At Dev4Side Software since August 2026

Karim El Atfy

Cloud Engineer
Infrastructure and Security

I look after Microsoft Azure environments, identity and the security posture around them, at a Milan consultancy. Before that I spent nine months as the cloud and delivery half of a university-connected startup team, turning their product into an environment they could keep deploying to after I left.

See the work Curriculum GitHub LinkedIn

01 Work

Where I am now, and what came before

Aug 2026 – Present

Cloud Engineer

Dev4Side Software, Infrastructure and Security team · Milan, hybrid

Dev4Side Software is a Milan consultancy working exclusively on the Microsoft stack. My team looks after Azure environments, identity and access, networking, and the security posture around all of it, for large enterprise clients across several sectors.

My first months went to one global enterprise client: reconstructing an Azure estate grown by hand for years into a Bicep infrastructure as code baseline, then rebuilding the release lifecycle of the same client's MuleSoft integration estate. Both are written up as case studies below. Next up: user lifecycle automation for a multinational fresh-produce group.

Azure infrastructure

Environments, resources and services, migration support, and the governance of Microsoft cloud tenants.

Identity and access

Entra ID, role assignments, conditional access, privileged identity, and endpoint policy.

Networking

Address plans, segmentation, peering, and a considered answer to what is published to the internet.

Automation and delivery

PowerShell and the Microsoft Graph SDK, Azure DevOps pipelines, and infrastructure described in Bicep.

Dec 2025 – Aug 2026

Independent Cloud and DevOps Engineer

University-connected teams and early-stage initiatives · Milan

For nine months I was the cloud and delivery half of a university-connected team building an early-stage product, taking it from hand deploys to an environment they could keep deploying to. The shape of the work: infrastructure that can be rebuilt from what is written down, a pipeline in front of it, failure made visible, and enough documentation for the two founders to carry on without me, which they do.

The collaboration is written up below, sanitized and published with the team's agreement.

02 Projects

Two enterprise engagements, one collaboration, and six public repositories

The enterprise work is written up sanitized, under NDA constraints, with the client unnamed. Everything after it is personal and public, each repository built because the one before it was missing something.

Case study, under NDA

Brownfield Azure IaC baseline

A live enterprise Azure environment, grown through years of portal and provider driven change, had no code that described it. I reconstructed the real state into a modular Bicep baseline, with a delivery workflow designed around convergence, approvals and immutable artifacts.

Azure
Bicep
ARM
Azure DevOps
PowerShell

Read the case study

50+ resources analyzed
25+ resource types
40+ in the managed baseline
0 unintended What-If changes

Case study, under NDA

MuleSoft release lifecycle modernization

A legacy CI/CD workflow had drifted so far that the Git branches, the artifact feed, Anypoint Exchange and the documentation disagreed about what was released. I reverse engineered the live behavior and rebuilt the lifecycle around explicit states, fail-closed validation and one immutable artifact.

MuleSoft
Anypoint Exchange
Azure DevOps
CI/CD
SemVer

Read the case study

4 independent state sources
3 promotion environments
1 immutable artifact
Pilot validated to production

Case study

FlowLedger

An early-stage invoicing product was deploying by hand, and had just spent thirty five minutes broken without anyone noticing. I left the two founders a delivery setup they could keep running on their own: reproducible, gated by CI, and watched by alerts that map to something a customer would feel.

Docker Compose
GitLab CI
Jenkins
Prometheus
Grafana

Read the case study

The Grafana dashboard built for the team, showing uptime, request rate, error rate and latency

Public repository

AKS GitOps platform

An end to end AKS delivery platform: layered Terraform with remote state, Flux reconciliation, Helm packaging, workload identity, and secrets mounted rather than copied. A single node rollout failure here became an incident note and a decision record about deployment strategy.

Terraform
AKS
Flux
Helm
Checkov

Open on GitHub

Public repository

DevSecOps container platform

A containerised FastAPI service on Azure Container Apps through a three stack Terraform design. Deployment is secretless over OIDC, images are tagged by commit, runtime and deployment identities are kept apart, and no secret value reaches Terraform state.

Container Apps
OIDC
Key Vault
Trivy
OpenTelemetry

Open on GitHub

Four repositories

The Azure progression

Four repositories that step up one constraint at a time: a Linux virtual machine bootstrapped with cloud-init, then segmented two tier networking, then private compute reached through Bastion with secrets in Key Vault, then a load balanced platform with private ARM64 backends. Reading them in order is the clearest thing I can show about how I learn a domain.

Browse the repositories

01 Linux VM and cloud-init
02 Segmented two tier
03 Private compute and Bastion
04 Load balanced ARM64

03 Stack

What I actually reach for

Azure

Azure
Entra ID
Microsoft 365
Exchange Online
Azure Policy
Lighthouse
Container Apps
AKS

Infrastructure & systems

Bicep
Terraform
ARM
Ansible
cloud-init
Linux
Windows Server
Proxmox

Containers

Docker
Compose
Kubernetes
Helm
Flux

Delivery

Azure DevOps
GitHub Actions
GitLab CI
Jenkins

Security

Key Vault
Managed Identity
OIDC
Defender
Trivy
Checkov
Gitleaks

Observability

KQL
Azure Monitor
Log Analytics
Prometheus
Grafana
Loki
OpenTelemetry

Code and data

Python
FastAPI
PostgreSQL
MySQL
PowerShell
Bash

04 Learning

Studying alongside the job

Politecnico di Milano

Computer Engineering, BSc, in progress · Sep 2024 – Present

Software, mathematics, electronics and computer systems, taken in parallel with full time work. Before it, a scientific high school diploma from IIS Carlo Alberto Dalla Chiesa in Sesto Calende, finished at 96 out of 100.

Certifications

AZ-900 Microsoft Azure Fundamentals Earned
AZ-104 Microsoft Azure Administrator In preparation
CCNA Cisco Certified Network Associate Study track

Languages

Italian Sesto Calende, then Milan Native
English Working language, written and spoken C1
French Conversational B1
Spanish Basic A2
German, Hochdeutsch Started Beginner
Swiss German In progress, for the region next door Learning
Russian Started Beginner

05 About

Beyond the job description

What draws me to infrastructure is not the tooling. It is wanting to know why something broke, and being unsatisfied with an answer that only holds once.

I like systems you can take apart, explain to someone else, and put back together the same way tomorrow. That is most of what I do at work, and most of what I do on my own time with a subscription and a Terraform file. The same instinct runs the house: a small Proxmox lab with a VLAN-segmented network, a NAS, and Home Assistant keeping the lights honest.

I grew up in Sesto Calende, near Lake Maggiore, and I moved to Milan for the degree I am still finishing. Away from a keyboard I take photographs, follow motorsport and race in simulators, and read about aviation for no professional reason at all. Probably the same instinct: things that are built precisely, and fail interestingly.

Photography
Motorsport
Simulators
Aviation

Community

Furizon APS

Administrative and accounting support for a non-profit of around five hundred members that runs two events a year: member records, invoices, reimbursements, reconciliation, and the data behind the annual report. Since September 2025.

Earlier

Before the cloud

Five months of retail operations at Libraccio, handling orders, delivery notes and stock records, and a short data quality internship at Whirlpool. Neither was engineering. Both taught me what happens when records and reality disagree.

Get in touch

Contact

Email is the fastest way to reach me, and I read all of it.

karim.elatfy2005@gmail.com