# Ahmed Tariq — Full Engineering Portfolio

> Expanded, AI-readable version of the client-facing portfolio at
> https://ahmed-tariq.me. Client architecture work is anonymized to protect
> organization and environment identifiers. Vendor reference blueprints are
> clearly attributed and are not presented as original client work. Claims are
> qualitative unless a verified metric is explicitly stated.

## Professional Focus

Ahmed Tariq is a Backend, Platform, AI, and Cloud DevOps Engineer. His scope
covers cloud-native AI
applications, infrastructure as code, CI/CD, Kubernetes, private networking,
observability, RAG, multi-agent applications, and MLOps across Microsoft Azure,
Amazon Web Services, and Google Cloud.

## Services

- Cloud Application Development: Cloud-native applications with serverless, microservices, and containers
- Cloud Engineering: SaaS, PaaS, and IaaS solutions balancing performance, security, and cost
- Cloud Automation and DevOps: CI/CD, Infrastructure as Code, release automation, and reliability
- Cloud Security and Compliance: Private networking, identity, secrets, monitoring, and governance
- AI Engineering: RAG, multi-agent platforms, document intelligence, model integration, evaluation, and MLOps

## Reference Blueprint — Enterprise Azure Landing Zone — Hub & Spoke

URL: https://ahmed-tariq.me/projects/enterprise-azure-landing-zone-hub-spoke/

Official source: Microsoft Cloud Adoption Framework — Azure landing zone
architecture.

Overview: An enterprise Azure foundation spanning management groups, platform
subscriptions, workload landing zones, identity, security, centralized
connectivity, policy, observability, and platform automation.

What it demonstrates: The ability to translate enterprise requirements into a
tailored landing-zone operating model, governance hierarchy, hub-and-spoke
network, security baseline, workload-onboarding path, and implementation
backlog.

Technology: Azure Landing Zones, Management Groups, Microsoft Entra ID,
hub-and-spoke networking, Azure Firewall, ExpressRoute, Azure Policy, Microsoft
Sentinel, Defender for Cloud, Azure Monitor, platform automation.

## Reference Blueprint — AWS Multi-Account Security & Network Landing Zone

URL: https://ahmed-tariq.me/projects/aws-multi-account-security-network-landing-zone/

Official source: AWS Security Reference Architecture.

Overview: A governed AWS organization separating management, security, log
archive, network, shared-services, and workload accounts with centralized
controls and inspected network paths.

What it demonstrates: Multi-account and organizational-unit design, security
and audit centralization, dedicated network and inspection services, workload
isolation, guardrails, and a scalable account-onboarding model.

Technology: AWS Organizations, AWS Control Tower, IAM Identity Center, Transit
Gateway, Network Firewall, Security Hub, GuardDuty, CloudTrail, AWS Config,
Amazon S3, Systems Manager.

## Reference Blueprint — Google Cloud Enterprise Foundation & Shared VPC

URL: https://ahmed-tariq.me/projects/google-cloud-enterprise-foundation-shared-vpc/

Official source: Google Cloud Enterprise Foundations Blueprint.

Overview: A governed Google Cloud foundation combining resource hierarchy,
organization policy, IAM, GitOps delivery, multi-region Shared VPC, private
connectivity, centralized security, secrets, encryption, logging, and
monitoring.

What it demonstrates: Enterprise foundation tailoring across organization,
folders, projects, shared networking, hybrid connectivity, policy controls,
security operations, and repeatable Terraform delivery through Cloud Build.

Technology: Resource Manager, Organization Policy, IAM, Shared VPC, Private
Service Connect, Cloud Interconnect, Cloud Router, Cloud Build, Terraform,
Security Command Center, Cloud Logging, Cloud Monitoring, Cloud KMS.

## Case Study — Private Azure RAG & Document Intelligence Platform

URL: https://ahmed-tariq.me/projects/private-azure-rag-document-intelligence-platform/

Overview: A backend-focused Azure architecture connecting separate application
services to private data, containers, retrieval, document processing, secrets,
and observability. The platform separates public frontend responsibilities from
backend services and controlled private dependencies.

