Cloud Infrastructure & Authorized Security Practice
Peter Christian Agbenyega
Healthcare Cloud Security & Purple Team Engineer
AWS Solutions Architect - Professional
AWS Security Specialty SCS-C02
AWS Solutions Architect Associate
Building secure cloud infrastructure with a growing focus on HIPAA and ePHI protection. Bridging DevSecOps deployment and Purple Team defense through authorized penetration-testing training, threat emulation and defensive validation.
The National Security Challenge
Cloud Misconfiguration Remains One of the Most Preventable Cyber Risks
IBM's Cost of a Data Breach Report 2024 found that the global average breach cost reached $4.88 million, up from $4.45 million the year before, while 82% of studied breaches involved data stored in cloud environments. CISA separately warns that unprotected and misconfigured cloud services are common targets for threat actors because poor configurations can enable sensitive data theft and even cryptojacking.
$4.88M
Average global breach cost in IBM's July 30, 2024 report
82%
Of studied breaches involved cloud-stored data
99.9%
Of U.S. businesses are small businesses per SBA Office of Advocacy
The Infrastructure Security Response
Open Reference Architectures for Safer Cloud Adoption
Peter Agbenyega designs and publishes reusable cloud security reference work built around AWS, Terraform, and DevSecOps controls. The emphasis is practical: network segmentation, identity boundaries, policy enforcement, secure CI/CD, and deployment patterns that reduce the chance of avoidable configuration failures from the start.
His public repositories document reference designs and implementation work. A repository or preview alone does not establish tested production use or adoption. Deployment results and operational outcomes require separate evidence.
View Public Reference ArchitecturesPortfolio Mission
Public Interest and Technical Evidence
This portfolio documents independent public-interest technical work focused on secure cloud architecture, DevSecOps automation, Kubernetes hardening, multi-region resilience, and secure AI infrastructure. The goal is to make cloud-security patterns easier to study, review, and adapt by technical teams working to reduce misconfiguration risk and strengthen digital resilience.
This portfolio uses AWS as the primary implementation and documentation environment, with Azure and Google Cloud concepts mapped where appropriate. The purpose is to document secure cloud architecture patterns, security controls, resilience planning, and DevSecOps automation as public-interest technical reference work.
Featured Engineering Projects
Cloud Infrastructure and Purple Team Practice
Independent engineering, research and authorized labs connect architecture, automation and defense. Each summary identifies the scope of the work.
Healthcare-Focused Purple Team & Offensive Security Lab
Focus: Developing offensive and defensive security skills in isolated environments.
Building a Proxmox-based practice environment alongside HTB Academy and ACW360 training, with a growing focus on healthcare threat models.
- Studying Information Security Fundamentals and the selected Penetration Tester path toward the HTB CPTS goal.
- Developing vulnerability-assessment, Nmap, Active Directory and exploit-execution skills through authorized training.
- Using Python/Bash study to connect lab observations with detection, hardening and remediation.
Training and lab development; no claim of healthcare production deployment or HIPAA certification.
Proxmox VEHTB AcademyACW360Active DirectoryPython/Bash
Hybrid-Cloud Application Deployment
Focus: Infrastructure engineering — Cloud Nexus Hub LLC independent project.
Developing an architecture that pairs Vercel-hosted application frontends with private Proxmox-hosted backend services to reduce dependence on one cloud vendor.
- Next.js and Vercel application delivery alongside a Proxmox virtualization environment.
- Python/FastAPI and Docker backend patterns, with Nginx/Traefik reverse proxying and encrypted connectivity as integration priorities.
- DNS, CORS and routing troubleshooting; end-to-end production readiness remains to be validated.
Proxmox VEVercelNext.jsFastAPIDocker
Network Forensics & DevSecOps Pipeline Hardening
Focus: Cloud security practice and defensive validation.
Coursework and permitted lab exercises connect network observations with detection, hardening and remediation decisions.
- Wireshark packet analysis and traffic inspection to investigate anomalies.
- TLS-decryption exercises using authorized traffic and available session keys.
- Linux hardening, AWS VPC security controls and GitHub Actions pipeline study informed by offensive and defensive methods.
WiresharkLinuxAWS VPCSecurity GroupsGitHub Actions
Quantitative Data Engines & Python Automation
Focus: Python backend and data engineering.
Reproducible data-processing and research workflows across Forex strategy evaluation and Kaggle CASMI mass-spectrometry learning.
- Forex research code normalizes historical market data and implements strategy-confirmation and average-true-range helpers.
- CASMI research code implements Parquet loading, schema checks and spectrum processing.
- Research and backtesting remain distinct from live trading, competition rankings or healthcare deployment.
