Rodrigue Tsopbeng

Administered and secured GitLab CI/CD pipelines for 30+ enterprise applications, integrating SonarQube, Snyk, Trivy, and Prisma Cloud with quality gates (vulnerability, license risk, and image signing) to reduce critical findings reaching production. Supported production AWS infrastructure across 50+ environments, provisioning networking, IAM (IRSA), security, storage, and compute with Terraform delivered through CI/CD while maintaining strict environment isolation. Managed configuration and change control for the DevSecOps toolchain (SonarQube, Nexus, Harbor, Keycloak, Vault, Jira/Confluence) and executed auditable patching and upgrades. Designed Jira workflows for release/version visibility, coordinated deployments with Argo CD GitOps for zero-downtime promotions across dev/staging/production, and validated releases through FedRAMP/NIST-aligned testing and approval gates (image hardening, signed Helm/Kustomize). Built and rolled out STIG-Manager with a CI/CD-provisioned MySQL backend

Designed and provisioned secure AWS environments using Terraform via GitLab CI, deploying EC2, VPCs, subnets, route tables, NAT gateways, load balancers, and security groups across multi-account dev/stage/prod aligned to NIST 800-53. Built VPC architectures with segmentation, egress controls, and data residency guardrails. Implemented security best practices including least-privilege IAM, Service Control Policies, and KMS encryption with automated key rotation for S3/EBS/RDS. Configured continuous monitoring and audit trails with CloudTrail, AWS Config, and GuardDuty. Developed CI/CD pipelines embedding shift-left security gates (build/regression testing, SAST/SCA scanning, artifact signing, deployment). Automated Linux EC2 configuration management and patching with Ansible and Bash to enforce STIG hardening and remediate drift. Wrote Python (Boto3) automation to audit IAM policies, enforce S3 encryption, validate tagging standards, and produce cost/security reports for auditors. Suppo

Secured CI/CD pipelines for Kubernetes workloads by integrating SAST/DAST/SCA scanning (SonarQube, Snyk, Trivy, Prisma Cloud) into GitLab CI, defining quality gates for vulnerabilities, license risk, and container/image readiness before deployment. Built and operated secure AWS EKS and Azure AKS clusters with hardened networking, IAM integration (IRSA/Pod Identity), autoscaling, and environment isolation via strict RBAC, network policies, and Pod Security Standards. Implemented GitOps with GitLab CI and Argo CD for zero-downtime, auditable deployments using Git as the single source of truth. Onboarded enterprise apps using Helm/Kustomize and standardized release configurations. Hardened Kubernetes workloads using RBAC, network policies, mTLS, and secrets management (AWS Secrets Manager, Vault, Azure Key Vault) with least-privilege and short-lived credentials. Enforced governance and scalability using Kyverno policy-as-code, autoscaling (HPA/VPA), Pod Disruption Budgets, and Karpenter-b