Hire the Best Cloud Security Framework Specialists

🔒 You need security that actually works — not a report that says it does. The organisations I work with want to find the vulnerabilities that matter, fix them with confidence, and get on with growing their business without security becoming the thing that stops them. I have delivered over 1,000 commercial penetration tests across 27 years. Not side projects. Not internal assessments. Full mission-critical engagements for high street and investment banks, hedge funds, insurance firms, government departments, police, military, national infrastructure, retailers, law firms, airports and more. I led the security architecture for the Athens 2004 Olympics internet-facing systems. I was lead architect on the UK Cyber Essentials scheme at launch. I have published in commercial security press and guest lectured at universities. There is a difference between someone who does penetration testing and someone who has seen every flavour of environment, every attack pattern, and every way organisations deceive themselves about their security posture. That difference is what you are hiring. 🎯 Where can I help: 🗡️ Network & Infrastructure Penetration Testing — adversarial testing of internal and external infrastructure, finding exploitable exposures before an attacker does. 🌐 Application Penetration Testing — web application and API security testing against real attack patterns: authentication, authorisation, input handling and business logic flaws. ☁️ Microsoft 365 Security Assessment — Entra ID, Conditional Access, PIM, Intune, DLP, sensitivity labelling, Exchange Online and Defender for Office 365. 🔷 Azure Security Assessment — identity and access management, network controls, storage and key management, Defender for Cloud posture, and monitoring coverage. 🟢 Google Workspace, GCP & AWS Security Assessments — configuration and access control assessments across Google and Amazon cloud environments. 🏛️ Security Architecture and Risk Advisory — senior technical input on architecture decisions, control design and risk without a full engagement commitment. 👤 Every engagement is delivered directly by me — David Morgan, founder of Metis Security. No account management layer, no junior handoffs, no templated output. You work with the person conducting the analysis and writing the report. 📋 How I work is as important as what I find Every finding in my reports is one I will defend as genuinely material to your environment. No padding, no low-hanging fruit included to justify the fee, no default risk ratings copied from a scanner. If your context changes the risk, the rating reflects that. What you receive: ✅ A visually structured report with clear separation between executive summary, findings and remediation roadmap — written to be read by people who are not security specialists ✅ Risk ratings adjusted to your specific environment and context, not defaulted from a tool ✅ A prioritised remediation roadmap so your team knows exactly what to fix first and why it matters commercially ✅ Immediate escalation of any high-risk finding or schedule-affecting issue during the engagement — you are never waiting until the end to hear something important ✅ Daily status updates so you always know where the engagement stands ✅ A debrief call at close to walk through findings, answer questions and finalise the report before it is delivered CISSP | ISSAP | Microsoft Security certifications | 27 years If you need to know whether your environment is genuinely secure — not whether it looks configured — I am worth a conversation.

