Identity infrastructure that is secure, auditable and run as code.

The company needed its partners to sign in to a web app and call its API securely, with Keycloak as the identity provider and nothing built yet.

As the sole Keycloak owner I designed the partner realm: Authorisation Code + PKCE for the single-page app, client-credentials service accounts for partner API access, and audience-scoped access tokens enforced end to end. I built the configuration as code from scratch — reusable Terragrunt modules for local, UAT and production — so every realm, client and mapper change became a reviewed Terraform diff.

I led the pre-go-live security review of the realm and remediated its findings before go-live.

Customers sign in through their own identity providers — some SAML 2.0, some OIDC — while every product and internal service needs one consistent identity and the authorisation data that goes with it.

I operate a multi-realm Keycloak platform that federates those providers behind a single authentication layer, covering inbound and outbound SSO over SAML and OIDC. I onboard and troubleshoot integrations with Okta, PingIdentity, Microsoft Entra ID, Active Directory and custom-built customer identity providers, manage LDAP / AD federation including attribute mapping and conflict resolution, keep the SSO configuration in Terraform and automate routine SSO work in Python.

A JWT customisation framework built on protocol mappers that puts organisation-specific claims and RBAC data into tokens, so downstream services can make fine-grained authorisation decisions without their own identity logic.

Every new customer SSO connection, removal and certificate rotation arrives as a ticket that an engineer would otherwise translate into configuration by hand.

An agent on AWS Bedrock that reads the ticket requirements, parses them and generates the configuration change as a merge request. The engineer only reviews and applies it, so a human always approves the change. It covers onboarding, offboarding and certificate rotation.

Weekly automated checks review the SSO configurations, flag certificates that are about to expire and open tickets, so customers are warned before anything breaks.

In the security operations team, responding to suspicious account activity meant manual steps for the incident response team.

I built Python and Rapid7 automation that hard-locks accounts when suspicious-activity triggers fire, alongside administering Microsoft Entra ID — conditional access, MFA enforcement, identity governance and access reviews across Microsoft 365 and Azure.

Less manual response work for the incident response team on account-compromise alerts.