Work
Selected work
What I build and secure, described by what and how. Clients stay anonymous; the engineering is the point.
Security & identity
-
Session revocation for an identity provider
Closed penetration-test findings on a client platform by adding single-session enforcement and token revocation to Keycloak: a custom SPI event listener plus a token-validation function backed by Redis, wired through the API gateway.
Keycloak SPI · Azure Functions · Redis · APIM
-
A secure backend-for-frontend for an AI chat
Built the BFF for a web chat on an AI agent platform: server-side sessions in HttpOnly, SameSite=Strict cookies, single-use handoff codes, idle and absolute session limits — plus origin checks and per-IP rate limits at the gateway.
Spring Boot 4 · Java 25 · APIM · Front Door
-
SAML single sign-on
Implemented a SAML 2.0 service provider for SSO against a corporate client’s Entra ID, from design through production.
SAML 2.0 · Entra ID · Spring Security
-
Supply-chain incident response
When a malicious npm package campaign hit the ecosystem, audited our Angular repositories against the published indicators — lockfiles, IoCs, C2 domains — and confirmed nothing was compromised.
npm · IoC analysis
Platform & Kubernetes
-
Cluster-wide memory policy for Kubernetes
Traced recurring node exhaustion to an old JDK that ignored container limits, then fixed it at the cluster level — Kyverno mutation policies and namespace LimitRanges — instead of hand-editing every manifest.
Kyverno · AKS · LimitRange · JVM
-
Moving a legacy platform to Azure
Co-led a legacy platform’s migration end to end: architecture, AKS, Keycloak, Service Bus, Event Grid, Redis, and the CI/CD pipelines.
AKS · Keycloak · Service Bus · Event Grid
-
Running an Azure estate
As the company’s Azure administrator: right-sizing clusters, tightening backup and log retention, and clearing idle resources — cost and reliability work that compounds.
Azure · AKS · Storage
Backend & events
-
A Kafka consumer that doesn’t lose events
Root-caused message loss in a consumer writing to Cosmos DB and rebuilt it with rate limiting, exponential backoff, dead-letter topics and redrive.
Spring Kafka · Java 21 · Cosmos DB
-
Shared platform libraries
Security, events and utility libraries packaged as Spring Boot auto-configuration, so services get them out of the box — adopted across the platform.
Spring Boot 3 · Auto-configuration
-
A tax-data extraction service
Designed and built a job-orchestration service for Peru’s SUNAT tax system: OAuth2, multiple data sources, scheduled jobs with idempotent workers, and consolidated daily reports.
Spring Boot 3 · Java 21 · SQL Server · PostgreSQL
-
Java 21, and the team after it
Migrated critical services to Java 21 and Spring Boot 3, built the pipeline build images, then trained the team to migrate the rest.
Java 21 · Spring Boot 3
Teaching
-
Full-stack bootcamp
Taught two editions of a full-stack bootcamp — Spring Boot on the backend, Angular on the front — for university students.
Spring Boot · Angular
Credentials
CNCF Kubestronaut
-
Certified Kubernetes Security Specialist (CKS)
-
Certified Kubernetes Administrator (CKA)
-
Certified Kubernetes Application Developer (CKAD)
-
Kubernetes and Cloud Native Security Associate (KCSA)
-
Kubernetes and Cloud Native Associate (KCNA)
-
Microsoft Certified: Azure Fundamentals (AZ-900)
-
Generative AI for Software Developers
-
CyberOps Associate
Education
B.Eng. Computer & Systems Engineering
Graduated in the top 10% of the class.
How I got here, and how I think about the work: About.