Skip to content

Available for DevOps & platform roles

Asad Bashir

DevOps Engineer

I build the pipelines and infrastructure that put code in production safely.

View experienceRead the notes
committodeploy.dev

whoami --verbose

role
DevOps Engineer
focus
AWS · Hetzner · Terraform · Kubernetes
currently
CyberoidTech
shipping
OIDC pipelines, ECS Fargate, GitOps

01/About

About

I run production infrastructure in the cloud: Kubernetes workloads across managed and self-managed clusters, Helm charts in place of hand-written YAML, and ArgoCD so the cluster matches Git rather than whatever someone applied by hand. Terraform provisions it and GitHub Actions ships it.

Security is part of that job, not a separate one. Snyk and Trivy gate the pipeline, secrets come from Vault, CI authenticates over OIDC with no stored keys. It also has to survive an audit, so I have worked with Delve on compliance automation and on the infrastructure side of SOC 2 and GDPR.

What I optimise for is the boring kind of reliability. Credentials that expire on their own, pipelines that fail loudly before production does, and infrastructure someone else can read six months later without calling me.

.github/workflows/deploy.yml
permissions:
  id-token: write
  contents: read

- uses: configure-aws-credentials@v4
  with:
    role-to-assume: ${{ secrets.ROLE_ARN }}
    aws-region: eu-north-1

# no AWS_SECRET_ACCESS_KEY anywhere

How the pipelines authenticate to AWS, with no stored keys.

02/Skills

Tools I've actually shipped with

  • Cloud

    • AWS EC2
    • AWS ECS Fargate
    • AWS ECR
    • AWS S3 & CloudFront
    • AWS ALB
    • AWS IAM
    • AWS Client VPN
    • more

  • Infrastructure as Code

    • Terraform
    • Ansible
    • Helm
    • Bash
    • YAML / JSON

  • Databases

    • Supabase
    • Row Level Security (RLS)
    • PostgreSQL
    • AWS RDS
    • MongoDB

  • Containers & Orchestration

    • Docker
    • Docker Compose
    • Kubernetes
    • kubeadm
    • k3s
    • ArgoCD

  • CI/CD

    • GitHub Actions
    • Jenkins
    • Bitbucket
    • GitOps
    • Git

  • DevSecOps

    • Snyk
    • Trivy
    • HashiCorp Vault
    • External Secrets Operator
    • AWS Secrets Manager
    • OIDC Authentication
    • AWS WAF
    • more

  • Compliance

    • Delve
    • SOC 2
    • GDPR
    • AWS KMS
    • CloudTrail & audit logging
    • Container Insights

  • Observability

    • Prometheus
    • Grafana
    • Loki & Promtail
    • CloudWatch

  • Development

    • JavaScript / TypeScript
    • Node.js & Express
    • React
    • Nginx
Every tool, with where each was used →

03/Experience

Where I've done the work

  1. Dec 2025 - Present

    DevOps Engineer · CyberoidTech

    Production infrastructure for client projects: cloud, CI/CD, security scanning and secrets management.

    • Implemented the Kubernetes delivery stack: ArgoCD for GitOps, HashiCorp Vault with the Kubernetes auth method, External Secrets Operator for cluster secrets, Helm charts replacing hand-written manifests, and kube-prometheus-stack with Loki and Promtail for metrics and logs.
    • Replaced long-lived AWS access keys in GitHub Actions with OIDC-based authentication, removing static credentials from CI entirely.
    • Built out an ECS Fargate production environment: cluster setup, IAM task execution roles, task definitions wired to Secrets Manager, and an ALB with path-based routing across two services.

  2. Jun 2025 - Nov 2025

    DevOps Intern · Techinn360

    CI/CD automation, containerization and AWS infrastructure for live projects.

    • Built and maintained GitHub Actions pipelines, cutting manual deployment time by roughly 50-60%.
    • Containerized applications with Docker and managed multi-service environments using Docker Compose.
    • Deployed and configured AWS infrastructure: EC2, RDS, S3, and CloudFront fronted by WAF.

  3. 2024 - 2025

    Infrastructure Projects · Self-directed

    Built and operated real infrastructure independently to develop depth across cloud, Kubernetes and automation.

