Platforms / AWS
Multi-account from the start. Everything in Terraform. Least privilege that survives contact with a deadline. Alerts that fire before your customers notice, and a bill you can explain line by line.
A multi-account foundation with organisational units, service control policies, centralised logging and a break-glass path that's rehearsed rather than theoretical.
Lambda, API Gateway, EventBridge, Step Functions and DynamoDB — with cold starts, concurrency limits and idempotency treated as design inputs, not surprises.
ECS Fargate or EKS depending on what you actually need to operate. We'll argue for the simpler one until the requirements out-argue us.
Aurora and RDS for transactional systems, S3-based lakes with Glue and Athena for analytics, and streaming with Kinesis or MSK when the data won't wait.
OpenTelemetry instrumentation, CloudWatch and X-Ray where they fit, third-party backends where they're better — plus alerts tuned so on-call trusts them.
Tagging you can enforce, per-team and per-tenant attribution, right-sizing, storage lifecycle rules, and a commitment strategy that doesn't lock you into last year's shape.
A fixed-scope engagement. We read the code and the console, interview your engineers, and hand back a document you can act on — or shop around with.
How changes get made, how failures get noticed, and how much of it depends on one person being awake.
Identity, network boundaries, secrets, encryption and the paths an attacker would actually take.
Failure modes, recovery objectives, and whether your backups have ever been restored.
Right service for the right job, and where you're paying a latency tax for a decision made two years ago.
Where the money goes, what it buys, and the three changes with the best ratio of savings to risk.
Utilisation, region choice and data lifecycle — usually the same changes that cut the bill.
The useful ones — the failure mode nobody's tested, the cost line nobody owns, the IAM role that can do rather more than intended.