The server nobody dares touch.
Configured by hand two years ago, and the person who did it has moved on.
I rebuild it as code, so it can be recreated in an afternoon.
Infrastructure as code →Remote · Working to your time zone · Taking new projects
AWS DevOps Engineer for teams that need their cloud to just work
You have a product to ship. I make the part underneath it boring: infrastructure in Terraform, releases that deploy themselves, and monitoring that warns you before your customers do. Then I hand it all over, so your team owns it.
AWS Certified
SOLUTIONS ARCHITECT — VERIFY
8+ Years
PRODUCTION CLOUD SYSTEMS
Live Monitoring Demo
REAL GRAFANA DASHBOARD
EN · FR · AR
WORKING LANGUAGES
// Sound familiar?
Most cloud problems are unfinished systems
Most businesses don't have an infrastructure problem. They have a repeatability problem. Something was set up once, by hand, and nobody has dared touch it since. Here is what that usually looks like.
Deploys that need one specific person.
If they're away, nothing ships.
A pipeline that tests and deploys on every merge, with a rollback that has actually been tried.
Deployment & rollback review →Outages your customers find first.
Dashboards and alerts that reach a person before the support inbox does.
Hosted monitoring →An AWS bill nobody can explain.
It grew, and nobody knows which line did it.
A read-only review that names the waste, line by line.
Cost optimization →An account nobody has reviewed.
Old keys, open buckets, admin access handed out "for now".
A security review that lists what is exposed, in order of risk.
AWS security review →Reports rebuilt by hand every Monday.
And two of them disagree.
Pipelines that survive a rerun, and an answer when the numbers don't match.
Data pipeline review →Every one of those is a system that was never finished. Finishing them is the work I do.
// Services
What you can hire me for
Five ways to work together. Each one starts the same way: you tell me where things stand, and I come back with a fixed quote in writing before any work begins.
Build and migrate on AWS
New infrastructure, or a move from another provider, done as code.
- Terraform, VPC, IAM and environments you can rebuild
- Migrations from a VPS, another cloud or Supabase
- CI/CD with tested rollback
Reviews and hardening
A fixed-scope look at what you already run, ending in a written, prioritised list.
- AWS security, architecture and resilience reviews
- VPS, container, SSL and WordPress hardening
- Email deliverability and DNS repair
Managed AWS
Ongoing care for an account after it's been reviewed: patching, backups restored rather than assumed, and a written report every month.
- Three monthly plans, business hours
- Your AWS bill stays yours, paid directly to Amazon
- No 24/7 desk, and I won't pretend otherwise
Data engineering
Pipelines and reporting that you can trust after a rerun.
- S3 data lakes, Glue, Athena, Redshift and dbt
- Idempotent loads and schema-drift handling
- Reconciling reports that disagree
Managed apps
A business system, such as a CRM, a booking site or a helpdesk, set up on your own domain and looked after for a year.
- Ready-made systems and bundles
- Domain, SSL, backups and updates included
- One invoice a year
// How it works
How a project runs
-
We talk
Your goal, your current setup and your real constraints: budget, team size, compliance. A free 30-minute call is usually enough.
-
You get a fixed quote
A written scope, a price and a date. Nothing starts until you agree to it.
-
I build it as code
Terraform, pipelines, dashboards and alerts, with progress you can see as it happens.
-
You get the keys
The repository, the runbooks, the dashboards and full admin access. You are never locked in to me.
- Fixed quote in writing, before work starts
- You own the code and the accounts
- Written handover, every time — see a sample
- Honest scope: if you don't need it, I'll say so
// Selected work
All repositories on GitHub →
Work you can inspect
Talk is cheap in this field. So every project below links to something you can check yourself: a running dashboard, a public repository, or a written case study.
Client Project
Healthcare SaaS platform, migrated to AWS
A multi-tenant, HIPAA-oriented healthcare platform, moved off Supabase and onto AWS. Login moved to Cognito with MFA. The database moved to RDS PostgreSQL, with tenant isolation enforced in the database itself, not just in the app. Files are encrypted with KMS, email carries no patient data, and every release deploys from a tested image with automatic rollback.
Live Demo
Hosted Monitoring Platform
A managed Grafana stack I host for the client — API, website, cloud and server metrics with alerting and secure credential handover. The demo below is a real dashboard, not a screenshot.
Open Source
terraform-aws-baseline
A secure-by-default AWS account baseline in Terraform: encrypted remote state, a multi-AZ VPC with an isolated database tier, and least-privilege IAM. Start compliant instead of retrofitting security later.
Service
AI Invoice & Receipt OCR Pipeline
Event-driven document extraction on Textract and Lambda. Invoices, receipts and scans become clean CSV, Excel or database records — with low-confidence fields escalated to human review instead of silently corrupting your data.
Open Source
flightops-lakehouse
A cost-safe AWS lakehouse over live flight telemetry. The same dbt models run on DuckDB locally and Athena in the cloud, and CI proves the whole pipeline — 215 tests, 97% coverage — with zero AWS credentials.