PythonPandasParquetData Validation
Reference Architecture Portfolio
Cloud Security Projects and Healthcare Security Direction
Each project below documents a specific security or resilience pattern: hardened landing zones, controlled networking, secure CI/CD, Kubernetes foundations, or continuity-oriented infrastructure design. These cloud foundations inform my developing healthcare cybersecurity and purple-team interests; the projects remain reference work, with deployment and adoption assessed separately.
Secure Cloud Baseline Architecture
Repository: ResilientOps-Cloud-Architecture
Draw.io-style reference diagram for public technical documentation.
Terraform-based AWS baseline showing segmented networking, controlled ingress, private application placement, data-tier separation, and centralized logging.
Terraform
AWS VPC
Auto Scaling
View Architecture
Kubernetes Security Reference Architecture
Draw.io-style reference diagram for public technical documentation.
Problem statement. Kubernetes platforms introduce avoidable risk when cluster access, workload boundaries, and image controls are not defined from the start.
Technical contribution. This reference architecture maps a secure delivery path from source control and image scanning into the control plane, private worker nodes, secrets handling, RBAC, and NetworkPolicy-based isolation.
Public benefit. It provides a reusable baseline that smaller teams can study before operating containerized workloads in cloud environments.
EKS
Kubernetes
RBAC
View Architecture
Cloud Security Controls Framework
Draw.io-style reference diagram for public technical documentation.
Problem statement. Cloud security programs often struggle to show how identity, network, encryption, detection, and compliance controls connect as a single reviewable framework.
Technical contribution. This reference architecture organizes least-privilege identity design, network controls, KMS-backed encryption, logging, threat findings, and control mapping into one structured control flow.
Public benefit. It helps reviewers and practitioners trace how practical cloud safeguards support accountable and repeatable governance.
AWS
Terraform
CloudTrail
View Architecture
Multi-Region Cloud Resilience Architecture
Draw.io-style reference diagram for public technical documentation.
Problem statement. Critical workloads cannot rely on a single region when continuity planning, replication, and recovery procedures are expected.
Technical contribution. This reference architecture shows DNS routing, primary and secondary region placement, replication flows, backups, health monitoring, and failover runbook alignment.
Public benefit. It documents continuity patterns that support more resilient digital operations for organizations with limited infrastructure depth.
Route 53
Multi-AZ
DR
View Architecture
AWS Terraform Security Baseline for SMB Environments
Repository: AWS-Terraform-Secure-Infrastructure
Draw.io-style reference diagram for public technical documentation.
Security-focused AWS baseline for small and medium business environments with mapped controls across IAM, encryption, Terraform state protection, and automated review gates.
Terraform
IAM
KMS
View Architecture
Secure DevSecOps Pipeline Reference Architecture
Draw.io-style reference diagram for public technical documentation.
Problem statement. Software delivery pipelines need review gates that catch secrets exposure, insecure infrastructure changes, and vulnerable build artifacts before release.
Technical contribution. This reference architecture documents a secure delivery sequence across source review, secret scanning, SAST and IaC checks, build and test, container scanning, approval, deployment, and monitoring feedback.
Public benefit. It demonstrates a practical control path that can be reused when organizations want stronger release discipline without unnecessary platform complexity.
GitHub Actions
Trivy
OWASP ZAP
View Architecture
Security-First Engineering Practice
The DevSecOps Security Pipeline
The diagram below groups the reference workflow into eight core stages for readability. The linked GitHub Actions configuration defines 15 stages, including scanning, approval and deployment steps. Successful execution, enforced approval and production operation require separate validation.
Prevention Goals
- Hardcoded credentials and token leakage
- Terraform and container misconfigurations
- Unreviewed image promotion into deployment paths
Detection Goals
- High and critical package vulnerabilities
- Static code weaknesses and insecure patterns
- Runtime exposure such as missing headers and weak defaults
Control References
- NIST SP 800-53 control-oriented workflows
- CIS benchmark-style hardening expectations
- AWS Well-Architected security practices
AWS Certifications
Credentials Built Around Enterprise Cloud Security
AWS Certified Solutions Architect - Professional
Exam version: SAP-C02
Advanced multi-account enterprise architecture design
AWS Certified Security - Specialty
Exam version: SCS-C02
Most relevant to this portfolio: IAM, KMS, GuardDuty, CloudTrail, logging,
encryption, and VPC security
AWS Certified Solutions Architect - Associate
Exam version: SAA-C02
Foundation architecture and AWS service design
Core Competencies
Cloud Engineering and Developing Purple Team Skills
Healthcare & Compliance Learning
HIPAA, ePHI protection and healthcare cloud architecture study. Preparing toward HIMSS CPHIMS; certification not earned and exam eligibility unverified.
Offensive Security Training
Penetration-testing fundamentals, vulnerability assessment, Nmap, Active Directory and exploit-execution practice within authorized training environments. HTB CPTS is a certification goal.