Outcome: A governed RAG foundation that separates backend, AI, data, and
operations responsibilities and supports a controlled path from proof of
concept to production.

Technology: Azure App Service, PostgreSQL, Azure AI Search, Document
Intelligence, Azure AI Foundry, Container Apps, Container Registry, Private
Endpoint, Private DNS, Key Vault, Application Insights.

## Case Study — Azure Multi-Agent Intelligence & RAG Platform

URL: https://ahmed-tariq.me/projects/azure-multi-agent-intelligence-rag-platform/

Overview: An AI-infrastructure pattern connecting specialist agents to governed
data, purpose-specific semantic indexes, shared Azure OpenAI services, graph
relationships, and deployable application components.

Outcome: A reusable multi-agent architecture that keeps data, retrieval,
models, and specialist workflows understandable, governable, and independently
evolvable.

Technology: Azure OpenAI, Azure AI Search, RAG, multi-agent systems, embeddings,
Neo4j, Docker, Azure VM, Azure DNS, SQL.

## Case Study — AWS Cross-Account Migration & Modernization

URL: https://ahmed-tariq.me/projects/aws-cross-account-migration-modernization/

Overview: A controlled migration blueprint for moving a web platform between
AWS accounts while exposing dependencies across edge delivery, DNS,
certificates, object storage, compute images, relational data, cutover, and
rollback.

Outcome: A migration design that surfaces hidden dependencies early and
supports phased execution, validation, rollback planning, and clearer
stakeholder communication.

Technology: AWS Migration, CloudFormation, AWS DMS, EC2, RDS, S3, CloudFront,
Route 53, ACM, AMI transfer, cutover planning.

## Case Study — Vertex AI MLOps & Model Evaluation Framework

URL: https://ahmed-tariq.me/projects/vertex-ai-mlops-model-evaluation-framework/

Overview: A controlled Google Cloud MLOps loop for repeatable Gemini training,
evaluation, pipeline artifacts, telemetry, comparison, and promotion signals.

Outcome: A governed framework that helps teams inspect model quality and
platform behaviour before promotion and make more deliberate release
decisions.

Technology: Google Cloud, Gemini, Vertex AI, Vertex AI Pipelines, Cloud Build,
Cloud Scheduler, Cloud Storage, Cloud Logging, BigQuery, model evaluation.

## Case Study — Secure Multi-Environment Azure CI/CD Platform

URL: https://ahmed-tariq.me/projects/secure-multi-environment-azure-cicd-platform/

Overview: A release-governance pattern separating development, staging, and
production delivery paths with environment-specific identities, agents,
artifacts, security checks, approvals, and service connections.

Outcome: A repeatable delivery path with clearer separation of duties,
security checks, approval points, and environment-specific deployment
controls.

Technology: Azure DevOps, Azure Repos, Azure Pipelines, CI/CD, code scanning,
artifacts, self-hosted agents, App Service, Logic Apps, Function Apps.

## Case Study — Secure Azure AI Application Platform

URL: https://ahmed-tariq.me/projects/secure-azure-ai-application-platform/

Overview: A production-minded Azure platform combining protected public
ingress, virtual networks, private service connectivity, managed application
and data services, AI capabilities, secrets, monitoring, and Terraform modules.

Outcome: A platform blueprint that improves service isolation, operational
visibility, and deployment consistency while keeping AI services inside the
wider application security model.

Technology: Azure Front Door, WAF, Azure VNet, Private Endpoint, Container Apps,
MySQL, Key Vault, Azure AI Foundry, Azure Monitor, Terraform.

## Case Study — Microsoft Fabric CI/CD & GitOps Automation

URL: https://ahmed-tariq.me/projects/microsoft-fabric-cicd-gitops-automation/

Overview: A delivery design connecting Microsoft Fabric workspaces, source
control, deployment pipelines, environment promotion, identity, and release
governance.