Service
Self-Hosted Observability Platform
The full Grafana + Prometheus + Loki stack installed on your own servers via Docker Compose, with centralised log search and tested alert routing. Full admin access handed over — no SaaS or per-host fees.
Live Site
mJm Travel — Travel Platform
A large affiliate travel platform: Viator API integration, custom PHP and WordPress workflows, MySQL ingestion, SEO infrastructure and automated content routing — deployed and monitored on cloud infrastructure.
Read what clients say on Trustpilot ↗ and Upwork ↗
// Why me
One engineer, start to finish
The person you talk to does the work
No account manager and no hand-off to a junior. You deal with me from the first call to the handover.
Everything is written down
Code in your repository, decisions in the handover, and runbooks your team can follow without me.
I work to your clock
Flexible hours, including evenings and overnight, across every US time zone and beyond.
I'll tell you when you don't need me
Some setups are fine where they are. Hearing that in a free call is cheaper than finding it out halfway through a project.
Verified credentials
- AWS Solutions Architect – Associate
- AWS Cloud Practitioner
- AWS Data Visualization — Demonstrated
- AWS Data Streaming — Demonstrated
- AWS Data Lakehouse — Demonstrated
- AWS Incident Response — Demonstrated
- AWS Serverless — Demonstrated
- Google Data Analytics Professional
- Google AI Professional Certificate
- Power BI Data Analyst — Professional
- DevOps Engineer – Professional In progress
- Data Engineer – Associate In progress
// Free tools
All 17 free tools →
Not ready to talk yet? Check your setup first
17 free checks and calculators, no signup. Run one, and if it finds something you'd rather not fix yourself, send me the result.
Website Health Check
One scan across DNS, email, your certificate, redirects, robots.txt and your sitemap. Six checks, one report.
AWS Cost Estimator
What AWS would cost you per month, for a migration or a new build. Includes the NAT Gateway, egress and Multi-AZ charges that turn a small estimate into a large bill.
Email Domain Health Check
Find out whether someone can send email as your domain. SPF, DKIM and DMARC, checked in one pass.
Cloud Architecture Self-Assessment
Seventeen questions about what happens when something breaks. Scored out of 100 per pillar, weakest first, with the fixes in the order worth doing them.
// From the blog
Read all articles →
Notes from real projects
I write up the problems I actually hit, including the mistakes. If you want to know how I think before we talk, start here.
Building an Audit Evidence Repository on AWS: Immutable Retention Without Regret
Enabling S3 Object Lock on a bucket does not protect the objects already in it. This is how to build an audit evidence repository…
Read article →
Building a Secure Patient Document Portal on S3 and Cognito
Cognito for sign-in, S3 for the files, and a demo that passes on the first try. The problems start after that. Prefix isolation…
Read article →
Dockerfile Layer Caching: Why Every Build Reinstalls Everything
Your Dockerfile copies the lockfile before the source, and CI still reinstalls every dependency on every commit. That gap between a…
Read article →
Building a Personalized Learning Assistant on AWS Without Leaking Student Data
A personalized learning assistant on AWS rarely fails loudly. It fails by being helpful to the wrong student. Five failure families…
Read article →
// Questions
Before you get in touch
How do you price a project?
With a fixed quote, after a short conversation about scope. You get the price, what it covers and the date in writing before any work begins. I don't publish prices because two projects with the same name rarely have the same scope.
What do you need from me to give you a quote?
What you're trying to achieve, what you run today, and any deadline or compliance requirement. A rough description is fine. I'll ask for the rest.
Can you work with an existing AWS account, or do you start from scratch?
Both. Most engagements start with a Well-Architected review of what already exists, producing a prioritised list of security, cost and reliability findings. From there we either harden the current setup incrementally or codify it into Terraform so it can be rebuilt on demand. Rebuilding from zero is a choice, not a prerequisite.
Do you work with startups and small teams?
Yes — small teams often benefit most, because one engineer is usually carrying infrastructure alongside product work. Engagements scale from a one-week monitoring setup to a multi-week platform build.
What do I get at the end?
The Terraform code, the pipeline definitions, the dashboards and a written handover document, all in your repository, plus full admin access. You can read a sample handover document before committing to anything.
Which time zones do you cover?
I work to your clock, not mine. Hours are fully flexible, including permanent evening and overnight shifts, and I cover the full North American range: all US zones from Eastern through Central, Mountain and Pacific to Alaska and Hawaii, and all Canadian zones including Atlantic and Newfoundland. Europe, the Middle East and Africa are a straightforward same-day overlap. Remote by default, in English, French or Arabic.
// Start a project
Let's make your infrastructure boring.
Tell me what you're working on and where it hurts. I'll reply within one business day with the most practical next step, even if that step isn't hiring me.
Book a free 30-minute consultation
John-Nessime.com/l/Book-Meeting
Email
john@john-nessime.com
Phone
John-Nessime.com/l/Call
LinkedIn — connect
John-Nessime.com/l/LinkedIn
GitHub — follow
John-Nessime.com/l/GitHub
Medium — follow
John-Nessime.com/l/Medium
Credly — verified credentials
John-Nessime.com/l/Credly