⚡ Cloud & DevSecOps Engineer | Azure Infrastructure & CI/CD Security Automation

Scalable Azure Cloud Platforms · Zero-Trust Infrastructure as Code · Shift-Left Pipeline Governance · Autonomous Incident Triage

I am a Cloud & DevSecOps Engineer dedicated to engineering resilient, automated Microsoft Azure cloud platforms, declarative Infrastructure as Code (Terraform), and shift-left CI/CD security pipelines in GitHub Actions and Azure DevOps.

Combining hands-on cloud provisioning and pipeline automation with an analytical foundation in Computer Applications & Mathematics (M.Sc Computer Science, B.Sc Mathematics & Computer Applications), I design infrastructure with strict security compliance, automated cost governance, and self-healing operations:

• ☁️ Cloud Architecture & CAF Governance: Architecting enterprise Hub-and-Spoke topologies, micro-segmented Virtual Networks, User Defined Routes (UDRs), Azure Bastion jumpboxes, NAT Gateways for static egress, and Azure Key Vault private endpoints.
• 🛡️ Shift-Left DevSecOps & Supply Chain Security: Hardening multi-stage CI/CD pipelines in Azure DevOps and GitHub Actions with secretless Workload Identity Federation (OIDC), static code analysis (Checkov, tfsec, TFLint), and secret detection (Gitleaks, TruffleHog).
• ⚡ Dynamic CI/CD Matrix & FinOps: Authoring intelligent monorepo workflow bots utilizing tj-actions/changed-files for isolated multi-directory Terraform execution, integrated with Infracost and the Azure Retail Prices API to prevent budget overruns before merge.
• 🤖 Agentic AI & SRE Automation: Standardizing Model Context Protocol (MCP) servers and LangGraph cyclical state machines for automated infrastructure alert ingestion, runbook querying, and GitOps remediation pull requests.

flowchart TD
    subgraph Core["🏛️ Azure Infrastructure & CAF Governance"]
        A["Mihir Maurya Cloud Platform"] --> B["Azure CAF Landing Zones"]
        A --> C["Enterprise Hub & Spoke VNet"]
        A --> D["Agentic SRE & MCP Tooling"]
    end

    subgraph DevSecOps["🛡️ Shift-Left CI/CD Pipeline Gates"]
        B --> E["Terraform Modular IaC"]
        C --> E
        E --> F["Client-Side Pre-Commit Hooks\nGitleaks & TruffleHog Scan"]
        F --> G["SAST & IaC Security Gate\nCheckov & tfsec CIS Benchmarks"]
        G --> H["Azure DevOps / GitHub Actions OIDC\nSecretless Workload Identity"]
        H --> I["Infracost & Azure Retail Prices API\nFinOps Cost Approval Gate"]
    end

    subgraph Runtime["☸️ Production Runtime"]
        I --> J["Zero-Trust Azure Platform"]
        J --> K["Central Hub VNet & Azure Firewall"]
        J --> L["Spoke Workloads & Private Endpoints"]
        J --> M["Azure Key Vault & Managed Identities"]
    end

    subgraph AI["🤖 Autonomous SRE Operations"]
        D --> N["Model Context Protocol (MCP) Host"]
        N --> O["LangGraph Anomaly Analysis Agent"]
        O --> P["Automated GitOps Remediation PR"]
        P -.-> J
    end

    classDef purple fill:#1d0738,stroke:#9d4edd,stroke-width:2px,color:#fff;
    classDef matrix fill:#032111,stroke:#00ff66,stroke-width:2px,color:#fff;
    classDef cyan fill:#051b2e,stroke:#00e5ff,stroke-width:2px,color:#fff;
    classDef amber fill:#2d1900,stroke:#f59e0b,stroke-width:2px,color:#fff;

    class A,B,C purple;
    class E,F,G,H,I amber;
    class D,N,O,P cyan;
    class J,K,L,M matrix;

Enterprise Azure Hub-and-Spoke Network Topology & CAF Landing Zone via Modular Terraform