🗽 U.S. and 🍁 Canada -only clients ☑️ Upwork Expert-Vetted 🌟 | 100% Job Success ✅ | 10,000+ hours 💻 on 200+ projects Hi there! 👋 I’m an Upwork veteran with over 10,000 hours delivered, 200+ successful projects, and $1M+ earned helping U.S. companies secure and scale their cloud and hybrid environments. ☁️ I specialize in Azure, Microsoft 365, and security-focused systems — delivering: • Secure infrastructure using Zero Trust, IaC (Terraform/Bicep), and DevSecOps pipelines • Incident response, forensics, and breach containment across regulated industries • Compliance-ready solutions aligned to SOC 2, HIPAA, ISO 27001, and NIST 800-53 As a certified consultant, I work directly with technical teams to deliver secure cloud transformation, implement controls, and respond to threats — fast. I also collaborate with Microsoft’s internal dev teams, giving me early-access insights and practical fixes 3–4 release cycles ahead of public rollout. Why Choose Me? ✅ $1M+ in security projects delivered across healthcare, fintech, crypto, and gov sectors 🔐 Architected Azure landing zones, GitOps pipelines, and zero trust cloud environments 🚨 Led incident response and forensic investigations for Fortune 500 and defense clients 📊 Built compliance workflows and policy-as-code enforcement for audit success 🪙 Secured crypto CI/CD pipelines and smart contract environments with GitHub, Checkov, GHAS 🧠 Career Highlights: ▪ Delivered security modernization and audit readiness for global government contractors and Fortune 500 companies ▪ Led compliance remediation and data protection initiatives across healthcare, fintech, and public sector clients ▪ Migrated global users to Microsoft 365 with security-first design — Exchange, Purview, Intune, Defender ▪ Built hybrid identity strategies (Entra ID, ADFS, GoDaddy 365, Azure AD B2C, custom policy support) ▪ Managed VMware-to-Azure hardening with conditional access, audit enforcement, and security baselines 🔧 Solutions I Deliver: • Azure Infra Security: Terraform, Bicep, Azure Policy, RBAC, Defender for Cloud • DevSecOps: GitHub Actions, tfsec, Checkov, Trivy, GHAS, pipeline reviews • Microsoft 365 Hardening: Defender, Purview, Compliance Center, Intune, Exchange • Compliance & Audits: SOC 2, ISO 27001, HIPAA, GDPR, NIST, CIS Benchmarks • Incident Response & Forensics: Malware analysis, reverse engineering, breach recovery • Crypto Security: CI/CD for smart contracts, wallet infra hardening, Web3 audits • Reverse-engineered malware to identify attack vectors and harden systems post-breach • Hardened Microsoft Exchange Online and Defender for Email in phishing-prone orgs • Integrated Azure Sentinel analytics with dashboards for cross-cloud visibility 🤝 Retainer & Advisory Support: • Ongoing guidance for CISOs, security architects, and compliance teams • Monthly retainers for SOC 2 evidence collection, security tool reviews, and policy automation • Rapid-response engagements for forensics, malware recovery, and breach root cause analysis 🧰 Platforms & Tools: • Azure, Microsoft 365, Azure Sentinel, Microsoft Defender (all modules), Intune • Terraform, Bicep, GitHub, Azure DevOps, GitOps, GHAS • Splunk, FTK, EnCase, Wireshark, Autopsy, Cisco ASA/Firepower • Checkov, Trivy, Aqua Security, smart contract security tooling • Compliance: SOC 2, HIPAA, ISO 27001, CIS, NIST, GDPR 📅 Let’s set up a free 30-minute consultation to explore how I can help you with security transformation, compliance readiness, or urgent recovery — no fluff, just fast, proven results. I bring the calm in chaos — whether you're planning secure growth or cleaning up after a breach, I’ll steady the course and deliver results. 