tell you straight if it is outside what I know.