Muhammad Qasim

Architecture that carries real traffic

I architect and operate production AWS environments end-to-end for high-traffic e-commerce and food-tech platforms: VPC design with public/private subnet tiers, Application Load Balancers, Auto Scaling Groups, RDS, CloudFront, Route 53, ACM and WAF — engineered for availability during peak ordering hours and promotion spikes.

Multi-account & multi-region by design

I've built centralized governance across a multi-account AWS Organization — organization-wide CloudTrail, IAM Identity Center (SSO) with Active Directory integration, service control policies, and cross-account, cross-region S3 replication pipelines (Singapore ⇄ Ireland) with custom KMS encryption architectures for durability and disaster recovery.

Cost as an engineering discipline

Cloud spend is an architecture signal. I've investigated and remediated real cost anomalies — tracing them from billing dashboards down to uncompressed asset delivery and misconfigured caching at the web tier — and turned the findings into permanent platform improvements.

Hybrid, not either/or

I design infrastructure that spans cloud and on-premises cleanly: VMware vSphere/ESXi estates with HA/DRS and snapshot policies running alongside AWS workloads, connected through VPNs and consistent identity, monitoring and backup layers so operations feel like one platform.

Linux at the core

RHEL, CentOS and Ubuntu fleets — provisioned, hardened, tuned and patched at scale. From kernel and storage-level fixes (like resolving boot failures caused by device-path fstab entries on NVMe instance reboots) to database server care for MariaDB and PostgreSQL, including disk-bloat reclamation on production systems.

Built to survive failure

Every design starts from the question "what happens when this dies?" — redundant tiers, tested restore procedures, RTO/RPO-aligned backup strategies and disaster-recovery drills, not just diagrams that look good in a slide deck.

Roots in telecom-grade networking

I spent the first three years of my career as a network engineer serving Pakistan's telecom sector — Telenor, Jazz, Zong, Ufone and Warid — deploying servers into data centers and engineering the connectivity between client data centers, provider facilities and offices. When the network is carrier infrastructure, "mostly working" isn't a state that exists.

From switch port to cloud edge

That foundation runs deep: multi-vendor routing and switching across Cisco ASA, Juniper SRX, F5 BIG-IP, MikroTik and pfSense, with BGP, OSPF, HSRP/VRRP, VLANs, trunking and IPSec — extended into cloud-native constructs: VPC topologies, security groups and NACLs, Transit Gateway patterns for cross-account connectivity, and Client VPN for secure operator access.

DNS and the delivery edge

I've executed production DNS migrations and operate Route 53 and Cloudflare at the edge — including solving real-world ISP routing failures for production subdomains by re-architecting proxy and DNS behaviour, and pairing CloudFront with tuned origin caching for global delivery.

Segmentation as security

Network design is the first security control. I design tiered, least-privilege network paths where databases, admin planes and public workloads live in deliberately separate zones with auditable traffic flows.

Platforms people order dinner on

I run the infrastructure behind e-commerce storefronts, CMS/CRM systems, mobile-app backends, call-center integrations and secure banking/SMS gateway interfaces — NestJS and React/Next.js stacks alongside classic LAMP/LEMP, with per-client isolation on shared staging environments.

Performance at the web tier

Nginx is my instrument: reverse proxying, TLS termination, compression, caching, security headers and structured logging. I've measurably improved asset delivery for national-scale ordering platforms by fixing compression and cache behaviour at the origin.

Live media at scale

Earlier in my career I ran video streaming platforms end-to-end: Wowza and Nginx/FFmpeg pipelines delivering HLS and RTMP with multi-bitrate transcoding, live DVR rewind, GEO blocking and API-driven feed monitoring — infrastructure where a dropped frame is immediately visible to thousands of viewers.

Integrations that can't fail quietly

Payment callbacks, SMS gateways and third-party APIs fail in subtle ways. I debug them at the protocol level — logs, headers, TLS, upstream behaviour — and design logging so the next failure is diagnosed in minutes, not days.

Pipelines teams actually trust

I've built production Jenkins CI/CD platforms from bare metal up — integrated with SonarQube quality gates and Bitbucket Cloud for NestJS and React/Next.js applications, deploying through dev, staging and production with per-client isolation and rollback paths.

