// devops & devsecops portfolio

DevSecOps projects built.

Hands-on DevOps and DevSecOps work across pipelines, policy-as-code, cloud baselines, Kubernetes controls, FinOps automation, and incident response, with completed projects linked directly to GitHub.

View GitHub activity Project tracks

7

GitHub-ready project tracks

6

Public project repos live

1

Projects in progress

// project tracks

GitHub repositories

Published

Secure CI/CD Starter

secure-cicd-starter

Reusable GitHub Actions templates for building, scanning, signing, and releasing container services with security gates that engineers can copy into real repositories.

Shows practical shift-left delivery: secrets detection, SAST, IaC checks, SBOM generation, image scanning, and signed artifacts in one pipeline.

GitHub ActionsGitleaksSemgrepCheckovTrivySyftCosign

Project highlights

  • - Pull request annotations for security findings
  • - SARIF uploads into GitHub code scanning
  • - SBOM artifact attached to every release
  • - Documented break-glass bypass with expiry

Build steps

  • - Create reusable workflow files under .github/workflows/
  • - Add sample Docker app and Terraform module with known passing controls
  • - Publish screenshots of successful and failed security gates
  • - Write a clear technical README with architecture and tradeoffs

Shows how the pipeline design turns scanner output into enforceable DevSecOps guardrails.

View on GitHub

Published

Terraform Azure Landing Zone Lite

terraform-azure-landing-zone-lite

Small Azure landing-zone foundation with networking, policy assignment, tagging, budgets, diagnostics wiring, and GitHub OIDC deployment guidance.

Demonstrates cloud platform engineering, secure-by-default infrastructure, and governance-as-code for regulated teams.

TerraformAzureAzure PolicyTFLintCheckovGitHub OIDC

Project highlights

  • - Terraform formatting and validation in CI
  • - TFLint and Checkov static analysis
  • - Module examples for dev, test, and prod
  • - Security decision records for each baseline control

Build steps

  • - Reusable modules for resource groups, networking, diagnostics, and policy assignments
  • - Dev, test, and prod examples with safe tfvars templates
  • - GitHub Actions validation for fmt, validate, TFLint, and Checkov
  • - OIDC guidance that avoids static Azure credentials in CI

Proves you can design the cloud foundation teams deploy onto, including controls and developer experience.

View on GitHub

Published

Kubernetes Security Baseline

kubernetes-security-baseline

Deployable Kubernetes hardening baseline with secure Helm defaults, default-deny networking, least-privilege RBAC, Gatekeeper admission controls, policy tests, and configuration scanning.

Combines preventive admission controls, hardened workload configuration, automated security testing, and documented runtime response.

KubernetesHelmOPA GatekeeperConftestTrivykindGitHub Actions

Project highlights

  • - Policy tests for privileged pods and unsafe capabilities
  • - NetworkPolicy examples with allowed and denied flows
  • - Helm chart lint and template validation in CI
  • - Runtime detection runbook for suspicious container behavior

Build steps

  • - Create a local kind-based demo cluster path
  • - Add Gatekeeper constraints for pod security and image provenance
  • - Ship secure and insecure sample workloads to prove the gates
  • - Add diagrams for request flow, policy flow, and alert flow

Moves your profile beyond pipeline tooling into platform security and production Kubernetes thinking.

View on GitHub

Work in Progress

AI Security Guardrails Lab

A practical security baseline for LLM-backed services, covering prompt-injection testing, identity controls, sensitive-data handling, audit logging, and CI validation.

Extends DevSecOps delivery into AI-assisted services with guardrails that are explicit, testable, and ready to operate.

PythonAzure AI FoundryOWASP LLM Top 10PromptfooGitHub ActionsOpenTelemetry

Planned components

  • - Prompt-injection and jailbreak test cases with expected outcomes
  • - Sensitive-data redaction and safe-output policy examples
  • - Managed identity and least-privilege access design
  • - Evaluation traces, audit logging, and alerting guidance

Build steps

  • - Create a small LLM-backed service with a protected data boundary
  • - Add automated adversarial prompts to the CI validation workflow
  • - Implement input, output, and tool-use policy checks
  • - Document incident handling for unsafe or unexpected model behaviour

Shows how cloud security principles apply to the new AI delivery surface: identity, data protection, testing, observability, and response.

Repository not published yet

Published

SonarQube + Trivy DevSecOps Lab

sonarqube-trivy-devsecops-lab

Hands-on lab that builds a Java or Node service, runs code quality and security checks, scans the container image, and publishes findings.

Turns tutorial-style DevSecOps learning into your own working lab with screenshots, pipeline logs, and clear remediation notes.

JenkinsSonarQubeTrivyDockerMaven or NodeGitHub

Project highlights

  • - Pipeline screenshots for build, quality gate, and security scan
  • - Before-and-after remediation commit history
  • - Documented false-positive handling
  • - Docker Compose lab setup for local reproduction

Build steps

  • - Create docker-compose.yml for Jenkins and SonarQube
  • - Add a sample app with intentional low-risk findings
  • - Write Jenkinsfile stages for build, unit test, SonarQube, Trivy, and publish
  • - Capture results in README and link from the portfolio page

Makes your GitHub activity visible through CI, scanning, and troubleshooting proof.

View on GitHub

Published

Cloud Cost Governance Bot

cloud-cost-governance-bot

Python automation that reviews cloud inventory exports, flags cost and governance drift, and opens actionable GitHub issues.

Combines FinOps, governance, automation, and security hygiene into a project that speaks to senior platform roles.

PythonGitHub ActionsAzure Cost ManagementAWS Cost ExplorerMarkdown reports

Project highlights

  • - Sample CSV inventory input with anonymised data
  • - Generated governance report
  • - GitHub issue creation dry-run mode
  • - Unit tests around tagging and budget rules

Build steps

  • - Define cost and tag policy rules in YAML
  • - Parse sample Azure and AWS export files locally
  • - Generate a markdown report for pull requests
  • - Add dry-run GitHub issue creation for drift items

Shows the business side of platform engineering: controls, cost, and automation that leaders care about.

View on GitHub

Published

Cloud Incident Response Runbooks

cloud-incident-response-runbooks

Operational runbooks and small automation scripts for leaked secret response, exposed storage, suspicious IAM changes, and vulnerable image rollout.

Demonstrates incident thinking, communication, containment steps, and automation without exposing any employer-specific work.

BashPythonAWS CLIAzure CLIGitHub ActionsMarkdown

Project highlights

  • - Runbooks with severity, owner, detection, containment, and recovery sections
  • - CLI scripts with dry-run defaults
  • - Post-incident review template
  • - Mapping to common controls such as least privilege and logging

Build steps

  • - Write four runbooks from realistic but anonymised scenarios
  • - Add scripts that validate access before changing anything
  • - Create tabletop exercise checklist
  • - Publish a blog post linking each runbook to platform controls

Positions you as someone who can operate under pressure and build repeatable security response, not just deploy tools.

View on GitHub