Outcome: A more traceable analytics delivery lifecycle with explicit source,
workspace, promotion, and governance responsibilities.

Technology: Microsoft Fabric, Git, Azure DevOps, CI/CD, GitOps, deployment
pipelines, workspace governance, environment promotion.

## Additional Study — Event-Driven WhatsApp AI Support Platform

URL: https://ahmed-tariq.me/projects/event-driven-whatsapp-ai-support-platform/

Overview: A backend integration architecture connecting WhatsApp ingress to
asynchronous messaging, AI processing, conversation state, external services,
human escalation, and operational telemetry.

Outcome: A resilient support architecture that separates external traffic,
asynchronous processing, AI orchestration, data, escalation, and observability
concerns.

Technology: Azure API Management, Service Bus, Azure AI, Cosmos DB, App Service,
Meta WhatsApp API, middleware, Application Insights, Azure Monitor, Log
Analytics.

## Additional Study — Terraform-Provisioned AWS Web Platform

URL: https://ahmed-tariq.me/projects/terraform-provisioned-aws-web-platform/

Overview: A repeatable AWS application platform using Terraform to connect DNS,
edge delivery, object storage, compute, networking, and managed relational data.

Outcome: A reviewable infrastructure baseline that replaces manual setup with
reusable provisioning and clearer dependencies between delivery, compute,
network, and data services.

Technology: Terraform, AWS, Route 53, CloudFront, S3, EC2, RDS, VPC, security
groups, infrastructure as code.

## Additional Study — Layered AWS VPC Web Application Platform

URL: https://ahmed-tariq.me/projects/layered-aws-vpc-web-application-platform/

Overview: A layered AWS network and application architecture separating public
entry, load balancing, application compute, and relational data across
controlled subnets and routes.

Outcome: A clearer trust model for internet-facing traffic, application
processing, and database access, with independently understandable network and
service boundaries.

Technology: AWS VPC, public and private subnets, Application Load Balancer, EC2,
RDS, route tables, NAT, security groups, high-availability design.

## Published Articles

- [The PostgreSQL RLS Policy Existed, But The Table Owner Still Saw Every Row](https://techstrong.it/features/the-postgresql-rls-policy-existed-but-the-table-owner-still-saw-every-row/) (Techstrong IT, Oct 7, 2026). I trace a tenant-isolation failure to the PostgreSQL role that owned the tables, and explain how to test row-level security with the application’s actual runtime identity.
- [Why One of Two Kubernetes Pods Missed a Secret That Already Existed](https://cloudnativenow.com/contributed-content/why-one-of-two-kubernetes-pods-missed-a-secret-that-already-existed/) (Cloud Native Now, Oct 6, 2026). I examine why Kubernetes Secret synchronization left two pods with different process environments, and show how a deployment check verifies required variable names in every pod.
- [How a RabbitMQ TLS mismatch burned one CPU core before AMQP negotiation](https://hackernoon.com/how-a-rabbitmq-tls-mismatch-burned-one-cpu-core-before-amqp-negotiation) (HackerNoon, Sep 27, 2026). I trace a .NET RabbitMQ client’s high CPU use to a TLS protocol mismatch, using thread stacks and the first bytes exchanged with the broker.
- [Drizzle 0.30.4 Missed Six PostgreSQL Parent Tables and Stalled the CI Pipeline](https://hackernoon.com/drizzle-0304-missed-six-postgresql-parent-tables-and-stalled-the-ci-pipeline) (HackerNoon, Sep 27, 2026). I examine how drizzle-kit 0.30.4 handled PostgreSQL partitioned tables, why its interactive prompt stalled CI, and how the migration workflow changed.
- [Two Identical AKS Clusters, Two Different Elastic Metadata Bugs](https://hackernoon.com/two-identical-aks-clusters-two-different-elastic-metadata-bugs) (HackerNoon, Sep 27, 2026). I trace two Elastic Agent metadata failures on AKS through Azure identity, cluster discovery and the collector’s handling of empty values.
- [Why Old Azure DevOps Releases Survive a Pipeline Cutover](https://devops.com/why-old-azure-devops-releases-survive-a-pipeline-cutover/) (DevOps.com, Sep 25, 2026). I inspect Classic release snapshots that retained retired Helm and image names after a cutover, then cover dependency cleanup and checks of the current workloads.
- [A Missing Binary Turned a Kubernetes Liveness Probe Into a Restart Loop](https://cloudnativenow.com/contributed-content/a-missing-binary-turned-a-kubernetes-liveness-probe-into-a-restart-loop/) (Cloud Native Now, Sep 25, 2026). A missing probe executable restarted a working container. I explain the different jobs of Kubernetes liveness and readiness checks, including workloads that consume messages in the background.
- [One Outlook edit became two Microsoft Graph events with no shared ID](https://pnp.github.io/blog/post/one-outlook-edit-became-two-microsoft-graph-events/) (Microsoft 365 & Power Platform Community, Sep 17, 2026). I examine how an Outlook recurring-series edit produced separate Microsoft Graph update and create notifications, and how correlation, retries and cancellation checks affect the reservation integration.
- [How I Consolidated Duplicate Delivery Pipelines With Parameters and Build Tags](https://devops.com/how-i-consolidated-duplicate-delivery-pipelines-with-parameters-and-build-tags/) (DevOps.com, Sep 16, 2026). I describe consolidating duplicate Azure DevOps delivery definitions with run parameters, build tags and stage conditions, including the routing checks that keep modules separate.