Defensive Security
AWS security, IAM, Wireshark packet analysis and network traffic inspection; Linux/Windows hardening and authorized TLS-decryption lab practice.
Cloud & Infrastructure
AWS architecture, Proxmox VE, Docker, Kubernetes and Terraform infrastructure as code.
DevSecOps & Automation
CI/CD pipelines, GitHub Actions, GitLab CI, Python/FastAPI, security scripting and Celery workflows. Research work also uses Parquet data processing.
MS Cloud Computing Systems — In Progress
University of Maryland Global Campus
Graduate study remains in progress; degree conferral is not yet confirmed.
Credentials and Education
Professional Development
Graduate study and certifications strengthen the theoretical and practical foundation behind the portfolio's cloud-security reference work.
AWS Certified Security — Specialty
Exam version: SCS-C02AWS Certified Solutions Architect — Professional
Exam version: SAP-C02AWS Certified Solutions Architect — Associate
Exam version: SAA-C02Master of Science in Cloud Computing Systems
University of Maryland Global Campus — in progress; expected December 2026.Graduate Certificate in Cybersecurity Technology
University of Maryland Global CampusHTB Certified Penetration Testing Specialist (CPTS)
Information Security Fundamentals study and selected Penetration Tester path. CPTS not yet earned.HIMSS CPHIMS
In preparation; certification not earned. Exam eligibility is not yet verified.Diploma in Basic Education
University of Cape CoastBachelor of Education in Basic Education — Mathematics major
University of Education, WinnebaApplied Technical Initiatives
Selected Projects and Development Context
Cloud Nexus Hub
Cloud Nexus Hub LLC is the operating entity through which Peter documents architecture work, organizes technical implementations, and maintains a U.S. base for cloud-security-focused initiatives.
cloudnexus360.comCloud Nexus Pilot
Interview preparation project for cloud and DevSecOps practitioners, including AWS security subject matter grounded in IAM, KMS, GuardDuty, and operational cloud defense.
cloudnexuspilot.comUBAG Store
E-commerce project for Uncle Bakarr African Grocery in Utica, New York, intended to support online product discovery and ordering workflows for a local grocery business.
ubagstore.comWOMIEX
Bilingual trade-information project exploring connections between DRC mineral producers and U.S. industrial buyers, with a focus on supply-chain transparency and information access.
womiex.comWhy This Work Matters
Technical Depth, Real-World Need, and Continued Growth
Demonstrated Technical Depth
- Three AWS certifications including Professional and Security Specialty levels
- Open cloud security architecture repositories available to public reviewers
- Graduate study in Cloud Computing Systems at a U.S. university
- Terraform and DevSecOps reference implementations available for technical review
- Applied implementation work focused on secure deployment and operational resilience
Why Cloud Security Matters
- CISA identifies misconfigured cloud services as common targets for threat actors
- IBM documents persistent cloud-linked breach exposure and escalating breach costs
- SBA documents that 99.9% of U.S. businesses are small businesses with limited security resources
- Reference architectures map directly to access control, logging, segmentation, and secure delivery concerns
- Technical projects explore digital tools for local businesses and trade information
Continued Growth and Direction
- Public repositories show hands-on work, not only theoretical familiarity
- Project work develops practical skills; deployment and adoption need separate evidence
- Combination of cloud security, DevSecOps, full-stack delivery, and systems thinking
- Based in Oneida, New York, with independent reference work through Cloud Nexus Hub LLC
- Ongoing graduate education deepens technical breadth while public work continues
Public Contributions
Open-Source Security Reference Work
Public code matters because it allows technical reviewers, lawyers, and adjudicators to examine the work directly rather than relying on unsupported summaries.
Latest Technical Writing
Cloud Security for Everyday America
Why Small Organizations Need Secure-by-Design Cloud Architecture Before They Scale explains why security is easier to build into cloud architecture early than to retrofit after growth — with core principles, an AWS-style example, and a starter checklist.
Read ArticleSecure Cloud Baseline Architecture
ResilientOps-Cloud-Architecture
Production-style AWS baseline with modular Terraform, controlled ingress, private application tiers, and segmented networking.
View on GitHubKubernetes Security Reference Architecture
Secure modular AWS EKS foundation with Terraform modules for VPC, IAM, control plane setup, and example security manifests.
View on GitHubCloud Security Controls Framework
Terraform-based security landing zone with multi-AZ networking, IAM controls, EC2 separation, and private-subnet RDS design.
View on GitHubAWS Terraform Security Baseline for SMB Environments
AWS-Terraform-Secure-Infrastructure
Compliance-mapped AWS landing zone implementing NIST, CIS, Well-Architected, and security scanning baselines for SMB environments.
View on GitHubSecure DevSecOps Pipeline Reference Architecture
Security-focused DevSecOps workflow with linting, testing, scanning, audit evidence, approval gates, and controlled deployment flow.
