Available for new opportunities

Secure delivery, automated end to end.

I'm Tayyab, a DevOps engineer automating the path from commit to production — CI/CD pipelines, containers and Kubernetes, infrastructure as code on the cloud, and security built into every stage: scanning, secrets management, and compliance checks.

Explore my work Start a conversation
20+Projects shipped
2+Years building
10+Tools in stack
Laptop running DevOps pipeline commandsMuhammad Tayyab
DevOps + DevSecOpsBuilt to ship safely
Pipelines that ship
Open to work

About me

Turning ideas into reliable pipelines

Tayyab Latif, DevOps and DevSecOps engineer
Tayyab LatifDevOps · DevSecOps & Cloud engineer

I automate delivery and bake security into every stage, so teams can ship often without worrying.

Automating CI/CD pipelines
Available for selected projects

I'm Tayyab, a DevOps and DevSecOps engineer who automates how software is built, shipped, and secured — so releases are fast, repeatable, and safe by default.

I work across the delivery lifecycle: CI/CD pipelines with GitHub Actions and Jenkins, containerised workloads on Docker and Kubernetes, infrastructure as code with Terraform and Ansible, and monitoring with Prometheus and Grafana. On the security side I shift checks left — SAST and DAST scanning, dependency and container image scanning, and secrets management — as a developer who has also built and shipped full-stack products.

Automation first Repeatable CI/CD from commit to production.
Reliable infrastructure Code-defined, observable, and scalable.
Security built in Scanning, secrets, and compliance in every pipeline.
AWSDockerKubernetesArgoCDTerraformAnsibleJenkinsGitHub ActionsTrivySonarQubeHashiCorp VaultPrometheusGrafanaLinux

Selected work

Projects I've built

Production infrastructure I run, DevSecOps pipelines and labs I've built, and full-stack apps I've containerised and deployed with Docker and Kubernetes.

Production · TeleTaleem
$ client -> edge router -> pfSense (NAT)$ haproxy :443  SNI routing  ├─ master   scalelite + nginx + postgres  ├─ worker-1 bbb 3.0  turn :3478  └─ worker-2 bbb 3.0  turn :3479✓ prometheus + grafana scraping 3 nodes
BigBlueButtonScaleliteHAProxypfSenseGrafana

BigBlueButton Multi-Node Cluster

Production Infrastructure | EdTech Live Classes

Scalelite load-balanced BigBlueButton cluster for live online classes: a master node routing meetings across worker nodes, behind pfSense, on VMware ESXi.

  • SNI-based TLS routing
  • Double-NAT port forwarding
  • TURN/WebRTC NAT fixes
  • Prometheus + Grafana
  • ufw hardening
Private production system
Production · TeleTaleem
$ systemctl status nginx php-fpm✓ 9+ moodle instances online$ php import_multiple_results.php  tangerine (couchdb) -> moodle grades✓ live classes via bigbluebutton
MoodleLinuxPHPCouchDB

Moodle LMS Production Platform

Production Infrastructure | LMS Operations

Running production infrastructure for 9+ Moodle LMS instances, integrated with BigBlueButton live classes and a custom results-import pipeline.

  • 9+ production instances
  • Tangerine → Moodle results import
  • BBB live class integration
  • Linux server operations
Private production system
Open source
$ threat-dragon  STRIDE -> 69 threats -> jira$ snyk test        9 issues -> 0  (397 tests pass)$ gitleaks detect  2 leaks  -> 0  (CI gate on PRs)$ trivy image      47/6/6/26 -> 0/0/0/0$ curl /.env      403 · TRACE 405 · brute-force 429✓ vault down -> app refuses to start
Threat modelingSnykGitleaksVaultTrivyHAProxy

Secure Infra From Scratch

DevSecOps | End-to-End Build

A hospital 3-tier app taken from bare network to hardened production: STRIDE threat model, SAST/SCA/secret scanning, Vault-managed secrets and a locked-down HAProxy + Nginx edge — with before/after evidence for every layer.

