Scanning that produces a report is advisory. Scanning that blocks a merge is a control. This turns the second one on — along with the pipeline, infrastructure code and cluster configuration that make it stick.

Scope call: what exists, what's missing, and what has to keep shipping while we work.

Build against a branch so nothing breaks while it's in progress.

Wire in the controls — dependency and action pinning, SAST, dependency scanning and secret detection as gates, SBOM per build, keyless cloud authentication, least-privilege pipeline permissions.

Terraform baseline where infrastructure isn't yet in code — imported from what's running, not rebuilt.

Run it end to end together including a deliberate rollback, then hand over.

Working pipeline — Build, test, scan and deploy across your environments, with promotion between them.

Enforced security gates — SAST, dependency scanning and secret detection, tuned so they block what matters and don't cry wolf.

Supply-chain controls — Pinned dependencies and actions, provenance, and an SBOM per build.

Keyless authentication — OIDC to your cloud. No long-lived credentials sitting in CI.

Terraform baseline — Modular, remote state with locking, and plan review before anything applies.

Runbook — How it works, how to change it, and what to do when it fails at 2am.

Repository access and permission to add workflows

Cloud account access, or someone who can grant it

A view on how strict the gates should be at the start

Handover is always included. You keep the code, the documentation and the runbooks — the point is that your team can operate this without me.

I work across GCP, AWS and Azure, and most of my recent work has been in regulated fintech, so compliance-shaped requirements (SAMA CSF, PCI-DSS, SOC 2, ISO 27001) are familiar rather than an add-on.