MOHANNAD EMHEMED
I am a
Cloud Infrastructure Engineer | Hybrid Connectivity | Automation & Security
Cloud Infrastructure Engineer | Hybrid Connectivity | Automation & Security
Cloud Infrastructure Engineer delivering governed multi-account platforms, resilient hybrid connectivity, and automated operations across AWS, Azure, and on-premises estates.
Recent work includes rolling out AWS IAM Identity Center with Microsoft Entra ID, scaling AWS Control Tower landing zones, automating tag compliance with Config and Step Functions, and securing traffic through Transit Gateway, Network Firewall, and Sentinel integrations to keep regulated workloads available and auditable.
Architected and deployed production-ready static website using AWS serverless architecture with enterprise-grade Infrastructure as Code. Implemented CloudFront with Origin Access Control (OAC), S3 with versioning and encryption (AES256), Route 53 DNS management, and ACM SSL/TLS certificates. Developed comprehensive Terraform and CloudFormation templates following best practices: separate resource files, pessimistic version constraints (~>), default tagging, S3 native state locking, HTTP/3 support, and managed cache policies. Includes professional Python deployment automation with logging, type hints, and error handling. Cost-optimized architecture (~$2-5/month) with 90-day lifecycle policies and global CDN performance.
Architected automated tag compliance monitoring and remediation system using AWS Config, Lambda, Step Functions, SSM Automation Documents, and EventBridge. Managed comprehensive tag policies across EC2, ENI, EBS, RDS, DynamoDB, FSx, and EFS, with SNS-based reporting for compliance violations.
Implementing AWS-native temporary elevated access management solution using IAM Identity Center. Architecting time-bound privilege escalation with automated approval workflows, session monitoring, and audit trails. Enables just-in-time access for administrative tasks while maintaining least privilege principles and compliance requirements through centralized access governance.
Led design and deployment of AWS Control Tower Landing Zone, integrating with existing AWS Organization. Established standardized security baselines, guardrails, and account provisioning workflows for enterprise-scale governance.
Designed and implemented VPC Interface Endpoints architecture across multiple VPCs, regions, and AWS accounts. Enabled secure, private connectivity to AWS services while reducing data transfer costs and improving security posture.
Engineered hybrid DNS solution integrating on-premises Active Directory Domain Controllers with AWS Route 53. Configured VPC DHCP options and AD instances for seamless DNS resolution across hybrid infrastructure.
Led implementation of centralized network egress using Transit Gateway and AWS Network Firewall. Enhanced security visibility, traffic inspection, and threat prevention across multi-account AWS environment.
Designed and implemented AWS SSO integration with Microsoft Entra ID using SAML 2.0 and SCIM protocols. Enabled automated user provisioning, centralized access management, and enhanced security compliance.
Spearheaded migration from AWS CodeCommit to GitLab and CloudFormation to Terraform. Modernized infrastructure-as-code practices, improved deployment workflows, and enhanced team collaboration.
Developed automated notification system for RDS instance updates using EventBridge, Lambda, and SNS. Enabled proactive database maintenance planning and reduced unplanned downtime.
Led Microsoft Sentinel integration with AWS for centralized log aggregation and security monitoring. Implemented SOC alerts and automated incident response across multi-cloud environment.
Orchestrated migration of DNS domains from third-party registrars to AWS Route 53. Consolidated DNS management, improved reliability, and reduced operational complexity.
Managed and optimized Site-to-Site VPN and AWS Direct Connect connections. Ensured reliable, high-performance connectivity between on-premises data centers and AWS cloud infrastructure.
Managed Azure environment lifecycle, securing access between AWS instances, on-premises infrastructure, and Sentinel. Handled service provisioning, access control, and cross-cloud integration.
Migrated AWS WAF from Classic (v1) to v2 following retirement. Removed root credentials from all accounts except management account. Managed Security Hub CSPM and Trusted Advisor for security and cost optimization.
Deployed Azure Monitoring Agent (AMA) on AWS instances and on-premises infrastructure. Integrated with Azure Arc, Analytics Workspace, and Data Collection Rules for unified monitoring across hybrid environment.