Principal Cloud Solutions Architect · AWS Subject Matter Expert
Tavira, Portugal · Remote / EU-wide engagements · Italian citizen
Cloud architect with 10+ years across AWS platform engineering, security and DevOps, and six AWS certifications including Solutions Architect Professional and Security Specialty. I design and deliver multi-account landing zones, zero-trust identity and network perimeters, production container platforms and agentic AI developer platforms for regulated and enterprise clients — a European institution, Volkswagen, global mobile gaming, fintech, public-sector utilities and IoT. Independent since 2025 through Aspect Solutions.
Stack: AWS Backup · Network Firewall · Security Hub · Config · CloudFormation StackSets · Systems Manager
Stack: AWS CDK · Step Functions · Transit Gateway · Direct Connect · GitLab CI · Python
Stack: Control Tower · Service Catalog · ServiceNow · Azure · Active Directory · Docker
Stack: ECS Fargate · API Gateway · Lambda · DynamoDB · ElastiCache · PHP · Node.js · React
Stack: Angular 2+ · Vue.js · Yii2 · Magento · WordPress · Joomla · D3.js
Conclusion — end client: a globally known mobile & web gaming publisher
Principal architect on the Conclusion team owning the Terraform platform that provisions production AWS infrastructure for three live game titles across multiple accounts, six EKS clusters and eleven Aurora clusters. Led the migration of seven production zones from Cloudflare to an AWS-native edge on CloudFront, WAFv2 and Shield Advanced — delivered on budget, with custom WAF rule sets and Origin Shield tuning. Designed the multi-region DR strategy for EKS, Aurora, ElastiCache/Valkey and CI/CD infrastructure as a single parameter-driven orchestration workflow, validated in a live failover drill. Delivered Amazon MQ (RabbitMQ) 3.13→4.2 engine and instance-class upgrades, AWS Backup with point-in-time restore across all production Aurora clusters, an EKS 1.35 upgrade with node auto-repair and Karpenter, Security Hub FSBP enablement and centralised Secrets Manager reconciliation. Defined ownership boundaries and least-privilege cross-account access for accounts co-managed with the client's platform teams. All changes shipped through ServiceNow change management with peer-reviewed, plan-gated CI and design docs versioned with the code; authored and ran a hands-on CloudFront/WAF workshop for 12 engineers across two practice teams.
Global IoT positioning & wireless semiconductor company (via InterEx)
Principal architect of the "0 Code AI" programme: an agentic internal developer platform (AppCommandCenter) on Amazon Bedrock AgentCore, Lambda, EventBridge and DynamoDB, with a React dashboard behind a same-origin BFF and central Cognito / Entra ID SSO. Delivered repo-discovery, architecture-compliance and RAG chat agents that gate GitLab merge requests and answer engineering questions with cited sources; shipped to dev, staging and production through GitLab OIDC credential-less CI with tagged releases. Designed and rolled out cross-account GitLab OIDC deploy roles (AWS CDK) across eleven client AWS accounts, enforcing environment separation and least privilege. Remediated all AWS Security Agent High/Medium findings with fail-closed allowlists, TDD and independent review. Architected the HA self-managed GitLab on AWS (CloudFormation, 500+ users, Entra ID SSO), migrated repositories from GitHub and legacy SVN with full history (119k-commit pilot), and, in a five-person team, re-platformed the company wiki on AWS serverless.
UCapital24 — FCA-regulated fintech group
Long-standing cloud architect and de-facto head of IT security. Built the AWS foundation: Control Tower landing zone with Security Hub, Google Workspace SAML SSO into IAM Identity Center and GitLab OIDC credential-less CI/CD; ECS microservices (CloudFormation + Copilot) streaming real-time market data over WebSockets, AppSync GraphQL, Managed Grafana and a SharedServices account with cross-account least privilege. In 2026 delivered an immutable email-compliance archive — Gmail journaling into S3 Object Lock (compliance mode, 7-year retention, KMS, Lambda-indexed manifest) — and exported 218k messages from 97 dormant identities to Deep Archive, cutting the Workspace licence bill by ~$12k/year (≈51%). Led the response to a P1 brand-impersonation BEC attack on an advisory client: forensic timeline, tenant-wide containment, registrar takedown packages and the FCA disclosure assessment; then hardened SPF, DKIM and DMARC across ten domains. Delivered a Microsoft 365 → Google Workspace migration with an atomic Route 53 MX cutover and no mail loss. Provisioned a governed AI-Services account with organisation-wide Bedrock access (redesigned Control Tower region guardrails, reconciled in Terraform), designed the multi-region HA replication of the production backend to the US, and decommissioned 73 legacy resources across two accounts.
ReeVo Cloud & Cyber Security — public-sector gas distribution end client
Control Tower + Security Hub + IAM Identity Center federated with Entra ID; hub-and-spoke Transit Gateway with Direct Connect and VPN failover; Network Firewall with Suricata rule sets. Multi-tenant EKS with namespace isolation, ArgoCD GitOps, Karpenter and NGINX ingress. Terraform observability modules across RDS, DocumentDB, ECS/EKS, CloudFront, WAFv2 and ALB/NLB. Private NLB → API Gateway → CloudFront delivery with WAF, Cognito OAuth 2.0 and KMS; CI/CD on CodeCatalyst.
AWAKE Mobility — automotive IoT
Prod/Dev/QA multi-account architecture aligned to the Well-Architected Framework; Entra ID SSO with least-privilege permission sets; VPC segmentation and Network Firewall; Bitbucket ↔ IAM Identity Center credential-free CI/CD; AWS Backup with cross-region replication; CloudWatch, Uptime Kuma and Sentry monitoring; CloudFormation and Terraform IaC; SNS/SQS/Lambda event-driven guidance.