HUB-SPOKE/
├── azure-pipelines.yml       # 🔄 Azure DevOps Multi-Stage CI/CD pipeline
├── run-pipeline.ps1          # 🛠️ Shift-Left Checkov + Terraform execution harness
└── terraform/
    ├── environments/         # 🚀 ISOLATED STATE ROOT DEPLOYMENTS
    │   ├── hub/              # Central Hub: VNet (10.0.0.0/16), VPN GW, Key Vault
    │   ├── spoke-dev/        # Dev Workload VNet (10.1.0.0/16) -> Peered to Hub
    │   └── spoke-prod/       # Prod Workload VNet (10.2.0.0/16) -> Peered to Hub
    │
    └── modules/              # 🧩 REUSABLE TERRAFORM MODULES
        ├── key_vault/        # Private Key Vault with RBAC & Access Policies
        ├── network/          # Dynamic VNet/Subnet generator via for_each
        └── vpn/              # Enterprise Gateway & P2S / S2S VPN

Enterprise Multi-Directory Terraform CI/CD Bot & Pre-Commit Security Engine

name: Dynamic Matrix Terraform CI/CD

on:
  pull_request:
    branches: [main]

jobs:
  detect-changes:
    runs-on: ubuntu-latest
    outputs:
      tf_dirs: ${{ steps.set-matrix.outputs.directories }}
    steps:
      - uses: actions/checkout@v4
      - uses: tj-actions/changed-files@v44
        id: changed-files
        with:
          dir_names: true
          files: '**/*.tf'

  terraform-matrix:
    needs: detect-changes
    if: needs.detect-changes.outputs.tf_dirs != '[]'
    strategy:
      matrix:
        directory: ${{ fromJson(needs.detect-changes.outputs.tf_dirs) }}
    runs-on: ubuntu-latest
    steps:
      - uses: hashicorp/setup-terraform@v3
      - run: terraform fmt -check
      - run: terraform init -backend=false
      - run: terraform validate
      - uses: infracost/actions/setup@v3
      - run: infracost breakdown --path=${{ matrix.directory }} --format=json --out-file=infracost.json

Enterprise 4-Stage Shift-Left Security, FinOps Cost Gating & Terraform CI/CD

stages:
  - stage: Terraform_Plan
    jobs:
      - job: Plan_And_FinOps
        steps:
          - task: TerraformCLI@0 (init, validate, fmt -check)
          - task: PowerShell@2 (Query Azure Retail Prices API from tfplan JSON)
          - task: PublishPipelineArtifact (drop tfplan)

  - stage: DevSecOps_Security_Scan
    dependsOn: Terraform_Plan
    jobs:
      - job: Static_Analysis
        steps:
          - script: gitleaks detect --config .gitleaks.toml
          - script: trufflehog git file://. --only-verified
          - script: tfsec . --format junit --out tfsec-results.xml
          - script: trivy config . --severity CRITICAL,HIGH

  - stage: Production_Approval_Gate
    dependsOn: DevSecOps_Security_Scan
    jobs:
      - deployment: Human_Signoff
        environment: 'production-approval'

  - stage: Terraform_Apply
    dependsOn: Production_Approval_Gate
    jobs:
      - job: Apply
        steps:
          - task: DownloadPipelineArtifact (retrieve verified tfplan)
          - task: TerraformCLI@0 (apply tfplan)

Modular Azure Infrastructure as Code Framework · CAF Enterprise Blueprints & Multi-Tier Compute

┌────────────────────────────────────────────────────────────────────────┐
│  1. ZERO-TRUST IDENTITY: Secretless Workload Identity Federation (OIDC)│
│  2. IMMUTABLE IaC: All infrastructure planned, audited, and applied    │
│  3. SHIFT-LEFT GATES: Checkov & Gitleaks block vulnerabilities at PR   │
│  4. BLAST-RADIUS ISOLATION: Decoupled remote states with lease locking │
│  5. COST GOVERNANCE: Infracost & Azure Retail Prices API gated in CI   │
└────────────────────────────────────────────────────────────────────────┘

A comprehensive index of cloud infrastructure repositories, security scanners, and automation frameworks maintained across this profile:

I am actively open to opportunities regarding Cloud & DevSecOps Engineer roles.