Cloud & IaC
AWS, Azure (Entra ID, Intune, O365), Terraform, Packer, Ansible
Platform and infrastructure engineer · Denver, Colorado
I turn complex infrastructure and manual maintenance into secure, repeatable automation.
My work draws on 15 years of Windows and Linux experience including critical application deployments, identity management, custom monitoring, and recovery operations.
At Jefferson County, I reduced required after-hours system updates from hours to minutes. Through AutomationLab, I build and operate infrastructure with Ansible, Kubernetes, GitOps, and Terraform, connecting server provisioning, certificate renewal, credential rotation, and recovery testing. Explore live dashboards, project visualizations, and working code to see how it works.
Live, two ways
The platform is running right now. Here are two ways to look at it.
The NOC is the operator's view. Every tile is one operational domain reduced to its worst current state. Click any tile and its own live dashboard opens. The platform map is the system's view. More than 800 components in one radial map you drill into node by node, colored by health, fed from the running lab. Both are the sanitized public projection: hostnames, addresses and admin links are removed before the data leaves the lab, and the NOC page explains exactly what that costs.
NOC
Checking live state.
Checking the live NOC.
Click any tile to drill into that domain's live dashboard.
The live board is temporarily unavailable. The public site remains independent of the lab.
Platform map
Backup and DR
The backups are restored every week, by a pipeline, without a person.
Every week the recovery pipeline restores critical VMs into an isolated test path, boots them, checks the application, and removes the test copy. In the measured Vault run on 2026-07-12 the VM was destroyed outright and restored from that night's snapshot in 97 seconds. A canary secret written minutes before the destroy survived, and credential fetches worked after the service returned.
Weekly restore check: last run 2026-09-20 · PASS · 181 seconds
The first implementation needed twelve reruns. Several checks could report success before they had verified the restored service. Those checks now test the service response and the canary value before the run is allowed to pass.
Application delivery
Applications give the platform something to support
CityAmble is a web app for planning a city trip day by day on a map. It started as my Nashville, London and Paris planners in AutomationLab. Now it runs on Cloudflare as one app for every city. The project page explains how it moved out of the lab and how it uses the paved road.
Experience and capabilities
I built AutomationLab from work I had already learned to operate at scale
My background is Windows-heavy infrastructure, virtualization, identity, monitoring, and automation across higher education and county government. The lab gave me a greenfield place to connect those systems through Kubernetes, infrastructure as code and GitOps.
Automation and operations
I grew a Jenkins platform from 20 scripts to 135 Python and PowerShell jobs. A PowerShell service I wrote watched 350 virtual desktops, patched their images and fixed the common failures without an operator, so we never had to buy the $30,000 a year product that did the same job.
Infrastructure at scale
I ran two Windows-heavy estates, one of about 1,000 VMs with more than 700 Windows servers and one of a few hundred servers. I recovered about $10,000 per month in missed billing, supported a two-site Horizon environment using Cloud Pod Architecture, and automated patching for Horizon desktop images.
Identity and service accounts
I removed over 200 unused service accounts, rotated and documented every one that remained, made every Jenkins service account auto-rotating, disabled interactive login for service accounts, and migrated SQL Server to gMSA.
Tools I use to build, secure, and operate systems
CI/CD & GitOps
Jenkins (shared libraries, JCasC), Argo CD, Gitea Actions, GitOps workflows, Kaniko
Containers & orchestration
Kubernetes (K3s), Helm, Docker, cert-manager, External Secrets
Languages & APIs
Python, PowerShell, Groovy, REST APIs, Microsoft Graph API, Go (familiar)
Identity & security
Active Directory, Entra ID, hybrid identity (AD Connect), SAML/OIDC SSO, MFA, Conditional Access, gMSA, HashiCorp Vault, PKI (AD CS, step-ca, Let's Encrypt)
Observability
Zabbix (API automation, self-healing), Prometheus, Grafana, SCOM, SolarWinds
Virtualization & network
VMware vSphere/vSAN/Horizon, Proxmox VE (HA clusters), OPNsense, VLAN design, Cloudflare Zero Trust
More from the lab
Windows template factory
rebuilds golden images from code on a schedule and promotes only the image that passes.
Self-healing monitoring
applies allowlisted OS-aware repairs and escalates the rest.
Safe decommission
removes the VM, monitoring, DNS, secrets and address in the checked order.
Identity lifecycle
creates and disables users from role definitions with a restorable snapshot before offboarding.
Jenkins automation
versioned jobs, approval gates, and Linux, Windows, and Kubernetes workers behind everyday infrastructure work.
AIOps morning triage
correlates monitoring, metrics, CI and backup findings in code.