📌 Helped a fintech client pass SOC 2 in under 60 days 📌 Responded to ransomware, restored 95% of systems in 48 hours 📌 Hardened crypto wallet infra securing $100M+ in assets Thanks again for stopping by. You can invite me to your job post or simply send a message to arrange a quick discovery call — I respond fast, and we’ll keep everything inside Upwork. — Nandy Bo 🗣️❝ 𝙄𝙩 𝙝𝙖𝙨 𝙗𝙚𝙚𝙣 𝙖 𝙥𝙡𝙚𝙖𝙨𝙪𝙧𝙚 𝙩𝙤 𝙬𝙤𝙧𝙠 𝙬𝙞𝙩𝙝 𝙉𝙖𝙣𝙙𝙮 𝙙𝙪𝙧𝙞𝙣𝙜 𝙩𝙝𝙚 𝙩𝙧𝙖𝙣𝙨𝙞𝙩𝙞𝙤𝙣 𝙤𝙛 𝘾𝙖𝙡𝙡𝙘𝙤𝙢. 𝙉𝙖𝙣𝙙𝙮 𝙞𝙨 𝙫𝙚𝙧𝙮 𝙜𝙚𝙣𝙪𝙞𝙣𝙚, 𝙝𝙤𝙣𝙚𝙨𝙩 𝙖𝙣𝙙 𝙝𝙚𝙡𝙥𝙛𝙪𝙡 𝙞𝙣 𝙣𝙖𝙩𝙪𝙧𝙚. 𝙃𝙚 𝙖𝙡𝙨𝙤 𝙝𝙖𝙨 𝙖 𝙫𝙚𝙧𝙮 𝙞𝙣-𝙙𝙚𝙥𝙩𝙝 𝙠𝙣𝙤𝙬𝙡𝙚𝙙𝙜𝙚 𝙤𝙛 𝙄𝙏 𝙬𝙝𝙞𝙡𝙚 𝙢𝙖𝙞𝙣𝙩𝙖𝙞𝙣𝙞𝙣𝙜 𝙖 𝙫𝙚𝙧𝙮 𝙗𝙧𝙤𝙖𝙙 𝙥𝙧𝙤𝙗𝙡𝙚𝙢-𝙨𝙤𝙡𝙫𝙞𝙣𝙜 𝙤𝙪𝙩𝙡𝙤𝙤𝙠. 𝙏𝙝𝙚𝙨𝙚 𝙛𝙚𝙖𝙩𝙪𝙧𝙚𝙨 𝙢𝙖𝙠𝙚 𝙝𝙞𝙢 𝙣𝙤𝙩 𝙤𝙣𝙡𝙮 𝙖 𝙥𝙡𝙚𝙖𝙨𝙪𝙧𝙚 𝙩𝙤 𝙬𝙤𝙧𝙠 𝙬𝙞𝙩𝙝 𝙗𝙪𝙩 𝙖𝙡𝙨𝙤 𝙫𝙚𝙧𝙮 𝙞𝙣𝙨𝙥𝙞𝙧𝙖𝙩𝙞𝙤𝙣𝙖𝙡. ❞ — 𝙅𝙤𝙧𝙙𝙤𝙣 𝘽𝙞𝙡𝙡 - 𝙈𝙖𝙣𝙖𝙜𝙞𝙣𝙜 𝘿𝙞𝙧𝙚𝙘𝙩𝙤𝙧 - 𝘾𝙖𝙡𝙡𝙘𝙤𝙢 𝙄𝙣𝙩𝙚𝙧𝙣𝙖𝙩𝙞𝙤𝙣𝙖𝙡

Your infrastructure breaks at 2 AM. Your deploys take 45 minutes. Your AWS bill climbed 40% and nobody can explain why. I fix all three - and I've done it 100+ times on this platform. Former SRE Lead at Yellow AI (100M+ users, AWS + on-prem). Now I run Skybyte, a DevOps and cloud consulting practice focused on startups and mid-market teams that need senior infrastructure work without the senior hire. What 61+ Upwork jobs and a 100% Job Success Score actually look like: Cloud cost optimization - cut AWS/Azure/GCP spend by 40-60% through right-sizing, Reserved Instances, spot fleets, and architecture cleanup. Not guesswork; I run the cost audit, build the dashboard, and hand you the savings. Kubernetes migration and management - moved production workloads to EKS, AKS, and self-managed clusters on Hetzner. Helm charts, ArgoCD GitOps, zero-downtime cutovers. I've handled clusters running 200+ pods and clusters running 6. CI/CD pipeline engineering - GitHub Actions, GitLab CI, Azure DevOps Pipelines, Bitbucket Pipelines. Took teams from 45-minute manual deploys to sub-5-minute automated releases with rollback built in. Infrastructure as Code with Terraform - full AWS, Azure, and GCP environments defined in Terraform modules. State management, drift detection, and PR-based infrastructure reviews that your team can maintain without me. DevSecOps and compliance - SOC 2 infrastructure from scratch, cloud security audits, Cloudflare WAF and DDoS protection, network security architecture, and DPDP-aligned data handling. I've built the controls and written the documentation auditors actually accept. Monitoring, observability, and SRE - Prometheus, Grafana, OpenTelemetry, Datadog, PagerDuty. Full observability stacks that catch failures before your users file tickets. I set up SLOs, runbooks, and on-call workflows. Beyond core DevOps - SSO/SAML integration, n8n workflow automation, MLOps pipelines, Docker deployments on bare metal and VPS, GCP Cloud Run serverless, and technical documentation your team won't ignore. I work best with funded startups burning money on cloud, engineering teams stuck in deployment hell, and companies scaling past the point where one developer can manage the infrastructure part-time. Stack: AWS (EKS, EC2, Lambda, RDS, S3) · Azure (AKS, DevOps, AD) · GCP (GKE, Cloud Run) · Kubernetes · Helm · Terraform · Docker · GitHub Actions · GitLab CI · ArgoCD · Prometheus · Grafana · OpenTelemetry · Datadog · Cloudflare · n8n Not a "set it up and disappear" contractor. I document everything, train your team, and build systems designed to run without me and scale.

