Principal Cloud Solutions Architect · AWS Subject Matter Expert
Tavira, Portugal · Remote / EU-wide engagements · Italian citizen
Principal cloud architect with 10+ years in AWS platform engineering, security and DevOps and six AWS certifications (Solutions Architect Professional, Security Specialty). I own architecture end-to-end — landing zones, zero-trust identity and networking, Kubernetes platforms, multi-region DR and agentic AI platforms on Amazon Bedrock — for a European institution, Volkswagen, a global gaming publisher, an FCA-regulated fintech, public-sector utilities and IoT. Independent since 2025 (Aspect Solutions); open to remote / EU-wide contract and fractional principal-architect roles.
Stack: AWS Backup · Network Firewall · Security Hub · Config · CloudFormation StackSets · Systems Manager
Stack: AWS CDK · Step Functions · Transit Gateway · Direct Connect · GitLab CI · Python
Stack: Control Tower · Service Catalog · ServiceNow · Azure · Active Directory · Docker
Stack: ECS Fargate · API Gateway · Lambda · DynamoDB · ElastiCache · PHP · Node.js · React
Stack: Angular 2+ · Vue.js · Yii2 · Magento · WordPress · Joomla · D3.js
Conclusion — end client: a globally known mobile & web gaming publisher
Principal architect owning the Terraform platform behind three live game titles — multiple accounts, six EKS and eleven Aurora clusters. Migrated seven production zones from Cloudflare to CloudFront, WAFv2 and Shield Advanced on budget (custom WAF rule sets, Origin Shield). Designed multi-region DR for EKS, Aurora, Valkey and CI/CD as one parameter-driven workflow, validated in a live failover drill. Delivered Amazon MQ (RabbitMQ) 3.13→4.2, AWS Backup PITR on all production Aurora clusters, EKS 1.35 with node auto-repair and Karpenter, Security Hub FSBP and centralised Secrets Manager. Defined least-privilege boundaries for accounts co-managed with client teams. Everything shipped via ServiceNow change management and peer-reviewed, plan-gated CI; ran a CloudFront/WAF workshop for 12 engineers.
Global IoT positioning & wireless semiconductor company — via a UK engineering-staffing partner
Principal architect of the "0 Code AI" programme: an agentic internal developer platform on Amazon Bedrock AgentCore, Lambda, EventBridge and DynamoDB with a React dashboard and Cognito / Entra ID SSO. Delivered repo-discovery, architecture-compliance and RAG agents that gate GitLab merge requests and answer engineering questions with cited sources, released to dev/staging/prod through credential-less GitLab OIDC CI. Rolled out cross-account OIDC deploy roles (AWS CDK) across eleven accounts; remediated all AWS Security Agent High/Medium findings. Architected HA self-managed GitLab on AWS (500+ users, Entra ID SSO), migrated GitHub and SVN repositories with full history (119k-commit pilot) and re-platformed the company wiki on AWS serverless.
UCapital24 — FCA-regulated fintech group
Long-standing cloud architect and de-facto head of IT security. Built the AWS foundation — Control Tower with Security Hub, Google Workspace SAML SSO into IAM Identity Center, GitLab OIDC CI/CD, ECS microservices streaming real-time market data over WebSockets, AppSync GraphQL and Managed Grafana. Delivered an immutable email-compliance archive (Gmail journaling → S3 Object Lock, 7-year retention, KMS) and archived 218k messages from 97 dormant identities, cutting licensing ~$12k/year (≈51%). Led response to a P1 brand-impersonation BEC attack — containment, registrar takedowns, FCA disclosure assessment — then hardened SPF/DKIM/DMARC on ten domains. Migrated Microsoft 365 → Google Workspace with an atomic MX cutover; provisioned a governed AI-Services account with org-wide Bedrock access; designed US multi-region HA replication; decommissioned 73 legacy resources.
ReeVo Cloud & Cyber Security — public-sector gas distribution end client
Control Tower + Security Hub + IAM Identity Center federated with Entra ID; hub-and-spoke Transit Gateway with Direct Connect and VPN failover; Network Firewall with Suricata rule sets. Multi-tenant EKS with namespace isolation, ArgoCD GitOps, Karpenter and NGINX ingress. Terraform observability modules across RDS, DocumentDB, ECS/EKS, CloudFront, WAFv2 and ALB/NLB. Private NLB → API Gateway → CloudFront delivery with WAF, Cognito OAuth 2.0 and KMS; CI/CD on CodeCatalyst.
AWAKE Mobility — automotive IoT
Prod/Dev/QA multi-account architecture aligned to the Well-Architected Framework; Entra ID SSO with least-privilege permission sets; VPC segmentation and Network Firewall; Bitbucket ↔ IAM Identity Center credential-free CI/CD; AWS Backup with cross-region replication; CloudWatch, Uptime Kuma and Sentry monitoring; CloudFormation and Terraform IaC; SNS/SQS/Lambda event-driven guidance.