Building secure, scalable, automated, and observable infrastructure through hands-on engineering projects.

I'm Simeon Siaka, a cloud infrastructure and DevOps practitioner building toward platform engineering and cloud security.

My GitHub is a record of that progression from individual AWS services and Linux administration to infrastructure as code, automated delivery, production-oriented application architectures, disaster recovery, and security-hardened Kubernetes platforms.

I focus on engineering systems that are:

• Secure — least privilege, private networking, workload identity, secrets management, supply-chain controls, and defence in depth
• Reliable — health checks, high availability, failure handling, disaster recovery, and operational runbooks
• Automated — Terraform, AWS SAM, GitHub Actions, CI validation, and repeatable deployments
• Observable — structured logging, metrics, dashboards, alarms, audit trails, and operational evidence
• Operationally realistic — documented trade-offs, validation, troubleshooting, cost awareness, and explicit evidence boundaries

My work is moving beyond simply deploying cloud resources toward understanding how infrastructure is designed, secured, operated, automated, and recovered at platform scale.

Cloud Infrastructure
        ↓
Infrastructure as Code
        ↓
DevOps & CI/CD
        ↓
Cloud Security
        ↓
Containers & Kubernetes
        ↓
Platform Engineering
        ↓
Reliability & Disaster Recovery

Recent portfolio work now includes a security-hardened Kubernetes platform with zero-trust networking, RBAC, Vault, Kyverno, Falco, Istio, Prometheus/Grafana, supply-chain security, and PCI-DSS control mapping. citehttps://github.com/simeonprimordial/security-hardened-kubernetes-platform

I have also been developing a multi-Region disaster-recovery architecture covering failover, data replication, recovery objectives, financial-safety gates, runbooks, data sovereignty, and operational evidence boundaries. citehttps://github.com/simeonprimordial/multi-region-disaster-recovery

A production-oriented reference architecture for a regulated fintech Kubernetes platform.

Engineering areas:

• Amazon EKS platform architecture across Development, Staging, and Production
• namespace isolation and domain-driven workload organisation
• default-deny NetworkPolicies and explicit service-to-service flows
• namespace-scoped RBAC and dedicated workload identities
• HashiCorp Vault for secrets and short-lived credentials
• Kyverno admission controls and Kubernetes Pod Security Standards
• Trivy, Syft, and Cosign for container supply-chain security
• Falco runtime security and Kubernetes audit logging
• Istio strict mTLS, workload identity, canary routing, and circuit-breaking patterns
• Prometheus, Grafana, Loki, and OpenTelemetry observability design
• Helm packaging and automated YAML/schema validation
• PCI-DSS technical-control mapping and operational runbooks

Stack: Kubernetes · Amazon EKS · Helm · Terraform · Vault · Kyverno · Falco · Istio · Prometheus · Grafana · Loki · OpenTelemetry · Trivy · Syft · Cosign

Designed a production-oriented multi-Region disaster-recovery architecture for a payment platform, including a hot-standby model and explicit recovery gates.

Engineering areas:

• active-passive multi-Region architecture
• Route 53 failover and regional health checks
• Aurora, DynamoDB, Redis, and MSK replication strategies
• RPO < 1 minute and RTO < 5 minute engineering objectives
• financial write-authority fencing and idempotency-aware recovery
• 12 production DR runbooks and decision trees
• data-sovereignty architecture and compliance mapping
• Terraform and Kubernetes configuration structure
• DR readiness checks and evidence capture
• explicit distinction between designed architecture and live production evidence

Stack: AWS · EKS · Terraform · Aurora · DynamoDB · ElastiCache · MSK · Route 53 · WAF · Kubernetes · Prometheus

Built a production-inspired serverless backend demonstrating secure multi-tenant application architecture.

Engineering areas:

• Amazon Cognito authentication and JWT authorization
• tenant-level isolation with owner/admin/member roles
• PostgreSQL persistence with Amazon RDS
• AWS Secrets Manager and private VPC endpoint access
• Lambda and API Gateway HTTP APIs deployed with AWS SAM
• GitHub Actions using AWS OIDC and STS rather than long-lived credentials
• automated formatting, linting, testing, coverage, and SAM validation
• CloudWatch logging, alarms, dashboards, and SNS notifications

Stack: AWS · Python · AWS SAM · Lambda · API Gateway · Cognito · PostgreSQL · Secrets Manager · CloudWatch · SNS · GitHub Actions · OIDC

Designed a serverless-first logistics architecture around a modeled 50× traffic spike and asynchronous order processing.

