Emanuel G. Michea · Cloud Security Engineer

Primary Focus

AWS Cloud Security

AWS · Core Platform

Production-grade AWS architecture — security and automation first

ECS Fargate — serverless container orchestration, no EC2 management
VPC multi-AZ — private subnets, Security Group segmentation, no direct internet
ALB — Layer 7 routing, health checks, TLS termination point
IAM Least Privilege — per-service roles, no wildcard policies
Secrets Manager — zero hardcoded credentials, KMS encryption at rest
ECR — private container registry, IAM-gated access, image scanning

CloudWatch — structured JSON logs, custom metrics, SLI/SLO dashboards
SNS — proactive alerting on CPU, 5xx rate, latency thresholds
Auto Scaling — target tracking for cost-optimized compute
CloudFormation / Terraform — 100% IaC, zero manual changes
GuardDuty · Security Hub · WAF — roadmap threat detection layer
Well-Architected Framework — security, reliability, cost efficiency pillars

Capabilities

Core Skills

Identity & Access

AWS IAM · Zero Trust

Least-privilege role design per service, no long-lived access keys, OIDC federation for CI/CD. Every request authenticated and authorized at the control plane.

Infrastructure as Code

Terraform · Modular IaC

Modular Terraform with separate networking, compute, and security layers. Remote state with S3 + DynamoDB locking. Workspaces per environment.

CI/CD Security

DevSecOps Pipelines

GitHub Actions pipelines with security gates: build → scan (Trivy/Checkov) → push ECR → deploy ECS with zero-downtime rolling updates and automatic rollback.

Container Security

ECS Fargate · EKS

Non-root containers, read-only root filesystem, RBAC on Kubernetes, network policies, container image hardening with multi-stage builds.

Observability

CloudWatch · SLI/SLO

Structured JSON logging, custom application metrics, dashboard-driven SLI tracking, proactive SNS alerting before incidents impact users.

Supply Chain

Sigstore · SBOM · OpenSSF

Artifact signing with Sigstore, SBOM generation for full dependency visibility, OpenSSF Scorecard compliance for repository security posture.

Portfolio

Projects

AWS Terraform DevSecOps

AWS DevSecOps Infrastructure Platform

Production-oriented, multi-AZ AWS platform built with Infrastructure as Code, a Zero Trust security model, containerized microservices on ECS Fargate, and full observability via CloudWatch. Designed following real-world cloud engineering principles: security-first, immutable deployments, and separation of infrastructure from application responsibilities.

View repo ↗

Infrastructure Stack

Layer	Service	Purpose
Compute	AWS ECS Fargate	Serverless containers — no EC2 management
Networking	AWS VPC + ALB	Multi-AZ, Security Group segmentation, Layer 7 routing
Security	IAM + Secrets Manager	Least-privilege roles, KMS-encrypted secrets, zero hardcoded credentials
Observability	CloudWatch	Structured logs, custom metrics, SLI/SLO dashboards
IaC	Terraform	Modular, declarative infrastructure — 100% IaC, zero manual changes
CI/CD	GitHub Actions	GitOps pipeline with encrypted secrets, OIDC on roadmap

CI/CD Pipeline

git push → main ▸ terraform plan (PR) ▸ terraform apply ▸ build image ▸ push ECR ▸ deploy ECS

Observability

CPU threshold

> 80%

Alert + scale trigger

HTTP 5xx rate

> 5/min

Critical alert via SNS

Latency

> 2s

Performance warning

Security Controls

Implemented

Least Privilege IAM

Secrets Manager integration

Container non-root user

Security Group segmentation

100% Infrastructure as Code

Audit logging · CloudWatch

Roadmap

OIDC federation (replace static keys)

Terraform remote state (S3 + DynamoDB)

Private subnets + NAT Gateway

Trivy + Checkov in CI/CD

AWS WAF · GuardDuty · Security Hub

HTTPS with ACM on ALB

Emanuel G.
Michea