FinPay — Internal Developer Platform for PHP Workloads on Azure
A self-service internal developer platform (IDP) that lets any team deploy a containerised PHP application to Azure from a single deploy.yaml manifest — turning a one-off fintech deployment into a reusable, self-service product with golden-path defaults.
- Versioned, reusable Terraform module provisioning Azure Container Apps, MySQL Flexible Server, Azure Cache for Redis, Key Vault and ACR.
- Private-by-default networking: VNet-integrated MySQL and private-endpoint Redis over TLS; passwordless access via user-assigned managed identity and Key Vault RBAC.
- Reusable GitHub Actions pipelines (
workflow_call) with OIDC federation to Azure.
- Security and quality gates in CI (Checkov, Trivy, tflint); semantic-versioned releases.
Azure Container Apps
Terraform
GitHub Actions (OIDC)
View on GitHub
FinPay — Fintech Payment Application (Software Engineering)
The PHP fintech application underneath the platform above: a versioned REST API (api/v1), authentication and user-account modules, and payment functionality including Bitcoin HD-wallet address generation.
- Containerised with Docker and Compose, with a health-check endpoint for platform probes and a PHPUnit test suite.
- Dependencies managed with Composer, configuration externalised via environment variables.
- Authorship note: Built as MSc SWE7303 (DevOps) coursework. I authored the PHP app; a classmate handled the AWS deployment shown in the repo's
buildspec.yml. I independently re-platformed the application onto Azure.
PHP 8.2
MySQL
Docker
View on GitHub
Secure Hub-and-Spoke Network
Implemented a scalable Hub-and-Spoke topology for enterprise-grade network isolation, centralized traffic inspection, and hybrid connectivity.
- Centralized security routing via Azure Firewall.
- Isolated workloads preventing unauthorized lateral movement between spokes.
- Infrastructure codified cleanly using Azure Bicep and Terraform.
Azure Firewall
VPN Gateway
Networking
View on GitHub
Azure Zero Trust Architecture
Designed a Zero Trust security model focusing on identity verification, least-privilege access, and network micro-segmentation.
- Identity verification via Entra ID and Conditional Access.
- Lateral movement blocking enforced by Hub-Spoke patterns.
Entra ID
Zero Trust
Security
View on GitHub
Automated Threat Remediation (SOAR)
Architected a Security Orchestration, Automation, and Response workflow using Microsoft Sentinel to standardize and accelerate incident triage.
- Ingestion of logs from firewalls and endpoints.
- Custom KQL queries mapping anomalous behavior to MITRE ATT&CK.
- Automated isolation workflows using Azure Logic Apps.
Microsoft Sentinel
Logic Apps
KQL
Identity Governance Automation
Enforced strong identity controls and access governance to manage administrative privilege safely.
- Deployed Entra ID PIM (Just-In-Time) access.
- Enforced strong MFA and device compliance policies.
- Aligned identity controls with standard frameworks.
Entra ID
PIM
Governance
View on GitHub
Currently Building (Roadmap)
Online Boutique on Azure AKS
Kubernetes, Helm/Kustomize, workload identity, ingress, managed Prometheus/Grafana.
Planned next: GitOps (Argo CD), observability/SRE, Terraform testing & policy-as-code, multi-region resilience.