  • 69 threats → Jira backlog
  • Snyk: 9 → 0 vulns
  • Gitleaks CI gate
  • Vault fail-closed secrets
  • Edge rate limiting + fail2ban
View on GitHub
Jenkins
$ jenkins build #fileforge  gitleaks -> sonarqube + quality gate  snyk -> owasp dependency-check  docker build -> trivy -> syft sbom -> grype  deploy (vault) -> owasp zap baseline✓ reports archived per stage
JenkinsSonarQubeSnykTrivySyft/GrypeOWASP ZAP

FileForge DevSecOps CI/CD Pipeline

CI/CD | Shift-Left Security

Jenkins pipeline for a React + Express + MongoDB file platform that runs secret scanning, SAST with a quality gate, SCA, image scanning, SBOMs, a Vault-backed deploy and a DAST scan on every build.

  • 10+ security stages
  • Quality gate
  • SBOM generation
  • Vault secrets
  • DAST scan
View on GitHub
Kubernetes
$ kubectl apply -f k8s/  namespace  secrets  storageclass (encrypted)  mongo  backend  frontend  ingress (tls)$ kyverno: runAsNonRoot  no privilege escalation$ netpol: mongo <- backend only✓ 13 STRIDE threats fixed
KubernetesKyvernoNetworkPolicyVaultcert-managerSBOM

FileForge on Kubernetes — Secured

Kubernetes | Threat-Model Driven

FileForge deployed to Kubernetes after a STRIDE review, with 13 threats fixed in code and manifests: JWT auth, audit logs, upload quotas, policy enforcement, network isolation and encrypted storage.

  • Kyverno policies
  • NetworkPolicies
  • Encrypted PVCs
  • Ingress rate limiting
  • Vault service account
View on GitHub
AWS
$ terraform workspace select production$ terraform plan  + aws_vpc  aws_subnet  aws_security_group  + aws_instance  aws_s3_bucket (versioned, private)  state: s3 (encrypted) + dynamodb lock✓ apply complete
TerraformAWSEC2S3DynamoDB

Terraform Multi-Environment AWS

Infrastructure as Code | AWS

One Terraform codebase that provisions separate testing, dev and production environments on AWS using workspaces, with remote state locked in S3 and DynamoDB.

  • 3 workspaces: testing/dev/prod
  • Per-env sizing
  • Remote state + locking
  • Versioned S3
  • Public access blocked
View on GitHub
Open source
$ docker compose up -d✓ frontend  backend  postgres  vault  healthy$ docker inspect backend  user: node  cap_drop: ALL  read_only: true$ ./scan.sh   trivy repo + 4 images✓ 0 HIGH/CRITICAL  (1 risk-accepted w/ expiry)
DockerComposeTrivyPostgreSQLLeast privilege

Hardened Container Stack

Containers | Supply-Chain Security

Next.js frontend, Express API and PostgreSQL in Docker Compose, hardened to least privilege and scanned with Trivy until every image came back clean.

  • Non-root containers
  • cap_drop ALL + read-only FS
  • Loopback-only ports
  • Least-privilege DB role
  • Trivy HTML reports
View on GitHub
Jenkins
$ jenkins build #fileforge  checkout -> compose down -> prune images  compose build --no-cache -> compose up -d$ docker ps  frontend  backend  mongo  nginx✓ health check passed
JenkinsDocker ComposeNginxMongoDB

FileForge CI/CD with Jenkins

CI/CD | Containers

Jenkins pipeline that rebuilds and redeploys the full FileForge stack — React, Express, MongoDB and an Nginx reverse proxy — with Docker Compose and a post-deploy health check.

  • Automated rebuild
  • Zero manual steps
  • Health checks
  • Logs on failure
View on GitHub
AWS
$ ssh ubuntu@ec2$ ./scripts/postScript.sh  compose down -> build -> up -d  nginx :80 -> frontend :3000  nginx /api -> backend :5000 -> mongo✓ live on ec2
AWS EC2DockerNginxReactNode.js

FileForge on AWS EC2 with Docker

Cloud Deployment | AWS

Containerised file-processing platform deployed on AWS EC2 with Docker Compose behind an Nginx reverse proxy, with a one-command redeploy script.

  • EC2 deployment
  • Reverse proxy
  • Redeploy script
  • Multi-container stack
View on GitHub
Jenkins
$ jenkins build #logstream  docker build backend  docker build frontend  compose up -d  frontend  backend  mongo$ socket.io  new-log  ERROR  payment-svc✓ live dashboard updating
ReactNode.jsSocket.IOMongoDBJenkins

LogStream — Real-Time Log Monitor

Monitoring | CI/CD

Real-time log monitoring app with live WebSocket updates, filtering and error alerts, containerised and deployed through a Jenkins pipeline.

