Freelance Senior DevOps & DevSecOps Engineer · Cloud Solutions Architect · SRE
Yahia Mohamed Benabbou. Four years designing, migrating, securing and operating production infrastructure across AWS, Azure, Oracle Cloud and on-premises estates — Kubernetes at fleet scale, Terraform everywhere, CI/CD that ships daily, and the observability to prove any of it works. Available as a freelance DevOps engineer for contract and consulting work, remote on European hours.
Selected work
Client names are withheld under NDA. Architecture, scope and outcomes are available in detail on a call.
Replaced fragmented per-team pipelines with a centralised, templated delivery platform. Security scanning, dependency checks and policy gates run on every build, so problems surface at merge time rather than in a quarterly audit.
Azure DevOps · Jenkins · GitHub Actions · SAST/SCA · HashiCorp Vault · Helm
+60%deployment frequency
−80%vulnerabilities reaching production
95%findings remediated pre-production
Delivered the country's first full-rack Oracle C3 installation alongside Oracle's architects, then onboarded ten-plus organisations onto the platform — workloads that legally could not leave national territory.
OCI Compute Cloud@Customer · Terraform · Ansible · OCI DevOps · GitHub Actions
10+organisations onboarded
1stC3 deployment in the country
100%data residency maintained
Built and tuned NVIDIA GPU environments on OCI for rendering, simulation and large-model inference — autoscaling, network and topology tuning, and monitoring dashboards that make expensive silicon accountable per workload.
OCI GPU shapes · NVIDIA · vLLM · Kubernetes · Terraform · OCI Monitoring
Scaleautoscaled multi-node GPU fleet
Costper-workload attribution and tuning
ISO27001 / PCI DSS certified facility
Led migration of core applications from on-premises VMware estates to OCI and AWS. Designed the landing zones, network topology and cutover runbooks, then ran the cutovers — in environments where an outage is a regulatory event.
OCI · AWS · VMware · Terraform · Ansible · OKE
−35%infrastructure cost after migration
99.9%availability held through cutover
0unplanned outages from migration
Designed and ran a production Kubernetes platform spanning fifty-plus clusters with automated lifecycle management, golden-path Helm charts and a shared observability stack. Teams ship to it without filing a ticket.
Kubernetes · Helm · Istio · Prometheus · Grafana · Loki · ELK
50+clusters, automated lifecycle
SOC 2controls implemented and evidenced
−70%request to running environment
Built and maintained cloud-native applications in Node.js, React and Next.js for a London product team, then took over delivery: CI/CD, AWS infrastructure and automated testing. The reason my platform work lands with developers instead of at them.
Node.js · React · Next.js · GitLab CI · AWS (EC2, S3, RDS) · MySQL
+25%application performance
CI/CDintroduced from scratch
SASTand dependency scanning in-pipeline
Security in practice
The same systems, re-cut by the controls I built and ran inside them — identity, secrets, service-to-service trust, and the gates standing in front of production.
Core banking applications moved to OCI and AWS, and the trust model moved with them: identity-based access control instead of flat network trust, microsegmentation between workloads, mutual TLS for east-west traffic through the service mesh, and Vault as the single source for secrets, dynamic database credentials and certificate issuance. Compliance checks run continuously against the regulatory baseline rather than the week before an audit.
HashiCorp Vault · Istio mTLS · Kubernetes RBAC · microsegmentation · OCI Cloud Guard · AWS GuardDuty · Terraform · Ansible
500K+daily transactions on the platform
99.9%environment consistency, drift eliminated
mTLSservice-to-service by default
Centralised delivery for thirty-plus microservices with SAST, DAST, dependency analysis, container scanning and secrets detection wired into every pipeline — then the runtime half most teams skip: image scanning, admission control, network policies and RBAC on the clusters receiving those artefacts. Findings route to the owning team with severity thresholds attached, not into a quarterly spreadsheet.
SonarQube · Trivy · SAST/DAST/SCA · secrets detection · admission control · network policies · Kubernetes RBAC · GitHub Actions · ArgoCD · Helm · OpenShift
−45%production incidents
30+microservices on one hardened path
−50%engineer onboarding time
A cloud-native SaaS platform in React, Node.js and Java microservices on EKS, where the security work sat in the code rather than around it: token-based authentication with OAuth 2.0 and OIDC, role-based authorisation enforced per service, and the application-layer defences that get dropped under delivery pressure — input validation and injection prevention, output encoding against XSS, and CSRF protection on state-changing routes.
Node.js · Java · React · OAuth 2.0 · OIDC · bearer tokens · AWS EKS · GitLab CI · SAST
OAuth 2.0and OIDC token-based auth
−60%mean time to resolution
AppSecinjection, XSS and CSRF defences
How I work with clients
I take engagements where the infrastructure has to keep working while it changes. Discovery call first, written scope second, no exceptions.
CI/CD pipelines built from scratch or rescued from sprawl — GitOps delivery, deployment automation, infrastructure as code, and the golden paths that let teams ship without filing a ticket.
Reference architectures, multi-cloud design and platform decisions across AWS, Azure and Oracle Cloud — capacity planning, cost modelling and advice shaped by what I've actually run in production, not by a single vendor's playbook.
Assessment, target architecture and execution for moves from on-premises or VMware onto AWS, Azure or OCI. Multi-account structure, network design, identity baseline, cost guardrails, and a cutover plan you can hand to an auditor.
Production-grade clusters, GitOps delivery, reusable Terraform modules and an internal developer platform, so teams provision what they need themselves with the guardrails already baked in.
