Principal security and cloud architect for federal, defence and other regulated environments. I design hardened platforms, sovereign cloud networks and Kubernetes infrastructure, and I am currently building Nexus, a project intelligence layer for agentic development.
When the target network has no Git access and code arrives as an archive, the release becomes a security boundary. Build from the committed tree, refuse to package secrets, prove integrity, and stop leaks earlier with pre-commit hooks for secrets, topology and classification markings.
Hosts hardened against more than one baseline produce false failures in naive compliance checks. Declarative YAML catalogues, a single generated probe script per host, probe deduplication, and an OVERRIDDEN status that attributes every real failure to the catalogue that owns the control.
Hardening is easy to apply and hard to take back. A profile engine that stacks baselines with explicit merge rules, records every deliberate override, snapshots the pre-change state on first activation, and resets a profile from that snapshot, including drift detection between deployments.
Containers cannot test kernel parameters, boot arguments or mount options, which is most of OS hardening. A four-layer approach that works: static gates, controller-local logic tests with test doubles, VM acceptance with an idempotency gate, and mocked-provider tests for the provisioning code.
Currently building
Nexus, the project intelligence layer for agentic development
See all projects →
