DevOps & Platform Engineer

Talha

AWS Infrastructure • KubernetesPlatform Engineering • SRE

I help teams ship confidently, run reliable cloud infrastructure and make production easier to understand.

Get in touch Explore projects Capabilities

AWS & multi-cloud accounts engineered

years delivering production platform systems

reduction in CI/CD pipeline runtime

sustained production platform uptime

Selected Projects

Selected infrastructure work, with code and architecture details.

EKS Platform Engineering

A reproducible EKS platform with private networking, workload identity and GitOps delivery, provisioned with Terraform.

Read the engineering note

Amazon EKSTerraformArgoCD

Repository

Architecture Breakdown

Production Spec

Separate Terraform roots for cluster infrastructure and Helm add-ons, with remote-state outputs connecting the layers. Includes private networking, managed node groups and an Argo CD bootstrap configuration.

Multi-AZ private VPC with isolated node groups and NAT gateway egress

IRSA binds add-on access to Kubernetes service accounts

KEDA & Cluster Autoscaler for cost-efficient, demand-driven scaling

Argo CD Helm bootstrap; application reconciliation requires additional configuration

Zero-Trust Kubernetes Secrets Management

Deliver AWS Secrets Manager credentials to Kubernetes workloads without storing plaintext secrets in Git or container images.

Read the engineering note

External Secrets OperatorAWS Secrets ManagerIRSA

Repository

Architecture Breakdown

Production Spec

External Secrets Operator examples map AWS Secrets Manager values into Kubernetes Secrets using IRSA authentication. Workload reload behavior and namespace boundaries require explicit validation.

External Secrets Operator pulling versioned secrets from AWS Secrets Manager

Eliminates plaintext credentials from Git, manifests, and container images

Scheduled secret synchronization; application reloads must be handled separately

IAM and store scope determine access boundaries; review them for each namespace

Enterprise Multi-Account AWS Landing Zone

A landing zone spanning 37+ AWS accounts, with isolated networks, shared connectivity and centrally managed access controls.

Transit GatewayPrivateLinkTerragrunt

Architecture Breakdown

Production Spec

Hub-and-spoke Transit Gateway topology, VPC PrivateLink for private service exposure, KMS Separation of Duties, IAM least-privilege enforcement, and CIS AWS Foundations Benchmark hardening — provisioned via modular Terraform and Terragrunt.

Transit Gateway hub-and-spoke mesh connecting 37+ isolated AWS accounts

VPC PrivateLink & Endpoints — microservices never traverse the public internet

KMS Separation of Duties — key usage restricted by resource and principal ARN

Reusable DRY Terragrunt modules with PR-gated plan reviews and state locking

More projects & writing (2)

CIS-Hardened Kubernetes Security Platform

Kubernetes admission policies and network boundaries that enforce safer workload defaults across shared EKS clusters.

KyvernoNetworkPoliciesIstio

Architecture Breakdown

Production Spec

Kyverno admission controller in audit and enforce modes, mandatory non-root execution, dropped Linux capabilities, default-deny NetworkPolicies, and Istio REGISTRY_ONLY egress — defense-in-depth posture aligned to SOC 2, HIPAA, and PCI DSS.

Kyverno policies enforcing CIS Benchmark & PSS Restricted across all namespaces

Non-root UID enforcement and full Linux capabilities drop on every pod

Default-deny ingress/egress NetworkPolicies with explicit allow rules per service

Istio REGISTRY_ONLY routing, with egress gateways and network policies enforcing outbound access

Structured Logging on AWS ECS Fargate

A practical guide to structured container logs on ECS Fargate using FireLens, Fluent Bit and CloudWatch Logs Insights.

ECS FargateFluent BitCloudWatch

Read Article

Architecture Breakdown

Production Spec

A practical engineering walkthrough covering structured log schema design, FireLens sidecar configuration, Fluent Bit routing rules, and CloudWatch Logs Insights queries — transforming raw container output into queryable, alertable observability data aligned to production SLOs.

FireLens log router sidecar with custom Fluent Bit output configuration

Structured JSON log schema for queryable, filterable container logs

CloudWatch Logs Insights queries for error rate, latency, and SLO alerting

Zero-code-change log enrichment — metadata injected at the infrastructure layer

Capabilities

How I can help your team.

Cloud Architecture & Infrastructure as Code

Build AWS environments your team can review, reproduce and maintain, with clear network and access boundaries.

AWSTerraformTerragrunt

Kubernetes & Platform Security

Run EKS platforms with workload isolation, managed secrets and policies that catch unsafe changes before deployment.

Amazon EKSKyvernoIstio

GitOps & Delivery Automation

Make releases repeatable with automated checks, reviewed infrastructure changes and clear rollback paths.

GitHub ActionsArgoCDSpacelift

Site Reliability & Observability

Connect logs, metrics and traces so engineers can investigate incidents and understand how services behave.

GrafanaPrometheusLoki

Tech Stack

Cloud & Containers

AWSAmazon EKSKubernetesDockerHelm

Infrastructure

TerraformOpenTofuTerragruntAnsible

Delivery

GitHub ActionsArgoCDSpacelift

Observability

GrafanaPrometheusLokiTempo

Security & Systems

IAMKyvernoIstioLinuxPythonBash

About

Talha Rehman - DevOps & Platform Engineer

I’m Talha, a DevOps and platform engineer. I work alongside product teams to simplify delivery and keep infrastructure dependable. I start by understanding what already exists, then make changes your team can review and own.

I also founded Devistio, where I help teams with cloud and platform engineering.

Operating Model

Remote & Relocation

Available worldwide

Credentials

AWS Solutions Architect & DevOps

BS Software Engineering (UMT)

Contact

What is getting in your team’s way?

Have a role or project in mind? Tell me what you’re building and where you need help. Open to remote work and relocation worldwide.

talha@devistio.com

Remote · Available Worldwide · +92 315 6569204

GitHubLinkedInMediumWhatsAppRequest CV