SLIs, SLOs and error budgets that mean something. Observability across logs, metrics and traces. Incident response, blameless postmortems, capacity planning and tested disaster recovery — not a DR document nobody has opened.
Security gates inside the pipeline instead of bolted on after: IaC scanning, container and dependency analysis, secrets management, policy-as-code, and a remediation workflow engineering teams will actually follow. Application side too — authentication and authorisation design, injection and XSS/CSRF prevention, and secure service-to-service communication over TLS and mTLS.
Technologies I work with
AWS (EC2, EKS, Lambda, RDS, Aurora, DynamoDB, S3, VPC, IAM, CloudWatch, Step Functions) · Azure (VMs, AKS, Storage, Monitor, Azure DevOps) · Oracle Cloud Infrastructure · Compute Cloud@Customer · GCP
Kubernetes · Docker · EKS · AKS · OKE · ECS · Fargate · OpenShift · Rancher · Helm · Istio · microservices architecture
Terraform (modules, remote state, multi-environment) · Ansible · AWS CloudFormation · AWS CDK · immutable infrastructure · configuration drift elimination
Azure Pipelines · Jenkins · GitHub Actions · GitLab CI · OCI DevOps · GitFlow · progressive delivery · deployment automation
Prometheus · Grafana · Loki · ELK and Elasticsearch · Kibana · CloudWatch · AWS X-Ray · OpenSearch · Azure Monitor · SLI and SLO instrumentation
IAM and least privilege · role-based access control · Kubernetes RBAC · OAuth 2.0, OIDC and SAML federation · X.509 certificates · mutual TLS between services · Zero Trust principles · access review and permission governance
HashiCorp Vault and dynamic secrets · AWS KMS and Secrets Manager · certificate lifecycle and key rotation · encryption at rest and in transit · vulnerability scanning and remediation · VPC design · ALB and NLB · NGINX · HAProxy · security groups and NACLs
Kafka and event-driven architecture · RDS (MySQL, PostgreSQL) · Aurora · DynamoDB · MongoDB · Redis · S3 and Azure Blob · high-throughput ingestion pipelines
VMware and on-premises estates · KVM · NVIDIA GPU shapes · HPC and bare metal · capacity planning · hybrid connectivity · datacenter operations
Credentials
Engineering degree (Bac+5) in Networks, Systems and Programmable Services — École Nationale des Sciences Appliquées, Marrakech. A five-year integrated engineering track under the Moroccan system, broadly equivalent to a Master's degree.
Kubernetes & Cloud Native Security Associate (KCSA) Linux Foundation · CNCF
Certified Kubernetes Application Developer (CKAD) Linux Foundation · CNCF
AWS Certified DevOps Engineer Professional · Amazon Web Services
AWS Certified Solutions Architect Associate · Amazon Web Services
AWS Certified Developer Associate · Amazon Web Services
Certified Kubernetes Administrator (CKA) Linux Foundation · CNCF
Kubernetes & Cloud Native Associate (KCNA) Linux Foundation · CNCF
HashiCorp Certified: Terraform Associate 003 · HashiCorp
Azure Network Engineer Associate · Microsoft
OCI Security Professional Oracle
OCI Architect Professional Oracle
OCI DevOps Professional Oracle
OCI Operations Professional Oracle
OCI Foundations Associate ×3 Oracle
Oracle Cloud Data Management & AI Foundations Oracle
Certification names link to the issuer's public verification page. Certified Kubernetes Administrator (CKA), OCI Foundations Associate ×3 and Oracle Cloud Data Management & AI Foundations are left unlinked pending a confirmed badge URL — verifiable on request in the meantime.
Certified Kubernetes Security Specialist (CKS) Linux Foundation · CNCF
In progressAWS Certified Security Specialty · Amazon Web Services
In progressAWS Certified Solutions Architect Professional · Amazon Web Services
PlannedCertified Cloud Security Professional (CCSP) ISC2
PlannedThese are on the roadmap, not on the wall. They are listed so you know where the practice is heading — and so nothing above this line is ever in doubt. Every certification in the list above is held today and can be verified on request.
References
"It has been a great pleasure working with Yahia. A great professional with extraordinary technical skills."
"Yahia has an exceptional ability to get to the bottom of any problem his team faces, whether technical or human. That is rare in one person, especially combined with how business-oriented he is given his level of technical expertise."
"J'ai collaboré avec Yahia dans un contexte exigeant où performance et réactivité étaient essentielles. Son expertise dans le domaine du cloud et sa capacité à travailler efficacement en équipe ont contribué de manière significative au succès de nos projets."
Engagement
Infrastructure work fails on process more often than on technology. These are the terms I work under, before anyone writes a line of Terraform.
Questions
If your question isn't here, it belongs on a call, not guessed at on a page — just ask.
Check the status dot in the rail/topbar and the Contact section below — both stay current. If it says available, I am taking on contract and consulting engagements.
Remote-first, based in Rabat (GMT+1) with full overlap with European teams and morning overlap with US East. On-site across EMEA on request — see Engagement.
Yes — every certification in Credentials links to the issuer's public verification page. The few not yet linked are called out explicitly rather than left to look verified when they aren't.
Yes, always, before any architecture, code or infrastructure detail is shared. Every client on this page is withheld under NDA as a result — you'd get the same treatment.
Banking and fintech, sovereign cloud, GPU compute, platform engineering and product engineering — see Work. No single-industry lock-in; the discipline carries across sectors.
Yes — nearvic.com is the company-level version of the same practice, for buyers who need to engage a named business rather than an individual. Same work, same person, different framing for different procurement needs.
Contact
I reply to every serious enquiry within one working day. If your problem is outside what I do well, I will say so and point you somewhere better.