Engineering areas:

• API Gateway and Lambda for spike-prone order intake
• DynamoDB access-pattern-first design
• SQS buffering and SNS event notifications
• EC2 Auto Scaling for the web tier
• RDS MySQL Multi-AZ and workload-driven cache decisions
• observability, failure testing, and regional resilience considerations

Stack: AWS · Lambda · API Gateway · DynamoDB · SQS · SNS · RDS · ElastiCache · EC2 · Auto Scaling · CloudWatch

Built a production-oriented three-tier application using Terraform and Docker.

Engineering areas:

• private application and database subnets
• Docker images delivered through Amazon ECR
• Application Load Balancer and Auto Scaling Group
• Flask, SQLAlchemy, and Amazon RDS MySQL
• AWS Secrets Manager instead of hardcoded credentials
• Terraform, Bash, and Python validation
• architecture, deployment, troubleshooting, and engineering decision documentation

Stack: AWS · Terraform · Docker · ECR · ALB · Auto Scaling · RDS · Secrets Manager · Flask

Built a controlled frontend release workflow using GitHub and AWS Amplify.

Feature Branch
      ↓
Pull Request Preview
      ↓
Staging
      ↓
Validation
      ↓
Production

Demonstrates branch-based environments, pull-request previews, environment-specific configuration, controlled promotion, and automated deployment. AWS 80 Projects: Project 10 completed.

The AWS 80 Projects Challenge is the central index for my hands-on cloud engineering portfolio.

Progress: [##########......................................................................] 10 / 80

The portfolio has evolved from foundational AWS builds into projects covering:

• cloud networking and compute
• high availability and Auto Scaling
• infrastructure as code
• serverless and event-driven systems
• Docker and container delivery
• multi-environment CI/CD
• identity and secrets management
• observability and operational readiness
• Kubernetes and platform security
• disaster recovery and resilience

Each substantial project aims to show more than a working deployment: requirements → architecture → implementation → security → automation → validation → operations → documentation.

AWS · VPC · EC2 · Auto Scaling · ALB · Lambda · API Gateway · Cognito · RDS · DynamoDB · ECR · S3 · CloudFront · IAM · STS · Secrets Manager · SQS · SNS · CloudWatch · Systems Manager · Route 53 · WAF

Kubernetes · Amazon EKS · Helm · RBAC · NetworkPolicies · Vault · Kyverno · Falco · Istio · Pod Security Standards · Trivy · Syft · Cosign · Zero Trust · Supply-Chain Security

Terraform · AWS SAM · GitHub Actions · OIDC · Docker · Linux · Bash · Python · CI/CD · Monitoring · Logging · Disaster Recovery · Runbooks

1. Define the problem — identify business requirements, constraints, and measurable targets.
2. Design the system — choose architecture based on reliability, security, performance, cost, and operational requirements.
3. Automate infrastructure — use Terraform, SAM, Helm, and CI/CD rather than relying exclusively on manual console configuration.
4. Secure the workload — apply least privilege, private networking, workload identity, secrets management, and defence-in-depth controls.
5. Validate continuously — test application behavior, infrastructure configuration, permissions, health checks, and failure scenarios.
6. Observe the system — build useful logs, metrics, alarms, dashboards, and audit evidence.
7. Document the engineering — record decisions, trade-offs, troubleshooting, operational procedures, and evidence boundaries.

• Kubernetes and Amazon EKS platform engineering
• cloud security and defence-in-depth architecture
• container delivery and image security
• Linux systems administration and production operations
• CI/CD and infrastructure quality gates
• Prometheus, Grafana, Loki, and OpenTelemetry
• multi-Region resilience and disaster recovery
• Azure infrastructure administration
• GCP infrastructure fundamentals

I don't want my GitHub to be a collection of tutorials that merely prove that I can follow instructions.

I am building it as an engineering record — a progression from foundational infrastructure to systems that require architectural reasoning, automation, security, reliability, observability, and operational judgment.

The goal is simple:

Build it. Secure it. Automate it. Break it. Observe it. Document it. Improve it.

SimeonOnTheCloud — building secure, scalable, automated, observable, and resilient infrastructure.