I build distributed systems and cloud infrastructure on AWS — serverless pipelines, event-driven platforms, security automation, and observability stacks. I start from correctness properties and failure modes, not features: I've formally verified IAM invariants with an SMT solver, load-tested SAGA orchestration past 1,100 req/min, and had 28 pull requests merged into upstream projects including Prowler, moto, OpenTelemetry, checkov, and aws-cdk-cli.
The gap between a working demo and a production system lives almost entirely in what you've thought through before writing code — CAP tradeoffs, failure scenarios, blast radius. I document those decisions explicitly, in every repo.
Open to remote Cloud / Platform / DevOps / Security Automation roles; applying for an M.Sc. (Fall 2027) in distributed systems / security.
| Domain | What I Build |
|---|---|
| Distributed Systems | SAGA orchestration, event sourcing, idempotency, circuit breakers, compensation paths |
| Cloud Infrastructure | AWS serverless, Terraform IaC, CDK, multi-stack deployments, Lambda architecture |
| Security Automation | CSPM scanning, event-driven auto-remediation, CIS compliance, IAM least-privilege |
| Observability | Structured logging, CloudWatch dashboards, X-Ray tracing, Prometheus/Grafana |
| Data Engineering | Kinesis streams, Hive-partitioned S3 data lakes, Athena, real-time analytics |
| CI/CD & DevOps | GitHub Actions pipelines, Docker, multi-environment deployments, smoke testing |
| AI Infrastructure | RAG pipelines, vector search, FAISS, production retrieval systems |
28 merged into upstream projects, 4 in review — across AWS tooling, cloud-security scanners, and observability. Selected below; full list.
| Project | Contribution | PR |
|---|---|---|
| getmoto/moto | ECS RunTask support for capacityProviderStrategy |
#10070 ✅ |
| bridgecrewio/checkov | Fix CKV_K8S_40 false-positive on hostUsers |
#7580 ✅ |
| prowler-cloud/prowler | New M365 Entra conditional-access exclusion-gap check | #11577 ✅ |
| open-telemetry/…-python-contrib | Fix Redis ClusterPipeline span metadata |
#4728 ✅ |
| aws/aws-cdk-cli | Customizable STS role session name | #1672 ✅ |
| grafana/alloy-scenarios | CloudWatch-metrics scenario (LocalStack, no AWS acct) | #147 ✅ |
| aws-samples/well-architected-skills | Full-review pillar-playbook loading | #104 ✅ |
| beenuar/AiSOC | IAM UpdateAccessKey privilege-escalation detection |
#375 ✅ |
| imran31415/kube-coder | HA control plane — remove SPOFs, pod disruption budgets | #124 ✅ |
| Lynpoint/CyberVerse | Pluggable RAG vector-store backend | #32 ✅ |
| prowler-cloud/prowler | New memorydb_cluster_in_transit_encryption_enabled check |
#12246 ✅ |
| prowler-cloud/prowler | New cognito_user_pool_account_recovery_sms_not_preferred check |
#12251 ✅ |
| getmoto/moto | Cognito: stop inventing an AccountRecoverySetting for new pools |
#10143 ✅ |
| getmoto/moto | EventBridge and Kinesis list pagination (NextToken) |
#10144, #10161 ✅ |
| cloud-custodian/cloud-custodian | Azure: resolve resource lookups in tag values | #10961 ✅ |
| traceopt-ai/traceml | Windows support: guard SO_REUSEPORT, Windows CI smoke test |
#264, #285 ✅ |
| enuno/unifi-mcp-server | Test coverage 74% → 81% past the CI gate; fixed 2 bugs it surfaced | #115 ✅ |
| Climate-Vision/ClimateVision | Carbon analytics API + ONNX Runtime inference with PyTorch fallback | #124, #126 ✅ |
| open-telemetry/…-python-contrib | Logging: don't unlink log-record factories chained after ours (approved) | #4905 🔵 |
| aws/aws-cdk | Emit account-root ARN in log-group resource policies | #38195 🔵 |
| prowler-cloud/prowler | New backup_vaults_lock_enabled check |
#12249 🔵 |
| bridgecrewio/checkov | Accept aws:kms:dsse as valid S3 server-side encryption |
#7634 🔵 |
✅ merged · 🔵 in review
The Grafana Alloy scenario is a representative deep-dive:
Merged upstream — grafana/alloy-scenarios #147 A CloudWatch-metrics scenario that runs end-to-end against LocalStack with no real AWS account — Grafana Alloy → Prometheus in ~90 seconds. Merged by Grafana DevRel with all 12 CI checks green.
Formal verification tool — iamprover · 
Formal verification — security-invariants-rbac · 
CloudFlow — Distributed SAGA Orchestration on AWS
Serverless order processing built around the SAGA pattern using Step Functions, DynamoDB, and AWS CDK. Implements idempotency as a security primitive, DynamoDB-backed circuit breakers shared across the Lambda fleet (cold-start safe), event sourcing with full audit trail, and explicit compensation paths. Load-tested at 1,100+ req/min (P99 < 120ms) on LocalStack. 50+ tests covering all distributed failure modes.
Python AWS Step Functions CDK DynamoDB SQS EventBridge X-Ray LocalStack
CSPM — Cloud Security Posture Management
Serverless, event-driven AWS security automation with 23 checks mapped to the CIS AWS Foundations Benchmark v1.5. Auto-remediates safe misconfigurations (S3 public access, open security group rules), publishes compliance scores to CloudWatch, and alerts via SNS. IPv4 + IPv6 coverage; port-range aware SG checks that catch TCP 0–65535 rules most tools miss. 87 tests with moto mocks.
Python AWS Lambda EventBridge Terraform IAM CloudTrail boto3
Cloud_Pulse — Serverless Analytics Pipeline
Lambda Architecture (batch + speed layers) on AWS serverless. Kinesis real-time streaming + SQS/S3/Athena batch path, Cognito JWT auth enforced at API Gateway, Hive-partitioned S3 data lake, React dashboard. 15 Terraform files, full CI/CD pipeline, ~55ms P50 ingest latency. Fail-open speed layer: Kinesis failure degrades to stale data, not data loss. Batch path stays within AWS Free Tier; Kinesis streaming runs ~$0.36/day.
Python Kinesis Athena DynamoDB Terraform Cognito GitHub Actions
agrifuture-platform — AI-Powered Agricultural Intelligence Platform
Production full-stack platform with 6 AI modules (crop intelligence, disease detection, drone terrain analysis, market forecasting, digital twin simulation, conversational AI), live data feeds, Razorpay payments, OTP auth (email + SMS), and multi-language support across 7 Indian languages. 12,500+ lines of TypeScript/React, deployed on Render with PostgreSQL.
TypeScript React 19 Node.js PostgreSQL Google Gemini Razorpay Express
wikiqa-rag-system — Production RAG Pipeline
Full-stack retrieval-augmented generation over Wikipedia. Bi-encoder FAISS retrieval + cross-encoder re-ranking (P@5 from ~0.60 to ~0.80), source diversity enforcement, SSE token streaming, multi-LLM support (Groq/OpenAI/Anthropic), faithfulness scoring (LLM-as-judge hallucination detection), Prometheus/Grafana observability. Deployable on EC2 free tier.
Python FastAPI FAISS React 18 Prometheus Grafana Docker
Distributed systems · Cloud infrastructure · Security automation · Available for remote roles