I'm a DevOps and Cloud Security engineer who builds infrastructure that passes audits — not just infrastructure that runs. I've delivered compliance-grade cloud platforms three times over — twice right here on Upwork: architected SOC 2 / ISO 27001-compliant infrastructure for a Lithuanian financial payment platform on GCP (secure networking, Istio service mesh, Jenkins CI/CD), and led SOC 2 / ISO 27001-aligned AWS infrastructure for a UK fintech (ECS, CloudFront, RDS, Lambda, GitHub Actions). Before that, I deployed enterprise monitoring (Grafana Enterprise — GET, GEM, GEL) inside a US government cloud at DoD Impact Level 5, where every component met FedRAMP-grade security controls. What I do best: Kubernetes at scale — multi-cluster EKS architecture, Karpenter and KEDA autoscaling, Helm/Helmfile delivery. At Mono I ran the EKS platform behind a marketplace serving 1M+ users at up to 27k RPS. My depth is EKS-native; the security model (RBAC, network policy, workload identity, admission control) transfers directly to GKE, and I've run production GCP infrastructure (Compute Engine, Cloud Run, Istio) — including a multi-tenant platform serving 40+ tenants. Infrastructure as Code — Terraform and Terragrunt as source of truth, including multi-workspace architectures across concurrent projects. Compliance-ready operations — audit-friendly observability (Prometheus, Thanos, VictoriaMetrics, Grafana, Loki, Tempo), secrets management, secure PostgreSQL on RDS and self-hosted, security patching automation in Python and Bash. CI/CD & GitOps — Jenkins, GitHub Actions, GitLab CI with self-hosted runners, ArgoCD; multi-environment promotion flows with rollback strategies. If your infrastructure needs to satisfy an auditor, a regulator, or a security review — that's the work I do best. Let's talk.

🎖 AWS Certified Solutions Architect – Professional 🎖 AWS Certified Solutions Architect – Associate 🎖 CISA Certified Information Security Expert 🎖 16+ Years in Cloud Security, Compliance & AI-Driven Automation 💡 Track Record: ✅ 6,900+ Hours on Upwork ✅ 200+ Successfully Delivered Projects ✅ Top Rated Plus Freelancer When businesses need to secure their cloud infrastructure, pass a compliance audit, or build AI-powered DevSecOps pipelines — they come to me. I'm a CISA-certified Cloud Security and Compliance Expert with 16+ years of experience helping startups, enterprises, and regulated industries build systems that are secure, audit-ready, and future-proof. What sets me apart today is my ability to combine deep compliance and security expertise with modern AI capabilities — including Agentic AI workflows, prompt engineering, and intelligent automation — to deliver faster results with fewer manual bottlenecks. Over 200+ projects and 6,500+ hours on Upwork, I've helped organizations across the US, Europe, and Middle East strengthen their security posture, achieve certifications, and ship secure products without slowing down their engineering teams. 🤖 AI & Intelligent Automation Skills (New & In-Demand) ✅ Agentic AI Development — Design and deploy autonomous AI agents for compliance monitoring, security alerting, and audit evidence collection using LangChain, AutoGen, and CrewAI frameworks ✅ Prompt Engineering — Craft production-grade prompts for security analysis, policy generation, risk assessment automation, and compliance documentation using GPT-4, Claude, and open-source LLMs ✅ AI-Powered DevSecOps — Integrate AI-driven code scanning, vulnerability detection, and automated remediation into CI/CD pipelines ✅ Intelligent Compliance Automation — Build AI workflows that continuously monitor controls, flag gaps, and generate audit-ready evidence — reducing manual compliance effort by up to 70% ✅ LLM Integration & Development — Integrate large language models into security dashboards, internal tools, and compliance platforms via REST APIs and SDKs 🔐 Core Expertise: Security, Compliance & Governance ✅ IT Compliance & Audit Readiness HIPAA, PCI-DSS, GDPR, ISO 27001, SOC 1 & SOC 2 implementation and audit support DPDP Act compliance frameworks and governance Risk assessments, gap analysis & security control mapping Policy development, security documentation & AI-assisted