Reliability engineering
SLOs that mean something, alerting that fires before customers notice, and recovery that's rehearsed instead of improvised.
- SLOs/SLIs for 20+ critical services
- 40% faster incident detection
- DR playbooks with a 2-hour RTO
Senior DevSecOps Engineer · AWS · Azure · GCP
Infrastructure that holds up — under load, and under audit.
8+ years keeping payment infrastructure at 99.9% availability across three clouds, and passing every compliance audit along the way.
- EmployerGlobal PaymentsNYSE: GPN · 13 years
- RecognitionCircle of ExcellenceCompany award · 2020
- CertifiedAzure AdministratorMicrosoft Associate
- EnvironmentPCI DSSRegulated payments
- EducationM.S., UT DallasIT Management
- Open source13 projectsRead the code ↗
99.9%
availability held across 20+ critical services
75%
faster provisioning through reusable Terraform modules
65%
faster recovery from automated DR runbooks, 2-hour RTO
100%
compliance across 3 straight audit cycles
03 What I do
Reliable and secure are the same job.
Most teams treat uptime, security, and compliance as three separate problems. I build them into the same Terraform, the same pipelines, and the same alerts.
Shift-left security
Security scanning and secrets management built into CI/CD, so problems are caught at the pull request, not in production.
- 40+ security controls in IaC pipelines
- Hardcoded credentials eliminated
- Snyk, Wiz, and HashiCorp Vault
Compliance as code
Policy-as-code Terraform modules for PCI DSS environments, so audit evidence is a by-product of shipping, not a yearly scramble.
- 100% compliance, 3 audit cycles running
- 75% faster provisioning
- 500+ endpoints under continuous monitoring
04 Selected work
The patterns I run in production, open-sourced.
Each one comes from the portfolio repository, with the code there to read.
pipeline
✓ passed
DevSecOps Security Pipeline
- Problem
- Security checks that run too late, after insecure code is already on its way out.
- Approach
- A four-gate GitHub Actions pipeline: secrets, SAST and dependencies, containers, then IaC policy.
- Result
- Insecure code is stopped before it reaches production.
pipeline
✓ passed
PCI DSS Compliance-as-Code
- Problem
- Audit evidence scrambled together once a year.
- Approach
- Checkov and OPA/Conftest checks mapped to PCI DSS v4.0 controls, wired into CI/CD.
- Result
- Audit evidence generated on every push.
signal path
✓ healthy
Observability Stack
- Problem
- Customers finding problems before the monitoring does.
- Approach
- A fully instrumented Flask service with Prometheus metrics and Grafana alerting tied to SLO thresholds.
- Result
- The same alerting pattern I run in production.
05 A note from Mustafa
Why I build it this way.
I didn't start in engineering. I started on a retail floor, running a 20-person team at Best Buy, and in 2013 I took a technical support job at Global Payments.
Over the next thirteen years I moved through account management, data analysis and DevOps before landing in DevSecOps. Every step started with someone trusting me with more than my title.
That path shapes how I work. I've been the person on the phone when a system goes down, so I build infrastructure that keeps anyone from sitting in that seat. And I treat audit evidence as something the pipeline should produce, not something a team scrambles for once a year.
06 Career path
One company, five roles.
From the support desk to senior DevSecOps. Every promotion came from the trust built in the role before it.
13years
v5 · current · at Global Payments since Feb 2013
Senior DevSecOps Engineer
Global Payments · Dallas, TX
- Defined and enforced SLOs/SLIs for 20+ critical services across AWS, Azure, and GCP, holding 99.9% availability.
- Led incident detection and root-cause analysis for a high-throughput production platform, cutting mean time to detect by 40%.
- Engineered reusable, policy-as-code Terraform modules that cut deployment cycle time by 75%.
- Built disaster recovery playbooks with a 2-hour RTO, cutting mean time to recover by 65%.
- Embedded security scanning and secrets management into CI/CD, eliminating hardcoded credentials across every environment.
- Mentored four junior engineers: one internal promotion, 30% faster onboarding for new hires.
v4
DevOps Engineer
Global Payments
v3
Data Analyst
Global Payments
v2
Account Manager
Global Payments
v1 · 2013
Technical Support Representative
Global Payments
earlier · 2005 — 2013
Operations Manager
Best Buy · Hammond, LA. Ran a 20-person team at a $10M+ location and lifted customer satisfaction 18%.
07 Stack
Tools I run in production.
08 Credentials
Certified, educated, recognized.
Certifications
- Microsoft Certified: Azure Administrator Associate
- Microsoft Azure Fundamentals
- Google Cloud Foundational
- SAS Institute Graduate CertificateBusiness Intelligence & Data Mining
Education
- M.S., Information Technology ManagementUniversity of Texas at Dallas · 2018
- B.A., Mass CommunicationLouisiana State University · 2010
2020 Company Award
"Recognized for building resilient, observable infrastructure at scale."
Circle of Excellence · Global Payments
09 Answers
Questions hiring teams ask me.
The honest answers, before you have to ask.
Thirteen years at one company. Can you adapt somewhere new?
It's been five different jobs, not one. Each role brought new tools, new teams and new stakeholders: support, accounts, data, DevOps, then DevSecOps. The infrastructure itself spans AWS, Azure and GCP, so I'm used to working across platforms rather than inside one.
Are the numbers on this page real?
Yes. They come from production systems at Global Payments, and they match my résumé. Pick any one and I'll walk you through how it was measured and what changed to move it.
Are you hands-on, or do you mostly manage?
Hands-on. I write the Terraform modules, build the pipelines and work the incidents. The portfolio repository has 13 projects you can read today. I've also mentored four junior engineers, so I can lead without leaving the keyboard.
Can you work in a regulated environment?
It's the environment I work in now: PCI DSS payment infrastructure, with compliance held across three straight audit cycles. Compliance-as-code is one of the public projects.
Your degree is in mass communication. Is the technical foundation there?
I followed the B.A. from LSU with an M.S. in Information Technology Management from UT Dallas, Microsoft and Google Cloud certifications, and years of production work on top. The communication background shows up in clear runbooks and incident write-ups.
How quickly can we talk?
Within one business day. Email is fastest; LinkedIn works too.
Accepting conversations
Need someone who's already done this at payment scale?
Let's talk. Send a role, a problem, or just a hello.
- A reply within one business dayEmail or LinkedIn, either works.
- Every number, explainedAsk about any metric and I'll show how it was measured.
- Work you can check firstThe code is public. Read it before we talk.