Senior Cloud DevSecOps Consultant · Cloud Solutions Architect · SRE
Yahia Mohamed Benabbou. Designing, migrating, securing and operating production infrastructure across AWS, Azure, Oracle Cloud and on-premises estates — Kubernetes at fleet scale, Terraform everywhere, CI/CD that ships daily, sovereign and GPU/AI infrastructure for workloads that can't leave the building, and the observability to prove any of it works. This page is the portfolio behind 7+ years of engineering work — six systems designed end-to-end, twenty-four certifications, and the security controls that held under real production load.
Selected work
Client names are withheld under NDA. Architecture, scope and outcomes are available in detail on a call. Four of these are written up in full as case studies on nearvic.com.
Replaced fragmented per-team pipelines with a centralised, templated delivery platform. Security scanning, dependency checks and policy gates run on every build, so problems surface at merge time rather than in a quarterly audit.
Azure DevOps · Jenkins · GitHub Actions · SAST/SCA · HashiCorp Vault · Helm
+60%deployment frequency
−80%vulnerabilities reaching production
95%findings remediated pre-production
Delivered the country's first full-rack Oracle C3 installation alongside Oracle's architects, then onboarded ten-plus organisations onto the platform — workloads that legally could not leave national territory.
OCI Compute Cloud@Customer · Terraform · Ansible · OCI DevOps · GitHub Actions
10+organisations onboarded
1stC3 deployment in the country
100%data residency maintained
Built and tuned NVIDIA GPU environments on OCI for rendering, simulation and large-model inference — autoscaling, network and topology tuning, and monitoring dashboards that make expensive silicon accountable per workload.
OCI GPU shapes · NVIDIA · vLLM · Kubernetes · Terraform · OCI Monitoring
Scaleautoscaled multi-node GPU fleet
Costper-workload attribution and tuning
ISO27001 / PCI DSS certified facility
Led migration of core applications from on-premises VMware estates to OCI and AWS. Designed the landing zones, network topology and cutover runbooks, then ran the cutovers — in environments where an outage is a regulatory event.
OCI · AWS · VMware · Terraform · Ansible · OKE
−35%infrastructure cost after migration
99.9%availability held through cutover
0unplanned outages from migration
Designed and ran a production Kubernetes platform spanning fifty-plus clusters with automated lifecycle management, golden-path Helm charts and a shared observability stack. Teams ship to it without filing a ticket.
Kubernetes · Helm · Istio · Prometheus · Grafana · Loki · ELK
50+clusters, automated lifecycle
SOC 2controls implemented and evidenced
−70%request to running environment
Built and maintained cloud-native applications in Node.js, React and Next.js for a London product team, then took over delivery: CI/CD, AWS infrastructure and automated testing. The reason my platform work lands with developers instead of at them.
Node.js · React · Next.js · GitLab CI · AWS (EC2, S3, RDS) · MySQL
+25%application performance
CI/CDintroduced from scratch
SASTand dependency scanning in-pipeline
Security in practice
The same systems, re-cut by the controls I built and ran inside them — identity, secrets, service-to-service trust, and the gates standing in front of production.
Core banking applications moved to OCI and AWS, and the trust model moved with them: identity-based access control instead of flat network trust, microsegmentation between workloads, mutual TLS for east-west traffic through the service mesh, and Vault as the single source for secrets, dynamic database credentials and certificate issuance. Compliance checks run continuously against the regulatory baseline rather than the week before an audit.
HashiCorp Vault · Istio mTLS · Kubernetes RBAC · microsegmentation · OCI Cloud Guard · AWS GuardDuty · Terraform · Ansible
500K+daily transactions on the platform
99.9%environment consistency, drift eliminated
mTLSservice-to-service by default
Centralised delivery for thirty-plus microservices with SAST, DAST, dependency analysis, container scanning and secrets detection wired into every pipeline — then the runtime half most teams skip: image scanning, admission control, network policies and RBAC on the clusters receiving those artefacts. Findings route to the owning team with severity thresholds attached, not into a quarterly spreadsheet.
SonarQube · Trivy · SAST/DAST/SCA · secrets detection · admission control · network policies · Kubernetes RBAC · GitHub Actions · ArgoCD · Helm · OpenShift
−45%production incidents
30+microservices on one hardened path
−50%engineer onboarding time
A cloud-native SaaS platform in React, Node.js and Java microservices on EKS, where the security work sat in the code rather than around it: token-based authentication with OAuth 2.0 and OIDC, role-based authorisation enforced per service, and the application-layer defences that get dropped under delivery pressure — input validation and injection prevention, output encoding against XSS, and CSRF protection on state-changing routes.
Node.js · Java · React · OAuth 2.0 · OIDC · bearer tokens · AWS EKS · GitLab CI · SAST
OAuth 2.0and OIDC token-based auth
−60%mean time to resolution
AppSecinjection, XSS and CSRF defences
Capabilities
Each maps directly to one or more of the systems shown in Work — capability demonstrated in production, not claimed in the abstract.
