S/SuneelDevSecOps / Platform Engineer
Get in touch →

SUNEEL CLOUD · SECURITY · EDGE

DevSecOps &
Platform Engineer

I build secure, resilient, and scalable cloud platforms that empower product teams to ship faster, operate reliably, and scale with confidence.

Explore projects Download profile
KCNA · KCSA · AZ-900 View certifications →

Core capabilities

Platform Engineering

Build, automate, and scale platforms for product teams

Cloud Security

Secure, compliant, and policy-driven cloud environments

DevSecOps Automation

Shift left, automate delivery, and enforce security at scale

Kubernetes & Cloud Native

Resilient, containerized workloads designed to grow

BUILD & OPERATE WITH
AWS
Kubernetes
Terraform
GitHub Actions
Argo CD
Karpenter
Grafana
CDK / TypeScript

THE ENGINEER BEHIND THE PLATFORM

About Suneel

I’m Suneel. My focus is the intersection of platform engineering, cloud security, and developer experience. I care about making the secure path the simple path, and turning operational complexity into dependable systems.

Across infrastructure as code, delivery pipelines, cloud security posture, and edge/IoT systems, my approach is practical: automate the repeatable, make systems observable, and design for the people operating them.

Explore this portfolio’s source →

TECHNICAL SKILLS

A practical engineering toolkit.

Grouped by discipline for a clear view of the tools and systems I work with.

Cloud & infrastructure

  • AWS
  • Kubernetes
  • Terraform
  • AWS CDK
  • TypeScript
  • Karpenter

Delivery & automation

  • DevSecOps
  • GitHub Actions
  • Argo CD
  • Infrastructure as Code (IaC)
  • GitOps

Security & posture

  • Cloud Security Posture Management (CSPM)
  • Palo Alto
  • IAM
  • AWS WAF
  • SonarQube
  • Black Duck
  • Trivy
  • TLS

Operations & edge

  • Grafana
  • Observability
  • Site Reliability Engineering (SRE)
  • Edge Computing
  • AWS IoT Greengrass
FEATURED CASE STUDY · CONCEPT

Self-Service EKS Platform
with Karpenter & GitHub Actions

A reference architecture for a secure, cost-conscious Kubernetes platform on AWS. Built around elastic capacity, automated delivery, and clear boundaries between workloads.

Elastic capacityPolicy guardrailsObservable by default
View full case study

Architecture exploration, not a published production case study.

DELIVERY TO OPERATIONS AWS CLOUD
DevelopersCommit & review
→
GitHub ActionsCI / CD
→
TerraformInfrastructure
→
Amazon EKS
Apps & services
Karpenter · elastic compute
IAM & securityLeast privilege · OIDC
ObservabilityMetrics · logs · traces
ReliabilityResilience · recovery
Cost efficiencyRight-sizing · Spot
GUARDRAILS AT EVERY LAYER DESIGNED TO EVOLVE →

WHAT I DO

Platform engineering capabilities

Platform design & build

Secure, scalable cloud foundations

Security & compliance

Zero trust and policy as code

DevSecOps & automation

CI/CD and automated governance

Observability & operations

Visibility, SLOs, and incident readiness

CLOUD SECURITY / EDGE & IOT

From cloud posture
to connected systems.

Bringing security thinking to cloud environments, edge computing, and connected devices.

CLOUD SECURITY POSTURE

CSPM / Palo Alto

Cloud security posture management, configuration visibility, and security guardrails across cloud environments.

COMPUTE CLOSER TO THE SOURCE

Edge Computing

Distributed compute, local processing, and operational considerations for systems beyond the cloud.

CONNECTED DEVICES & LOCAL SERVICES

AWS IoT Greengrass

Cloud-to-edge integration, connected-device applications, and local services for IoT systems.

CONTINUOUS LEARNING

Certifications

Cloud native foundations, Kubernetes security, and Microsoft Azure.

ARCHITECTURE / SYSTEMS THINKING

Architecture & design decisions

Explore the decisions behind secure delivery, resilient workloads, and sustainable operations.

EKS platform architecture notesDelivery, security, capacity, and operations+

REFERENCE ARCHITECTURE · CONCEPT STUDY

Self-service EKS platform: design decisions

The challenge

Design a Kubernetes platform that gives product teams a repeatable delivery path while keeping identity boundaries, capacity management, and operational visibility explicit.

Delivery and security

GitHub Actions validates changes, SonarQube checks code quality, Black Duck scans open-source dependencies, and Trivy scans images and infrastructure configuration. Terraform provisions AWS resources, while Argo CD reconciles Kubernetes deployments from Git. Use short-lived OIDC credentials, scoped IAM roles, and isolated workload identities. Protect web traffic with AWS WAF and encrypt connections with TLS.

Capacity and resilience

Amazon EKS runs containerized services. Karpenter adjusts compute capacity to workload demand. Multi-AZ placement, disruption budgets, and tested recovery plans support resilience. Balance consolidation and Spot capacity against workload disruption tolerance.

Operations and validation

Collect metrics, logs, and traces through an observability stack. Track service-level objectives and resource utilization before tuning capacity or introducing Spot instances. Validate deployment rollback, recovery behavior, policy enforcement, and scaling under representative load before claiming production outcomes.

This concept describes design choices and validation goals. Production metrics and deployment results are not claimed.

Trust boundaries first

Short-lived identities, least privilege, and workload isolation define the foundation.

Git as the source of truth

Reviewed infrastructure changes and Argo CD reconciliation keep delivery repeatable.

Operate with evidence

Service objectives, telemetry, and recovery exercises guide reliability decisions.

BLOG / ENGINEERING NOTES

Engineering articles

Short reads on the decisions that shape everyday platform engineering.

IDENTITY & SECURITY

Why CI/CD should use short-lived credentials

Deployment pipelines need access to the cloud, but they do not need permanent keys.

Read engineering note +

GitHub Actions can exchange an OIDC token for a temporary AWS role session. This avoids storing long-lived access keys and gives each deployment a distinct session identity.

Restrict the trust policy to the intended repository and environment. Then scope permissions to the CDK bootstrap roles, and protect the GitHub environment with branch rules and review controls.

OIDC establishes identity; it does not replace authorization. The deployment role and the CloudFormation execution role still need deliberately scoped policies.

KUBERNETES & RELIABILITY

Autoscaling is more than adding nodes

Elastic infrastructure works best when application behavior and operational constraints are part of the design.

Read engineering note +

Karpenter provisions capacity for pending workloads, while pod autoscaling adjusts replica counts. Resource requests, scheduling rules, and availability-zone constraints influence how well those mechanisms work together.

Define disruption budgets and graceful shutdown behavior before introducing aggressive consolidation. Spot capacity can reduce costs for suitable workloads, but interruption handling and capacity diversity remain essential.

Measure scheduling latency, utilization, and service health. Treat savings and reliability as outcomes to validate, rather than assumptions attached to an autoscaler.

RESOURCES / BUILD IN THE OPEN

Resources

This portfolio, under the hoodNext.js · AWS CDK · S3 · CloudFront · GitHub Actions→Technical skills overviewPlatform design, security, automation, and observability→

LET’S BUILD SOMETHING THAT LASTS

Contact Suneel

Cloud security, secure delivery, edge computing, or a fresh perspective on your infrastructure. Start with a conversation.

Contact me