DevOps Engineer · DevSecOps · Platform Engineering
Six years inside a HIPAA-regulated telehealth SaaS, from co-op QA to building and running production infrastructure. I studied cybersecurity before I wrote my first pipeline, so least privilege and attack surface are where I start, not what I bolt on afterward.
Same company, three roles, one continuous trajectory: cybersecurity training into QA into infrastructure engineering.
Keel Digital · HIPAA-regulated telehealth SaaS
Keel Digital
Work outside work. Each build ships with a write-up of its decisions, including the mistakes. Four finished builds lead below. Two more are one click away, including one still in progress.
Three sanitized case studies from production at Keel Digital — the real constraints, and the architecture that answered them.
A fully local, private document Q&A assistant — Ollama, FastAPI, and sqlite-vec in Docker Compose, with zero data leaving the machine. Built like production, not a demo: fail-closed API auth, magic-byte upload validation, and a Trivy-gated CI pipeline.
A Zabbix template and alert pipeline for Keycloak's Prometheus metrics — identity monitoring without standing up a separate Prometheus/Alertmanager stack. Triggers catch failed-login spikes and service-to-service auth errors, routing to Google Chat.
A Terraform module for the ops-automation shape I kept rebuilding by hand: a Lambda on an EventBridge schedule, with least-privilege IAM and log retention done right instead of copy-pasted. Ships with a working example, tflint checks, and versioned releases.
Used daily at Keel Digital.
Real builds, not production systems. Each links to a write-up under Projects.
Used or evaluated, not day to day.
I studied cybersecurity at Fanshawe College and earned my CEH before I wrote my first pipeline. That order matters more than it sounds like it should: I entered the workforce already thinking about attack surface, access control and failure modes, and it shows up in the defaults I reach for. Least privilege in every IAM policy. Network topology that starts from what shouldn't be reachable. Trivy gating the build rather than just flagging it.
QA at Keel Digital is where that training met real production systems. I built JMeter suites against rate limiting, RBAC and authorization boundaries, added Nessus scanning to the Compose stack for monthly compliance scans, and found a critical vulnerability in a registration API before it shipped. That stretch taught me how APIs actually behave under pressure and where security assumptions quietly fall apart once tested.
DevOps took it further. Knowing the traffic patterns and service dependencies from the QA side shaped how I build pipelines, how I scoped the bare-metal migration, and how I designed our SIEM's log ingestion. I've since contributed to a FedRAMP Moderate authorization (300+ NIST SP 800-53 controls, third-party assessment, continuous monitoring), which is about as unforgiving a proving ground as compliance work gets.
The cybersecurity-to-QA-to-DevOps path means fewer blind spots. I'm looking for DevOps or DevSecOps work where that combination counts, somewhere the security and compliance requirements are real rather than aspirational.
Email is the best way to reach me. My resume is available in three role-specific versions. Happy to talk about DevOps, DevSecOps or platform engineering roles.