  • Real-time WebSocket feed
  • Level/service filters
  • Error alerts
  • Jenkins deploy
View on GitHub 
$ vcenter > cluster > hosts  ├─ esxi-01  connected  ├─ esxi-02  connected  └─ esxi-03  connected✓ HA + DRS enabled✓ vMotion: vm-web -> esxi-02 (0 downtime)
VMware ESXivCentervMotionHADRS

VMware vSphere HA Lab

Virtualization | Data Center

Multi-host vSphere environment managed from vCenter, with shared NFS storage, high availability, live migration and VM lifecycle automation.

  • 3 ESXi hosts in vCenter
  • NFS shared storage
  • Templates & clones
  • Snapshots
  • vSwitch networking
View on GitHub 
$ pfSense-1 MASTER  <-carp->  pfSense-2 BACKUP  LAN      users  VLAN 20  servers$ jump-server  bind9-dns  smb  sftp✓ failover tested
pfSenseCARP HAVLANsBIND9Firewall

pfSense HA & Network Segmentation

Networking | Security

Redundant pfSense firewalls on separate hosts with CARP failover, separating users from servers with VLANs and hosting core internal services.

  • CARP high availability
  • Users/servers segmentation
  • Jump server
  • Internal DNS (BIND9)
  • SMB & SFTP
View on GitHub
Traffic Flow AI Dashboard dashboard screenshot
DockerKubernetesNext.jsAI integrationsAnalytics

Traffic Flow AI Dashboard

AI-powered traffic management dashboard, containerised with Docker and deployed on Kubernetes with rolling updates and health probes.

  • Dockerised
  • Deployed on Kubernetes
  • Live demo
View live project
Smart Parking Management System dashboard screenshot
DockerKubernetesReact.jsNode.jsDashboard

Smart Parking Management System

Parking management dashboard with a React frontend and Node.js API, shipped as Docker images and run as Kubernetes deployments behind an Nginx ingress.

  • Dockerised
  • Deployed on Kubernetes
  • Live demo
View live project
Hospital Doctor Dashboard dashboard screenshot
DockerKubernetesNext.jsREST APIsHealthcare

Hospital Doctor Dashboard

Healthcare dashboard for doctors, packaged as a non-root Docker image and deployed to Kubernetes with config and secrets kept out of the image.

  • Dockerised
  • Deployed on Kubernetes
  • Live demo
View live project
BuildCore Construction Platform dashboard screenshot
DockerKubernetesFull-stackPostgreSQLReporting

BuildCore Construction Platform

Construction management platform with PostgreSQL, deployed as a multi-container stack with Docker Compose and on Kubernetes with persistent storage for the database.

  • Dockerised
  • Deployed on Kubernetes
  • Live demo
View live project
Custom Trading Dashboard dashboard screenshot
DockerKubernetesNext.jsReact.jsTypeScript

Custom Trading Dashboard

FinTech Dashboard | Trading Platform

Financial trading dashboard containerised with a multi-stage Docker build and deployed on Kubernetes, scaled with multiple replicas behind a Service.

  • Dockerised
  • Deployed on Kubernetes
  • Trading analytics
  • Portfolio overview
  • Market insights
View live project
Crypto Trading & Analytics Platform dashboard screenshot
DockerKubernetesNext.jsReact.jsTypeScript

Crypto Trading & Analytics Platform

Crypto Platform | Financial Analytics

Crypto analytics platform built into a slim Docker image and deployed on Kubernetes with an Ingress, readiness checks and zero-downtime rollouts.

  • Dockerised
  • Deployed on Kubernetes
  • Crypto analytics
  • Financial reports
  • Market insights
View live project
Restaurant Management & Ordering Platform dashboard screenshot
DockerKubernetesReact.jsNext.jsTypeScript

Restaurant Management & Ordering Platform

Food & Business Applications

Restaurant ordering web app, containerised with Docker and served through Nginx, deployed on a Linux server and on Kubernetes.

  • Dockerised
  • Deployed on Kubernetes
  • Restaurant landing page
  • Menu browsing
  • Food categories
View live project

Let's connect

Have a project in mind?

I'm available for freelance and full-time work — CI/CD, cloud infrastructure, and security automation.

askmuhammadtayyab786@gmail.com+92 315 4064911Islamabad, PakistanLinkedInGitHub
Usually replies within 24–48 hours