Syed Amjad Ali

Cloud Native Security Engineer

I build security controls that enforce themselves.

I automate security policy across Linux fleets and cloud platforms — firewall governance at scale, CIS hardening, Kubernetes admission control, service mesh zero-trust, and signed software supply chains. Four years building and running this in production on AWS and Azure.

See the work What I can build for you

Selected work

Production

Firewall Automation & Governance Platform

Centralised, database-driven network access control across a production Linux fleet — policy compiled per host, applied safely, and revoked automatically.

  • Python
  • iptables / IPSets
  • MySQL
  • Ansible
 Production

SSL Certificate Lifecycle Automation

Issue, transfer, install, disable and revoke for Let's Encrypt certificates across a fleet of multi-tenant nginx hosts — private keys kept off the command line and out of the web tier, and every destructive step made reversible.

  • Python
  • certbot / ACME
  • nginx
  • Bash
 Production

Node Configuration Inventory & Server Scoring

A read-only collector run across a Linux fleet over SSH, normalising hardware, OS, network and package data into one schema — then scoring every server and every network interface, with a reviewed dictionary for any metric it has never seen before.

  • Python
  • Paramiko
  • MySQL
  • Linux
 Production

Distributed Proxy Checker

A queue-driven daemon that tests a proxy from whichever server you choose, across a mixed Linux and Windows fleet — pickup cut from up to a minute to about two seconds, and every failure naming the stage it failed at.

  • Python
  • systemd
  • MySQL
  • FastAPI
 Built & drilled

Secure High-Availability Web Platform

A load-balanced, multi-AZ platform with MySQL GTID replication, encrypted backups and a WAF — built, then deliberately broken, with every recovery number measured rather than claimed.

  • Terraform
  • Ansible
  • AWS
  • MySQL
 In progress

GitOps Delivery Platform with Service Mesh

A Kubernetes platform where a git commit is the only deployment mechanism, and releases roll out as canaries under service mesh traffic control.

  • Kubernetes
  • ArgoCD
  • Istio
  • Helm
 In progress

Zero-Trust Secure Supply Chain Platform

Seven independent enforcement layers on Kubernetes — from signed images in CI down to runtime detection — each one verified by attempting to bypass it.

  • Kubernetes
  • Kyverno
  • Cosign
  • Istio

All projects, including earlier work →

The through-line

Default-deny with an explicit, reviewable allowlist — whether that's an iptables chain, a Kubernetes admission webhook, or a service mesh authorization policy. Same discipline, different layer of the stack.

I care about controls that can be verified, not just asserted. If I say something is blocked, I can show you it being blocked.

Get in touch →