View on GitHubMulti-Region Cloud Resilience Architecture
Continuity-focused public repository reserved for multi-zone and failover-oriented cloud architecture work.
View on GitHubAll reference architectures are published publicly so that organizations, reviewers, and collaborators can inspect the technical work directly.
Flagship Reference Work
Evidence Portfolio
The five projects below form a coherent program of public-interest technical reference work, covering identity and access controls, network segmentation, secure delivery, container security, and regional resilience. The linked material supports review of the cloud work itself. Healthcare cybersecurity and purple-team learning are developing areas, separate from demonstrated deployment, organizational adoption or clinical outcomes.
Cloud Security Controls Framework
A structured reference for identity, network segmentation, encryption, logging, monitoring, detection, response, compliance mapping, and remediation planning.
View RepositoryKubernetes Security Reference Architecture
A Kubernetes/EKS-style security reference focused on RBAC, namespace isolation, secrets handling, network policies, image security, and audit visibility.
View RepositoryMulti-Region Cloud Resilience Architecture
A resilience reference covering regional continuity, DNS routing, replication, backup strategy, health checks, alerting, and failover planning.
View RepositorySecure DevSecOps Pipeline Reference Architecture
A secure software delivery reference covering secret scanning, dependency review, SAST, IaC scanning, container scanning, approval gates, rollback readiness, and audit evidence.
View RepositorySecure Cloud Baseline Architecture
A secure baseline reference for segmented cloud networking, controlled ingress, private workloads, IAM boundaries, encryption, logging, and monitoring.
View Repository
Peter Christian Agbenyega
Healthcare Cloud Security & Purple Team Engineer
Oneida, New York
AWS Security & Architecture
Terraform and Kubernetes Foundations
DevSecOps Pipeline Controls
About
About Peter
I am a Healthcare Cloud Security and Purple Team Engineer building on cloud infrastructure, DevSecOps and security automation foundations while developing threat-emulation and healthcare cybersecurity skills. Based in Oneida in Central New York, I combine AWS, Kubernetes and Terraform foundations with a growing focus on securing healthcare and enterprise environments.
I am currently finalizing my M.S. in Cloud Computing Systems, with completion expected in December 2026, and pursuing a Graduate Certificate in Cybersecurity Technology at the University of Maryland Global Campus. I am developing my knowledge of HIPAA, ePHI protection and health data security. My graduate qualifications remain in progress.
I take a Purple Team approach to learning: understanding how systems are built, how attackers may test their defenses, and how detection, hardening and remediation work together. In authorized coursework and labs, I use network forensics, Wireshark packet analysis and ethical-hacking exercises to inform secure infrastructure and CI/CD design. Active Directory security and exploitation are part of my training focus.
My experience in human services has reinforced the importance of confidentiality, reliable operations and accurate documentation. Those responsibilities shape my interest in dependable health IT and in protecting the people who rely on technical systems.
I am studying Information Security Fundamentals through HTB Academy and have selected the Penetration Tester path toward the HTB Certified Penetration Testing Specialist (CPTS) credential, with supporting study through Arewa Cyber Warrior (ACW360). CPTS is a goal, not an earned certification. I also participate in Kaggle competitions for research learning. Security testing is confined to authorized labs and permitted project work.
My healthcare professional development includes HIPAA and ePHI study and preparation toward HIMSS CPHIMS. I have not earned CPHIMS, and my exam eligibility has not been verified. Health Information Management remains an area of exploration.
For recruiters and hiring managers: I currently hold H-1B status and require employer sponsorship. I am interested in qualifying cap-exempt healthcare or academic employers and remote U.S. Purple Team, DevSecOps or Security Engineering roles. Transfer eligibility and start date must be confirmed for the specific position with the employer's immigration counsel.
Oneida, New York.
Organizational Foundation
Cloud Nexus Hub LLC
Cloud Nexus Hub LLC provides an organizational foundation for Peter's independent technical documentation, cloud-security reference architecture work, and long-term professional development in secure infrastructure, DevSecOps automation, and responsible cloud adoption.
The public materials connected to Cloud Nexus Hub are independent technical references and do not contain client secrets, proprietary systems, protected personal information, or compliance certification claims.
cloudnexus360.comProfessional and Community Context
Community and Professional Responsibility
Alongside cloud security and DevSecOps work, Peter has professional experience in human-services environments supporting vulnerable individuals, documentation discipline, safety protocols, and operational responsibility. This background reinforces a practical understanding of regulated environments, reliability, confidentiality, and the importance of systems that protect people, data, and critical services.
Connect With Peter
Healthcare Security, Cloud Engineering and Collaboration
Based in Oneida, New York. Please connect for cloud architecture and DevSecOps discussions, healthcare cybersecurity learning, authorized lab collaboration, or professional inquiries about the public portfolio and reference work.