monitoring ✅ Security Audits, VAPT & Risk Mitigation Comprehensive security audits with detailed, actionable reporting Cloud Security Audits across AWS & Azure environments Vulnerability Assessment & Penetration Testing (VAPT) CIS Benchmarks and NIST framework enforcement Enterprise-wide vulnerability management & remediation planning ✅ DevSecOps & Cloud Security Engineering DevSecOps with Zero Trust architecture and AI-assisted threat detection Cloud Security Posture Management (CSPM) AWS Security Hub, GuardDuty, Inspector Azure Security Center & governance policies Secure CI/CD pipeline automation with built-in AI-powered security controls ☁️ Cloud & DevOps Engineering Cloud Platforms AWS (EC2, ECS, EKS, Lambda, IAM, S3, Route 53, RDS, CloudFormation) · Microsoft Azure (AKS, VMs, VNets, Azure DevOps, Azure Monitor) · Kubernetes · Docker · Terraform · Helm · GitOps · Ansible · Jenkins CI/CD & Infrastructure as Code GitHub Actions · GitLab CI/CD · Azure Pipelines · Terraform · CloudFormation · Automated deployments & release management Monitoring, Observability & Incident Response Prometheus · Grafana · OpenTelemetry · AWS CloudWatch · ELK Stack · Datadog · AI-assisted threat monitoring · Disaster recovery & business continuity planning 💡 What You Get Working With Me ✅ Compliance-ready security frameworks built for audit day ✅ AI agents and automation that cut manual compliance work dramatically ✅ End-to-end security audits with clear, prioritized remediation plans ✅ Secure, scalable cloud infrastructure with proactive AI-powered monitoring ✅ DevSecOps pipelines with security and intelligence baked in from day one ✅ A single expert who speaks both security and AI — no need to hire two people 📞 Available now for cloud security audits, SOC 2 / ISO 27001 compliance, DevSecOps implementation, VAPT, Agentic AI development, and intelligent compliance automation. 🚀 Let's talk about how I can help you build a system that's secure, compliant, and ready for the AI-driven future.

I build and run Production Infrastructure on AWS, GCP, Azure and on-prem. Most of my work the last few years has been Kubernetes (EKS, GKE, AKS, and bare metal RKE2 with Rancher) and getting that infrastructure through compliance audits: HIPAA, SOC 2, PCI DSS, NIST 800-53. 10+ years in DevOps. Top Rated Plus, 100% Job Success. 𝙎𝙤𝙢𝙚 𝙧𝙚𝙘𝙚𝙣𝙩 𝙥𝙧𝙤𝙟𝙚𝙘𝙩𝙨 𝙩𝙤 𝙜𝙞𝙫𝙚 𝙮𝙤𝙪 𝙖𝙣 𝙞𝙙𝙚𝙖 𝙤𝙛 𝙬𝙝𝙖𝙩 𝙄 𝙖𝙘𝙩𝙪𝙖𝙡𝙡𝙮 𝙙𝙤: Built an on-prem RKE2 cluster from scratch for a company preparing for SOC 2 and HIPAA. Rancher for management, Cilium with WireGuard for encrypted pod traffic, GPU nodes for their ML workloads, Longhorn for storage, Velero for backups, ArgoCD for deployments. Also enforced SSO through Entra ID on every cluster and SSH access point because their auditors required it. Took a healthcare data platform through HIPAA hardening on AWS. ECS Fargate, Aurora PostgreSQL, private subnets, TLS everywhere, proper secrets handling. Phase one was making it work, phase two was making it pass an audit. Different skill sets, I do both. Modernized AWS infrastructure for a holding group running four brands. Moved everything to ECS Fargate and Aurora Multi-AZ, set up blue-green deployments, CloudFront in front. Midway through we found a security breach in their GitHub org and I handled the full remediation across every repo. Fixed a production Aurora MySQL performance problem that had their app timing out during peak hours. Root cause was tmp table spill to disk. Tuned it, added a reader, no downtime. I also do a lot of unglamorous work that keeps things running: CI/CD pipelines (GitHub Actions, GitLab CI, ArgoCD), Terraform for everything, monitoring with Prometheus and Grafana, cost cleanup, VPN and networking issues, database migrations. Industries I know well: Healthcare (HIPAA is second nature at this point), Fintech and Payments (PCI DSS), and B2B SaaS. 𝙒𝙝𝙖𝙩 𝙮𝙤𝙪 𝙜𝙚𝙩 𝙬𝙤𝙧𝙠𝙞𝙣𝙜 𝙬𝙞𝙩𝙝 𝙢𝙚: Infrastructure that is written down in code, documented, and reproducible. I answer messages fast and I will tell you upfront if something is a bad idea or if I am not the right person for it. Send me your project details and current setup. I will give you an honest read on scope and effort before you spend anything.