Skip to content
alinadeem.ca

Muhammad Ali Nadeem

Cloud & DevOps engineer

I build and secure serverless systems on AWS.

Founder of EasyIntern and builder of CloudGuard: production systems on AWS that stay secure, tested, and inside the free tier.

I founded EasyIntern, an internship board that runs serverless on AWS at $0/month, and built CloudGuard, an autonomous security remediation service for AWS accounts. Before that: software engineering intern at CyberDiverge, fellow at Headstarter AI, and an Honours BSc in Computer Science & Mathematics from the University of Toronto Mississauga.

GitHubEmailResume (PDF)
now
Open to cloud, DevOps, platform, and SRE roles; running EasyIntern.updated
focus
serverless AWS · IaC · CI/CD · security
based in
Greater Toronto Area
education
HBSc CS & Math · UTM · Aug 2026
open to
cloud · DevOps · platform · SRE
stack
  • AWS
  • Terraform
  • GitHub Actions · OIDC
  • Python
  • TypeScript
  • PostgreSQL · pgvector

Selected work

Production systems I designed, built, and operate. Each card opens a case study with the full architecture diagram, the decisions and trade-offs, and the security, cost, and test numbers.

easyintern data flow
01 · July 2024 – presentLive

EasyIntern

AI-powered internship board with hybrid lexical/semantic search, run serverless on AWS at $0/month.

  • FastAPI on Lambda container images behind API Gateway with a JWT authorizer; ECS Fargate ingestion from 4 ATS integrations on a daily EventBridge schedule.
  • PostgreSQL 17 on RDS with pgvector and ONNX Runtime (bge-small) for hybrid lexical/semantic ranking; RDS IAM auth, no database passwords.
  • Terraform (114 resources, 6 modules) and a 10-job GitHub Actions merge gate with OIDC federation; 20 ADRs.
Terraform resources
114
pytest / Vitest / Playwright
477 / 134 / 32
Merge-gate jobs
10
AWS bill
$0/mo
  • Next.js 15
  • Amplify Hosting
  • Python
  • FastAPI
  • Lambda (container)
  • API Gateway HTTP API
  • ECS Fargate
  • EventBridge
  • PostgreSQL 17 on RDS
  • pgvector
easyintern.ca
cloudguard data flow
02 · August 2026Open source

CloudGuard

Autonomous AWS security remediation: finds and fixes public S3 buckets, world-open SSH, and orphaned EC2 on a schedule.

  • Event-driven serverless: Python 3.12 Lambda (arm64), EventBridge, SNS, DynamoDB single-table with TTL, API Gateway HTTP API, React dashboard on S3 + CloudFront (OAC).
  • 12-action least-privilege scanner role with no delete, terminate, or authorize permissions; SSH rules wider than TCP/22 go to manual review instead of being revoked.
  • Terraform (31 resources), GitHub Actions with OIDC, PR plan comments, reviewer-gated apply; 59 pytest cases at 98% line coverage with zero live AWS calls.
Terraform resources
31
pytest cases
59
Line coverage
98%
Scanner IAM actions
12
  • Python 3.12
  • Lambda (arm64)
  • EventBridge
  • SNS
  • DynamoDB (single-table, TTL)
  • API Gateway HTTP API
  • React
github.com/Nadee108/cloudguard
recallai pipeline
03No longer live

RecallAI

AI study helper: a RAG pipeline over uploaded documents that generates quizzes and flashcards.

  • Retrieval-augmented generation over user-uploaded documents produces quizzes and flashcards.
  • Next.js/React frontend with Clerk auth and Stripe billing, deployed on Vercel.
  • Firebase for data, OpenAI + LangChain for generation, Sentence Transformers for embeddings.
  • Next.js
  • React
  • Vercel
  • OpenAI
  • LangChain
  • Sentence Transformers
  • RAG

How I work

What the projects above have in common.

  1. everything as code

    Infrastructure is Terraform with S3 remote state, locking, and lifecycle preconditions: 145 resources across EasyIntern and CloudGuard.

  2. no long-lived keys

    CI assumes roles through GitHub Actions OIDC federation, and the database authenticates with IAM instead of passwords.

  3. least privilege by construction

    CloudGuard's scanner role has 12 actions and no delete, terminate, or authorize permissions; its EC2 opt-in tag is enforced in the API, the code, and IAM.

  4. gate the merge, not the people

    A 10-job merge gate runs Checkov, tflint, gitleaks, pip-audit, and Playwright before anything reaches AWS, backed by 477 pytest, 134 Vitest, and 32 Playwright tests.

  5. free tier is a design constraint

    Both AWS systems run at $0/month on purpose, which pushes every design toward serverless, scheduled, and event-driven shapes.

Experience

  1. Jul 2024 – Oct 2024

    Software Engineering Fellow (full scholarship) · Headstarter AI

    • Built 15 AI/ML projects over the fellowship, including a brain tumour detector and a credit card fraud detector.
    • Built React/Next.js/Firebase applications and integrated Stripe.
    • Implemented retrieval-augmented generation with OpenAI and Pinecone, plus Llama 3.1 on Groq, orchestrated with LangChain.

  2. Sep 2023 – Aug 2024

    Mississauga, ON

    Software Engineering Intern · CyberDiverge

    • Built AI-driven REST APIs and CI/CD pipelines.
    • Worked on AWS IAM and CloudTrail/CloudWatch monitoring.
    • Contributed to ISO 27001 compliance work.
    • Developed PyTorch anomaly-detection models.

  3. Sep 2023 – May 2025

    Co-President · UTMFCC

    • Led about 10 Python workshops for finance students.
    • 50+ students completed the 10-session series.

Education

Honours BSc, Computer Science & Mathematics · University of Toronto Mississauga

Graduated August 2026

Skills

Hover a skill to highlight the projects that used it.

Cloud
AWS Lambda · API Gateway · ECS Fargate · RDS · DynamoDB · EventBridge · SNS · Cognito · IAM · CloudFront · S3 · Amplify · CloudWatch / CloudTrail · Secrets Manager · GCP · Azure
Infra & DevOps
Terraform · Docker · Kubernetes · GitHub Actions · OIDC · Checkov · tflint
Languages
Python · TypeScript / JavaScript · Java · C / C++
Backend & data
FastAPI · PostgreSQL / pgvector · REST
AI / ML
LangChain · Hugging Face · ONNX Runtime · PyTorch · RAG

Let's talk

Hiring for cloud, DevOps, platform, or SRE work in the Greater Toronto Area? Email is the fastest way to reach me.