    • Ran a self-managed k3s cluster on Hetzner to build depth before doing the same work in production.
    • Automated multi-server provisioning with Ansible playbooks and roles.
    • Designed an AWS VPC architecture with public and private subnets, route tables, security groups and a NAT gateway.

  4. 2023 - 2024

    Full-Stack Developer · Academic & Freelance

    Full-stack web applications with payments, authentication and cloud deployment.

    • Built a furnished home rental platform with Stripe payments, real-time availability and an admin panel, delivered as a final year project with distinction.
    • Developed a heavy machinery marketplace with search, filtering and inventory management.
    • Designed REST APIs with authentication, authorization and full CRUD.

04/Projects

Infrastructure I've built

Client work sits alongside self-directed builds. Where a repository is private, it says so rather than linking somewhere unhelpful.

StockFlow — Multi-Tenant Inventory & Order Management

B2B wholesaler back office on an append-only stock ledger, with the AWS infrastructure to run it.

  • NestJS
  • Next.js
  • PostgreSQL
  • Redis
  • ECS Fargate
  • +6
Read more →Source

Shopix Production AWS Infrastructure

Full-stack ecommerce on a custom VPC, with no static AWS keys and no open SSH.

  • AWS
  • VPC
  • ALB
  • RDS
  • ECR
  • +4
Read more →Source

ECS Fargate Production Environment

Client production platform on ECS Fargate, with VPN-only access to internal services.

  • ECS Fargate
  • VPC
  • Multi-AZ Subnets
  • ALB
  • Internal Load Balancer
  • +7
Read more →Private client repo

Furnished Home Rentals Platform

MERN rental marketplace with Stripe payments and an admin panel. Final year project.

  • React
  • Node.js
  • Express
  • MongoDB
  • Stripe
  • +1
Read more →Source
More on GitHub

05/Certifications

Credentials & training

AWS Certified Cloud Practitioner

Earned

Amazon Web Services

AWS Certified Solutions Architect - Associate (SAA-C03)

In progress

Amazon Web Services

Linux Administration

Earned

Course: CentOS & Ubuntu administration, shell scripting, user and permission management

Ansible Automation

Earned

School of DevOps (Udemy): playbooks, roles, loops, server automation

MERN Stack Development

Earned

Course: MongoDB, Express, React, Node.js

06/FAQ

Questions I get asked

Direct answers to what recruiters and engineers ask most often.

What infrastructure-as-code tools has Asad used?

Terraform for provisioning infrastructure in production, Ansible for server provisioning and configuration management across multiple hosts, and Helm for Kubernetes releases. Pipeline and cluster configuration is version-controlled the same way application code is.

Has he worked with cloud providers other than AWS?

Yes. Alongside AWS he has worked with Hetzner Cloud, provisioning servers, running a self-managed k3s Kubernetes cluster on them, and using Hetzner S3-compatible object storage, and with RunPod for GPU infrastructure to deploy models. The tooling around them (Terraform, Ansible, containers, GitOps) transfers across providers.

What database experience does he have?

Supabase and PostgreSQL, including Row Level Security policies for access control at the database layer rather than only in application code. Also AWS RDS in production, where he configured automated backups and resolved security group misconfigurations, and MongoDB for Node.js applications.

07/Field Notes

Field Notes

Write-ups from production work.

$ cat ingressnightmare-cve-2025-1974.md

Kubernetes

IngressNightmare: closing CVE-2025-1974 on a live cluster

A critical unauthenticated RCE in the ingress-nginx admission webhook, and how we closed it on a production Kubernetes cluster without dropping traffic.

  • Kubernetes
  • Security
  • ingress-nginx
  • CVE
  • +1

5 min read

Read →

08/Contact

Get in touch

Open to DevOps, platform and cloud infrastructure roles. If you have a pipeline that keeps breaking or infrastructure that needs a second pair of eyes, send a note.

Send an emailDownload résumé
Email
asadbashir2229526@gmail.com
Phone
+92 340 0569133
GitHub
@asadbashir7755
LinkedIn
asad-bashir