personal

Student

University of Nairobi

BSc in Electrical & Electronics Engineering, Second Class Honours (2016–2021).

milestone

Freelance Cloud & Platform Engineer

Freelance Engagements

Architected multi-cloud landing zones with Terraform, managed Kubernetes clusters, and optimized cloud storage architectures to reduce client infrastructure costs.

job

Cloud Platform Engineer

E&M Technology House

Led containerization and deployment of microservices to Amazon EKS, automated CI/CD pipelines, and executed zero-data-loss workload migrations.

job

Cloud Engineer

Equity Group Holdings

Manages multi-cloud infrastructure across AWS and Azure for 25+ Kubernetes clusters and 500+ microservices, leading FinOps governance and security automation.

job

Equity Bank Limited

Cloud Engineer | Equity Group Holdings / Equity Bank Kenya Oct 2024 - Present • Owned infrastructure operations across AWS and Azure, provisioning, deploying and configuring services and monitoring for load, performance and security events across 25+ AKS/EKS clusters, 500+ microservices, 1,000+ databases, 150+ storage accounts and 100+ VMs at 99.99% availability. • Investigated Azure Update Manager patch compliance across 112 machines (93 Azure VMs and 19 Azure Arc-enabled), reviewing update status, pending reboots and missing update data to separate genuine patch gaps from reporting and platform limitations, and validated TLS 1.0/1.1 security findings across Windows environments through registry configuration checks and remote execution. • Led AKS upgrade planning and execution across 9 production clusters over 3 days, sequencing controlled rollout configuration and workload validation to manage upgrade risk without service disruption; produced design specifications and diagrams for cluster topology and networking changes and collaborated with engineering teams to align designs with organizational objectives. • Contributed to Azure Landing Zone architecture, including management groups, RBAC, subscription vending, policy enforcement and hub-and-spoke networking, balancing centralized policy enforcement with operational flexibility to meet PCI-DSS and audit requirements. • Engineered networking and platform components using Azure CNI, Cilium, NSGs, Private Endpoints, Application Gateway, Azure Firewall and ExpressRoute, and built infrastructure using Terraform, Bicep, Ansible and Helm. • Owned configuration management for cloud environments: engineered reusable Terraform modules across AWS and Azure to track, log and correct configuration items and support audits, reducing environment provisioning time from approximately 4 hours to 24 minutes, a 90% reduction, and improving consistency across environments. • Applied information security controls (RBAC, PIM, IAM, Key Vault, Microsoft Defender for Cloud, AWS Security Hub) and supported vulnerability remediation using Tenable, Azure Automation Accounts, Python and Ansible, reducing the vulnerability backlog from 996 to 2 findings (99.8%) and raising Microsoft Secure Score from 54% to 76%. • Developed a multi-cloud IAM analyzer in Python to support access reviews, identifying excessive permissions across 200+ accounts and reducing blast-radius risk from compromised credentials. • Validated backup configurations for the DFS/Finserve KRI, assessing backup status, retention, point-in-time recovery, redundancy and geo-redundancy, restore capability and RPO/RTO considerations, and compiling evidence for audit review. • Worked with backup evidence and restoration logs for Jenga databases and Equitel MGW, MICA and SMSC systems to support recovery readiness, and investigated backup and upgrade considerations for a production MongoDB 6.0.6 standalone instance (approximately 250GB) protected through Azure Backup with daily application-consistent recovery points. • Supported monitoring and incident response using Prometheus, Grafana, Datadog, Azure Monitor and Application Insights; architected centralized Kubernetes logging (Grafana Loki, Alloy, Helm, Terraform) that forwarded telemetry to a SIEM, and troubleshot production Kubernetes issues involving node health, resource pressure, OOM and eviction events, application probe failures and Falcon sensor restarts. • Engineered a self-healing Python remediation engine that detected Kubernetes deployment failure states and triggered automated recovery actions, cutting incident resolution time by 35% and reducing recurring manual intervention. • Implemented Kubernetes network security controls (Cilium, NetworkPolicy) applying default-deny with explicitly permitted communication paths, reducing unnecessary east-west and egress connectivity. • Drove FinOps automation and resource governance (rightsizing, idle-resource removal, autoscaling, lifecycle management), contributing to a 25% reduction in cloud spend, and maintained cost and configuration records for stakeholder reporting. • Created operational troubleshooting documentation and repeatable diagnostic procedures for Kubernetes, networking, cloud infrastructure and security findings. • Supported cloud infrastructure for AI initiatives (Azure AI Foundry, Microsoft AI Factory, SharePoint-based RAG workloads, MCP integrations, Kubeflow), focusing on connectivity, deployment and operational integration for model-serving workloads. Strategic Projects & Business Impact • Built an automated FinOps cost-reporting platform (Azure Logic Apps and Azure Data Explorer) that produced a daily VM/SQL cost report by SKU, resource and trend, replacing manual cost pulls with self-service reporting for stakeholders. • Built a capacity assurance automation tool (Python, dynamic metric discovery, 16+ subscriptions) that surfaced over-utilization, quota headroom and scalability risk across SQL, Elastic Pool, Redis and Cosmos DB, informing capacity planning ahead of production risk. • Extended the production self-healing engine into IntelliKube, a personal R&D project adding predictive detection, automated investigation and post-incident reporting using Kubernetes CRDs, on top of assigned scope.

job

E&M Technology House Ltd

Cloud Platform Engineer | E&M Technology House Apr 2024 - Oct 2024 • Supported cloud infrastructure implementation and operations for containerized enterprise workloads, leading containerization and deployment of 20+ Java applications to Docker, Kubernetes, Amazon EKS and Helm, reducing deployment failures by 70%. • Engineered 12+ Spring Boot microservices and 30+ secure REST APIs integrating core banking and enterprise systems (SWIFT MT, IBM MQ, ISO 15022), supporting 99.95% transaction reliability. • Built configuration-managed, reusable Terraform modules for AWS infrastructure provisioning, reducing provisioning effort by 85% and standardizing environment configuration. • Implemented CI/CD pipelines (Azure DevOps, Git, Maven, SonarQube) with integrated security checks, reducing deployment time by 80% and manual release effort by 90%. • Led migration of 40+ workloads with Multi-AZ failover, supporting 99.9% business continuity with zero data loss during cutover. • Applied information security controls (IAM least privilege, secrets management, network segmentation) and supported troubleshooting of Linux, JVM and Nginx workloads, reducing MTTR by 65%. • Established Prometheus, Grafana, CloudWatch and ELK observability for monitoring and incident support across application and infrastructure workloads, reducing detection time by 60%. Strategic Projects & Business Impact • Moved a 12+ microservice trade finance platform onto EKS with standardized Helm deployment patterns, enabling independent service scaling for financial messaging workflows (SWIFT, IBM MQ) without a full application rearchitecture. • Selected a lift-and-shift migration strategy over full rearchitecture to meet a fixed deadline, protecting a zero-data-loss cutover for 40+ production workloads. Software Engineer, Java/Python | E&M Technology House Jan 2024 - Apr 2024 • Architected cloud-native Trade Finance Spring Boot microservices, decomposing monolithic workflows into independently deployable services. • Co-designed event-driven processing using RabbitMQ and Amazon EKS, improving workload scalability and service isolation. • Engineered secure REST APIs (OAuth2, JWT) with SAST, DAST, dependency scanning and CI/CD security controls. • Optimized JVM workloads through caching and JDBC connection-pool tuning to improve service performance and resource efficiency.