Pirvu C.

AWS DevOps Engineer | Terraform, Python, ECS, Cloud Security

I build cloud infrastructure that you can leave alone. Predictable, reproducible, auditable. Not held together with manual ClickOps and dread. Most teams I work with come to me when one of three things is happening. The AWS bill keeps climbing every month and nobody can explain why. I cut waste on real client workloads by moving idle EC2 to scheduled start and stop, replacing NAT Gateways with VPC endpoints (saves around $35 per month per environment, before traffic), right sizing instances, and surfacing waste with proper tagging and Cost Explorer dashboards. Production was set up in the console two years ago and now nobody dares touch it. I migrate ClickOps environments into Terraform without breaking running services. Module based, workspace driven, with state in S3 and DynamoDB locking. The handover is a repo your team can read, not a black box only I understand. The infrastructure works but it is exposed in places it should not be. I have moved public ALBs to private origins behind CloudFront and WAF, replaced shared IAM users with role based access, locked down security groups, and put secrets in Secrets Manager instead of environment files. Boring, careful work. The kind that prevents the 3 AM call. What I work with daily: - AWS — ECS Fargate, RDS, Aurora, S3, CloudFront, Route 53, Cognito, Secrets Manager, SQS, Lambda, EC2, VPC, IAM, WAF, CloudWatch - Terraform — custom modules, workspace structure, multi account setups, S3 and DynamoDB state - CI/CD — GitHub Actions, GitLab CI, automated database migrations, container scanning - Python — FastAPI services, Celery workers, automation scripts, infrastructure tooling - Security — Cognito with JWT auth, VPC design without NAT, IAM least privilege, audit logging - Containers — Docker, ECS Fargate (Spot and on demand), private ECR Recent work: - Built a battery storage SaaS platform on AWS. FastAPI plus Celery, dual queue ECS Fargate workers (Spot for short jobs, on demand for long ones), Cognito auth, full Terraform from scratch. - Architected a private ML training platform on OVH. GPU workers, Celery, Tailscale private networking, S3 compatible object storage. - Self hosted infrastructure deployment on a Swiss vServer. Docker stack with Keycloak SSO, Traefik with Let's Encrypt, GitLab CI/CD. - Migrated multiple client workloads from public ALBs to private origins behind CloudFront and WAF. - Built scheduled EC2 start and stop automation for a workflow stack to cut idle compute cost. How I work: - Everything goes in Terraform. If it is not in code, it does not exist. - I write things down. Runbooks, decision logs, architecture diagrams. The next person on the project should not need to call me. - I would rather flag a risk early than discover it during a deploy. - If I think the scope is wrong or the approach will not hold up, I will say so. You are paying for judgment, not just hands. Background includes 9 AWS certifications across architect, security, networking, and devops tracks, plus internships at Deutsche Bank and ING Hubs on the Java backend side, and ongoing freelance work across AWS infrastructure, security migrations, and platform engineering. If you are trying to clean up production, get out of ClickOps, cut your AWS bill, or build a new platform from scratch, happy to talk. If your project is more "throw a script together fast and do not worry about it later," I am probably not the right fit.