Available now · UK remote or hybrid

I build the infrastructure that AI products run on.

Cloud and AI platform engineer, five and a half years across AWS, Azure and GCP. I do the infrastructure and the AI layer on top of it, which in practice means Terraform at estate scale, Kubernetes and DevSecOps, then agents, MCP servers, evaluation and guardrails. Most of what I build is public.

Book a chat Try my live agent Download CV
200+
engineers on the AI platform I ran
3
clouds in production, with Terraform modules for each
2024
Google Award, GenAI Excellence
01

Ask the agent

The trace below is scripted, not live. The real agent is deployed and free to try, have a go (the public instance replays recorded runs, so it costs nothing).

portfolio-agent Scripted walkthrough Open the live agent →
Try one
YOU—

For the engineers: this is a miniature of the Context Window Explorer from mcp-context-inspector, an MCP server I built because most agent tooling re-displays data your interface already had, rather than the part nobody renders. Figures below are illustrative. The deployed version reports per-session breakdowns, with token counts labelled as estimates rather than presented as exact provider usage.

02

Experience

Four roles, all delivery-facing. The through-line is platform work other engineers depend on.

Sohaib, you are a delight to work with and you have continuously been supporting and helping us onboard onto this LLM platform. We’ve been able to automate our workflows and increase productivity by 45%.
An engineer who onboarded onto the platform, 2026
2026VeracrossSenior AI Platform Engineer. Multi-agent LLM platform on Bedrock, an eval harness gating every PR, guardrails across three regions, and Terraform across a multi-brand AWS estate.
2025–26LSEGSenior Cloud & AI Engineer. Ran an enterprise AI platform used by 200+ engineers end to end: DevOps and deployments, the agentic layer and MCP setup, and unblocking every team onboarding onto it. Escalated to Microsoft’s AI Product team to sort out AI Foundry issues.
2023–25PwCSenior DevOps Engineer. Led the Kubernetes workstream for an internal SaaS platform and mentored the juniors on the team. Shipped an AI compliance app into three tier-one bank environments, plus Landing Zones across AWS and Azure.
2021–22CapgeminiDevOps Engineer. Serverless and EKS workloads, with DevSecOps scanning wired into four different CI systems.

Terraform Associate, Azure Fundamentals and AWS Cloud Practitioner certified, currently working towards the CKA. BSc from Brunel University London.

03

Case studies

Platform work is mostly invisible, so here it is written up the way I would write a postmortem.

Problem
Legitimate user queries were getting blocked in production. Everyone assumed prompt-attack detection was firing on benign input, and acting on that would have burned the week.
What I did
Built 27 test cases and 45 positive controls, ran them per region, then repeated them on identical inputs to see whether the detector was even deterministic.
Result
It was the HATE filter strength, not attack detection. PROMPT_ATTACK turned out to be non-deterministic even at LOW (83% one run, 94% the next), so it cannot gate a release. One config change across three regions fixed it.
Problem
Deployments were manual, per model and per region, and you checked quota by asking someone. If it did not fit you found out halfway through, with the estate left in a partial state.
What I did
A five stage Python pipeline (quota discovery, capacity weighting, dry run, tfvars generation, apply) with one YAML file per model family driving Terraform.
Result
50+ deployments from declarative config and 30 minutes down to 2. More moving parts than a hand written resource block, which is the trade, but failures moved to the start where they are cheap.
Problem
Agent demos are usually unfalsifiable. If the data shifts run to run you cannot score it, and if the reasoning is hidden you cannot tell competence from luck.
What I did
Deterministic mock infrastructure so eval scoring stays reproducible, five tools (services, metrics, logs, deployments, cost), and a UI that streams each tool call live instead of showing a spinner.
Result
8/8 eval scenarios passing, scored on tool choice and on the facts reaching the answer. One has a false premise: ask which deployment broke checkout-api when none did, and a good answer traces it to the inventory-service dependency rather than inventing one.
Problem
Most agent observability re-shows you data your own interface already had. The genuinely invisible part is what entered context, and how much of it the user never sees.
What I did
A drop in MCP server over Streamable HTTP with eight tools, so any client can connect, Claude Desktop included. Token counts are labelled estimates rather than exact usage, documented as a deliberate trade.
Result
System prompt, tool specs, reasoning, results and answer, in the order they actually entered context, split by what the user sees versus overhead. Pulled out of the agent above once it was obviously useful on its own.
04

Selected work

Two of these are deployed and open to anyone. Everything else is public source.

gcp-vertexai-app

Vertex AI Vector Search indexes and endpoints, with Python scripts for embeddings and validation.

TerraformPythonGCP Source ↗2026
terraform-azure-genai-infrastructure A full GenAI estate: OpenAI accounts, AI Search, APIM gateway, Container Apps behind it. source ↗ 2026
terraform-azure-rbac-module Entra ID groups and scoped role assignments, so permissions live in a reviewable diff. source ↗ 2025
+ 36 more The learning archive, 2019 to 2021. Left public on purpose. browse ↗ 2019–21
05

Writing

Three posts, each from a problem I hit at work rather than a tutorial rewritten from the docs.

Jan 2026 The Azure LLM Quota Problem You’ll Hit At Scale (And How I Built Around It) Deploying a handful of models to AI Foundry is fine. At 50+ across multiple instances you hit a gap neither Azure’s tooling nor Terraform solves: quota allocation at deployment time. 8 min Aug 2025 Terraform Tips: Understanding try() and lookup() and When to Use Them Two functions that stop a plan breaking the moment a value is missing, and the distinction between them that is easy to get wrong. 2 min Jul 2025 Terraform 1.10.0: Native S3 State Locking Without DynamoDB S3 conditional writes replace the DynamoDB lock table. One backend line, one less service to run, and clearer errors when a lock is held. 3 min
All posts on Medium →