CI/CD pipelines built from scratch or rescued from sprawl — GitOps delivery, deployment automation, infrastructure as code, and the golden paths that let teams ship without filing a ticket. Automation comes first; security and reliability are built into the same pipeline, not bolted on after.
Reference architectures, multi-cloud design and platform decisions across AWS, Azure and Oracle Cloud — capacity planning, cost modelling and vendor-neutral advice shaped by production experience, not by whichever vendor sponsors the workshop.
Assessment, target architecture and execution for moves from on-premises or VMware onto AWS, Azure or OCI. Multi-account structure, network design, identity baseline, cost guardrails, and a cutover plan you can hand to an auditor.
Production-grade clusters, GitOps delivery, reusable Terraform modules and an internal developer platform, so teams provision what they need themselves with the guardrails already baked in.
Security gates inside the pipeline instead of bolted on after: IaC scanning, container and dependency analysis, secrets management, policy-as-code, threat detection with OCI Cloud Guard and AWS GuardDuty, and continuous compliance monitoring against a SOC 2 control baseline — evidence collected continuously, not the week before an audit.
SLIs, SLOs and error budgets that mean something. Observability across logs, metrics and traces. Incident response, blameless postmortems, capacity planning and tested disaster recovery — not a DR document nobody has opened.
GPU clusters for inference and compute-intensive work: NVIDIA GPU node pools on Kubernetes, vLLM-based LLM serving, autoscaling and topology tuning, and monitoring that attributes GPU time to the workload that used it — delivered on OCI GPU shapes.
Technologies I work with
Credentials
Engineering degree (Bac+5) in Networks, Systems and Programmable Services — École Nationale des Sciences Appliquées, Marrakech. A five-year integrated engineering track under the Moroccan system, broadly equivalent to a Master's degree.
AWS Certified Security Specialty · Amazon Web Services
Certified Kubernetes Security Specialist (CKS) Linux Foundation · CNCF
Professional Cloud Security Engineer Google Cloud
Professional Cloud DevOps Engineer Google Cloud
DevOps Engineer Expert (AZ-400) Microsoft
Azure Administrator (AZ-104) Associate · Microsoft
Kubernetes & Cloud Native Security Associate (KCSA) Linux Foundation · CNCF
Certified Kubernetes Application Developer (CKAD) Linux Foundation · CNCF
AWS Certified DevOps Engineer Professional · Amazon Web Services
AWS Certified Solutions Architect Associate · Amazon Web Services
AWS Certified Developer Associate · Amazon Web Services
Certified Kubernetes Administrator (CKA) Linux Foundation · CNCF
Kubernetes & Cloud Native Associate (KCNA) Linux Foundation · CNCF
HashiCorp Certified: Terraform Associate 003 · HashiCorp
Azure Network Engineer Associate · Microsoft
OCI Security Professional Oracle
OCI Architect Professional Oracle
OCI DevOps Professional Oracle
OCI Operations Professional Oracle
OCI Foundations Associate ×3 Oracle
Oracle Cloud Data Management & AI Foundations Oracle
Linked names go to the issuer's public verification page. The five newest (AWS Certified Security, both Google Cloud Professional certifications, DevOps Engineer Expert and Azure Administrator), OCI Foundations Associate ×3 and Oracle Cloud Data Management & AI Foundations are left unlinked pending a confirmed badge URL — verifiable on request in the meantime.
AWS Certified Solutions Architect Professional · Amazon Web Services
PlannedCertified Cloud Security Professional (CCSP) ISC2
PlannedThese are on the roadmap, not on the wall. They are listed so you know where the practice is heading — and so nothing above this line is ever in doubt. Every certification in the list above is held today and can be verified on request.
References
"It has been a great pleasure working with Yahia. A great professional with extraordinary technical skills."
"Yahia has an exceptional ability to get to the bottom of any problem his team faces, whether technical or human. That is rare in one person, especially combined with how business-oriented he is given his level of technical expertise."
"J'ai collaboré avec Yahia dans un contexte exigeant où performance et réactivité étaient essentielles. Son expertise dans le domaine du cloud et sa capacité à travailler efficacement en équipe ont contribué de manière significative au succès de nos projets."
Questions
If your question isn't here, just ask.
For most, yes — certifications in Credentials link to the issuer's public verification page wherever a confirmed badge URL exists. The ones not yet linked are named explicitly rather than left to look verified when they aren't, and can be verified on request.
Every project on this page involved confidential systems, so client and employer names are withheld under NDA. Architecture, scope and outcomes are described in as much detail as confidentiality allows.
Banking and fintech, sovereign cloud, GPU compute, platform engineering and product engineering — see Work. No single-industry lock-in; the discipline carries across sectors.
Yes — nearvic.com is the practice this work is done under. This page is the detailed portfolio behind it: the certifications, case studies and references.
Contact
I reply to every serious message within one working day.