Configuration as code

Ansible playbooks (certified EX294) and reusable Terraform modules for repeatable provisioning across accounts and regions — including a complete AWS site-to-site IPSec VPN (Customer Gateway, Virtual Private Gateway, routing) built entirely as code, and fleet-wide agent rollouts (Wazuh, Zabbix, New Relic, CrowdStrike) across Linux and Windows Server environments. This discipline has cut manual provisioning effort by more than 60% and eliminated configuration drift as a class of incident.

Automating the boring and the dangerous

The best automation removes both toil and human error: automated AMI baking for Auto Scaling fleets, scheduled encrypted backups, alert-driven remediation and self-documenting deployment workflows.

Scripts that run in production, not demos

My Bash tooling is written for the 3 a.m. failure case: strict error handling, locking, logging, alerting on failure and idempotent re-runs. Example: a backup system streaming zstd-compressed, AES-256-encrypted MariaDB backups directly to S3 — hardened iteratively through real restore failures on 100 GB+ production-scale datasets until restores were boring.

Python where structure matters

Beyond Bash, I build production Python tooling: a custom SIEM alert-notification framework with REST API integrations (Wazuh, OpenSearch), severity-based routing, duplicate suppression, structured logging and dynamically generated dashboard deep links — turning raw security events into one-click investigations.

Glue for everything

Cron orchestration, log parsing and rotation, certificate automation, health checks, AWS CLI workflows, database maintenance jobs — the connective tissue that makes a platform self-operating.

Diagnostics that adapt to the cluster

When a recurring Zabbix flush-latency alert hit a production 8-node Elasticsearch cluster, I turned the manual investigation into a reusable, version-adaptive Bash/jq tool — it auto-discovers topology, detects the ES version live, classifies nodes from real-time data, and generates a single readable incident report. That same investigation later root-caused a JVM heap OOM outage and drove a zero-data-loss, one-node-at-a-time remediation across the whole cluster.

Tested means restore-tested

A backup script that has never restored anything is a hypothesis. Every recovery tool I ship is validated against real production clones before it's trusted.

SIEM engineering, not just administration

I run Wazuh as a centralized SIEM across Linux and Windows fleets — and I engineer it: custom detection rules tuned against false positives, File Integrity Monitoring, vulnerability detection and Security Configuration Assessment, MITRE ATT&CK-aligned reporting, and a custom Python alert framework with team-based routing, deduplication and HTML notifications that deep-link straight to the exact alert in the dashboard. I also administer the OpenSearch clusters underneath — index templates, shard allocation and cluster-health recovery included.

Defense in depth, in practice

The SIEM layer sits alongside cloud-native detection — GuardDuty, organization-wide CloudTrail, CloudWatch metric filters and EventBridge/SNS alerting — plus endpoint protection with CrowdStrike Falcon deployed fleet-wide through Ansible, and deep-dive analysis of external vulnerability-scan traffic (QualysGuard) to keep defenses ahead of what attackers actually probe.

Hardening that survives audits

SSH and PAM hardening, Fail2Ban, auditd, SELinux/AppArmor, TLS configuration and Nginx access controls — applied systematically across production fleets and verified against penetration-test findings, not just checklists.

WAF tuning without breaking the business

Managed WAF rules block attackers and, badly tuned, legitimate users. I've run false-positive investigations on production AWS WAF deployments, isolating the exact managed rule responsible and designing scoped, label-matched overrides so protection stays on where it matters. I also work with Nuclei for template-driven vulnerability scanning and deployed a self-hosted Passbolt password manager for team credential security.

From audit finding to closed control

I've taken a full third-party security audit — thirteen findings across SSH, PAM, Fail2Ban, auditd, TLS permissions and web-server access controls — and systematically remediated every one on production infrastructure, with evidence the auditor could verify. I work directly with GRC auditors and translate their requirements into engineering.

Governance built into the platform

Organization-wide CloudTrail, service control policies, IAM role-based access with SSO, KMS-encrypted data at rest and lifecycle-governed retention: controls that are enforced by architecture rather than by policy documents alone. My banking-sector background (regulated environment administration, DR drills) shaped this discipline early.

Knowledge that outlives the engineer

I produce team-ready documentation — architecture wikis, runbooks, security training. I built and delivered an internal OWASP Top 10 training program complete with hands-on vulnerable-application labs for developer teams.