Cloud Architect | Multi-Account Networking & Incident Response (Public Sector)

Cloud networking, security, and incident-response work for a large public-sector AWS environment spanning dozens of accounts. The work covered both design (how traffic should flow securely between accounts and from remote users) and diagnosis (why specific flows were failing, and whether an incident was an attack or organic load).

Client details are withheld — this is an active engagement.

What I Did

• Multi-account connectivity — Transit Gateway topology, Site-to-Site and Client VPN, FortiGate SSL-VPN integration, and cross-account routing so traffic actually reaches resources end to end.
• Connectivity diagnosis — resolved “the route exists but traffic blackholes” cases by working through return-path routing, security groups, NACLs, and DNS resolution rather than guessing.
• DNS and hybrid resolution — Route 53 / Resolver design and troubleshooting across VPCs and on-prem.
• DDoS incident RCA — reconstructed attacks against live CloudWatch, CloudTrail, and load-balancer evidence; separated attack-driven origin scale-out from organic traffic growth to produce a defensible root-cause report.

Highlights

• Networking depth — Transit Gateway, VPN, hybrid, and the diagnosis skills for when it breaks
• Evidence-based RCA — conclusions anchored to telemetry, correlation checked before claiming causation
• Security posture — WAF/Shield review and least-privilege segmentation
• Stakeholder-ready reporting — findings written to be defensible when someone cross-checks the source data

Outcome

Reliable multi-account connectivity and a set of defensible incident reports — turning “the network is down for some users” and “are we under attack?” from guesswork into traceable, documented answers.