Kane Stephens

Built entirely with Terraform to demonstrate hands-on cloud security engineering ability

• Designed a modular Terraform codebase covering VPC, IAM, KMS, CloudTrail, GuardDuty, Security Hub, and Alerting, every module written from scratch rather than sourced from the registry.
• Built a custom VPC with segregated public/private subnets, removed the insecure default VPC, and enabled VPC Flow Logs with a least-privilege IAM role for log delivery.
• Implemented per-service KMS encryption (separate keys for CloudTrail and S3) with key rotation enabled to contain blast radius in the event of key compromise.
• Configured a multi-region CloudTrail with log file validation using SHA-256 and encrypted storage to ensure tamper-evident, forensics-ready audit logging.
• Enabled GuardDuty (S3 protection, malware scanning for EC2/EBS) and integrated findings into Security Hub, benchmarked against CIS AWS Foundations v5.0.0.
• Built CloudWatch alarms for root account usage, non-MFA logins, and unauthorised security group/IAM policy changes, with a 1-period evaluation for near-immediate alerting.
• Documented architecture, design rationale, and known limitations, and maintains a clear roadmap (AWS Config, remote state, multi-account SCPs).

• Architected and deployed a serverless resume site using S3, CLoudfront, ROute 53 and ACM with all infrastructure being managed through Terraform
• Developed a visitor-counter using Python, Lambda, API Gateway and dynamoDB and used Javascript frontend.
• Built a GitHub actions CI/CD pipeline to run Terraform formatting, validation and planning checks and also to deploy any html or frontend changes to S3.
• Implemented GitHub OIDC federation with AWS IAM, so that it uses temporary AWS credentials instead of access keys and also restricted role assumption to the repository and main branch.

• Supported secure connectivity across 200+ customer environments by troubleshooting VPN and remote access issues, enabling the wider support team to deliver customer support efficiently.
• Managed privileged access requests and credential administration while maintaining compliance with internal security procedures and protecting sensitive customer information.
• Monitored daily automated reports across customer SQL environments, identifying failed or delayed jobs and batch server errors, and coordinating early remediation before customer impact.
• Acted as a technical point of escalation for colleagues, supporting them through connectivity and access issues across a varied customer estate.

Technologies: VMware, Microsoft 365, Windows Server, SQL, VPN, Active Directory, Remote Desktop