## Talks and Podcasts

- [Season 5, Episode 33: Claude Opus 5.5, Tokenomics on AWS, and Sovereign Cloud Models](https://logicastvideo.podbean.com/e/s5-ep-33/) (LogiCast AWS News, Sep 29, 2026). A guest discussion of AWS AI services, token costs, sovereign cloud controls and the effect of agent automation on engineering work.
- [Don’t Give the Agent a Shell: Tool and Identity Boundaries for AI Agents in Cloud Operations](https://www.conf42.com/AI_Agents_2026_Ahmed_Tariq_identity_permissions_cloud) (Conf42 AI Agents, Sep 24, 2026). I discuss typed tools, separate read and execution identities, short-lived credentials and approval controls for AI agents that operate cloud infrastructure.
- [Schema Migrations in CI/CD: When AI Helps, When It Hurts, and How to Tell the Difference](https://www.conf42.com/Database_DevOps_2026_Ahmed_Tariq_postgres_mysql_scaling) (Conf42 Database DevOps, Jun 4, 2026). A practical discussion of backward-compatible database changes, migration checks in CI/CD, rollback limits and the role of AI-assisted review.
- [Intro to DevOps: Bridging Development and Operations for Faster Delivery](https://www.youtube.com/watch?v=64LoMWFzRs4) (Tech GupShup with Fatima, Oct 12, 2024). An introduction to DevOps collaboration, delivery workflows and the connection between development and operations.

## Certifications

- Google Cloud Certified: Associate Cloud Engineer
- AWS Certified: Solutions Architect Associate
- Microsoft Certified: DevOps Engineer Expert
- Microsoft Certified: Azure Solutions Architect Expert
- Microsoft Certified: Azure AI Engineer Associate
- Aviatrix Multicloud Network Associate

## Authoritative Links

- Website: https://ahmed-tariq.me/
- Case studies: https://ahmed-tariq.me/projects/
- Articles: https://ahmed-tariq.me/publications/
- Talks and podcasts: https://ahmed-tariq.me/talks/
- LinkedIn: https://www.linkedin.com/in/ahmedtariq01/
- GitHub: https://github.com/ahmedtariq01/
- Credly: https://www.credly.com/users/ahmedtariq
- CV: https://ahmed-tariq.me/cv/Ahmed_Tariq_CV.pdf
- Contact: https://ahmed-tariq.me/#contact