# Security & Access Management > Selected work demonstrating this service. - [Enhanced data security by implementing 1,000 RBAC rules for developers, application instances, PostgreSQL, MS SQL, and other Linux servers, preventing unauthorized access; documented with Ansible automation.](https://engineer.company/portfolio/enhanced-data-security-by-implementing-1-000-rbac-14/) - [Prevented security breaches by leading access management initiatives, utilizing M365, 1Password, Red Hat SSO, and OKTA SSO.](https://engineer.company/portfolio/prevented-security-breaches-by-leading-access-management-initiatives-21/) - [Managed and troubleshooted 8 WireGuard VPN and IPSEC VPN connections, ensuring secure communication across Google Cloud and Linux systems.](https://engineer.company/portfolio/managed-and-troubleshooted-8-wireguard-vpn-and-ipsec-23/) - [Improved team communication and collaboration by implementing Slack, Mattermost, 1Password, and Jira, saving 8,000 hours of labor.](https://engineer.company/portfolio/improved-team-communication-and-collaboration-by-implementing-slack-34/) - [Administered network infrastructure for over 1,000 servers, ensuring optimal system deployment, security, and troubleshooting.](https://engineer.company/portfolio/administered-network-infrastructure-for-over-1-000-servers-39/) - [Automated SSL/TLS certificate creation for 100 Docker applications, ensuring secure connections across Ubuntu Linux hosts.](https://engineer.company/portfolio/automated-ssl-tls-certificate-creation-for-100-docker-41/) - [Designed an organization context‑switching system with client localStorage and server‑side cookie mirroring, letting users act as managed organizations while enforcing least‑privilege authorization.](https://engineer.company/portfolio/designed-an-organization-context-switching-system-with-client-59/) - [Built email as a platform capability — three providers with failover, delivery webhooks, send and delivery logging, templating and campaigns — behind a startup check that will not boot without one.](https://engineer.company/portfolio/built-email-as-a-platform-capability-with-failover-62/) - [Provisioned Azure infrastructure as code with Bicep — Container Apps, PostgreSQL Flexible Server, Front Door/WAF and networking — across the development, staging and production environments.](https://engineer.company/portfolio/provisioned-azure-infrastructure-as-code-with-bicep-container-68/) - [Hardened the application with nonce‑based CSP, HSTS, SameSite cookies, least‑privilege database roles and server‑side entitlement re‑checks.](https://engineer.company/portfolio/hardened-the-application-with-nonce-based-csp-hsts-77/) - [Automated team collaboration, password management, task and time management, and built a semi‑automatic project‑showcase system, raising team productivity.](https://engineer.company/portfolio/automated-team-collaboration-password-management-task-and-time-89/) - [Integrated a company‑wide password‑management system, strengthening security and streamlining access control.](https://engineer.company/portfolio/integrated-a-company-wide-password-management-system-strengthening-90/) - [Built the payments and entitlements layer — Stripe alongside Apple and Google in‑app purchase — gating the directory, search and export through an 11‑table access model checked on the server.](https://engineer.company/portfolio/built-the-payments-and-entitlements-layer-96/) - [Built fail‑closed abuse controls — 22 Redis‑backed rate limiters, Cloudflare Turnstile, request idempotency and an origin lock — so the platform sheds bots and floods instead of trusting its callers.](https://engineer.company/portfolio/built-fail-closed-abuse-controls-and-rate-limiting-100/) - [Built company ownership claims end to end — a user claims a company, an administrator adjudicates, and an approval rewrites the authorization graph that decides who is allowed to edit what.](https://engineer.company/portfolio/built-company-ownership-claims-end-to-end-103/) - [Established a continuous security programme — code scanning, DAST, dependency and vulnerability checks, SBOM generation, secret scanning and SHA‑pinned actions — alongside 21 written security audits.](https://engineer.company/portfolio/established-a-continuous-security-programme-104/) - [Found and closed three SSH brute‑force protections that had never worked: a ban jail watching port 22 while the daemon listened on 1986, a rate limit shadowed by a broader rule above it, and a ban action whose binary never resolved, so no ban had ever applied.](https://engineer.company/portfolio/found-three-ssh-brute-force-protections-that-never-worked-110/) - [Hardened SSH to 24 asserted directives with three‑stage validation — the candidate file, the assembled config, then the daemon's own read‑back — after the read‑back caught the running server silently overriding two of the twenty‑four.](https://engineer.company/portfolio/hardened-ssh-with-three-stage-validation-111/) - [Proved the intrusion‑banning path end to end on every hardening run by banning a reserved test address, reading the resulting kernel rule and unbanning in a guaranteed cleanup block, so a jail that stops working fails a run instead of reporting healthy.](https://engineer.company/portfolio/proved-the-intrusion-banning-path-on-every-converge-112/) - [Verified firewall rules by position rather than presence, reading the numbered rule list and the live packet‑filter chain, because a rule that exists is not a rule any packet reaches.](https://engineer.company/portfolio/verified-firewall-rules-by-position-113/) - [Added a preflight play that runs the same code as the converge against operator‑local secrets in about a second, after a half‑applied production run died on its ninth task with the swap settings already written to the live host.](https://engineer.company/portfolio/added-a-preflight-play-for-secrets-117/) - [Reconciled a 20‑record DNS zone declaratively against the Cloudflare API with separate audit and BIND‑export entry points, and turned the CDN proxy back off on privacy grounds after building it.](https://engineer.company/portfolio/reconciled-a-dns-zone-declaratively-118/) - [Cut systemd sandbox exposure across every unit this platform installs — a dead‑man's‑switch service from 9.6 UNSAFE to 1.5, an internet‑facing git forge from 8.3 EXPOSED to 1.5 — and added a converge‑time parser check after finding a misspelled directive silently ignored in three unit templates.](https://engineer.company/portfolio/cut-systemd-sandbox-exposure-across-every-unit-119/) - [Deployed a container plane on Podman and Quadlet under systemd rather than Docker, because Docker publishes container ports above the host firewall's own rules — and gave deploys an unprivileged user with one fixed command instead of root.](https://engineer.company/portfolio/deployed-a-container-plane-on-podman-and-quadlet-122/) - [Automated the provisioning of a second server on a second cloud provider, creating the firewall before the machine so it is born behind one, with both providers' firewalls written directly against their REST APIs to avoid a third‑party collection.](https://engineer.company/portfolio/provisioned-a-second-server-from-code-123/) - [Wrote a scope rule into the repository after a restructure carried another company's inventory, firewall allowances and prose into it — and kept the quarantined residue under the secret scanner rather than excluding it.](https://engineer.company/portfolio/wrote-a-scope-rule-after-a-credential-leak-124/) - [Split the four per‑host operational secrets after establishing that two hosts sharing one dead‑man's switch alert less than two switches, not more, and that a shared backup passphrase makes two hosts one repository.](https://engineer.company/portfolio/split-every-operational-secret-per-host-125/) - [Reached the half of the messaging core the application had never used — backup transfer, disappearing messages, message editing and resending, verified invitations, proxies and encryption policy — driving every test against the real library with no mocks.](https://engineer.company/portfolio/reached-the-unused-half-of-the-messaging-core-161/) - [Audited 644 Rust crates for licence compatibility on every build, and proved the check fires by rewriting one crate's licence and by moving the pinned core revision without regenerating.](https://engineer.company/portfolio/audited-644-rust-crates-for-licence-compatibility-163/)