Karim El Atfy
GitHub CV

At Dev4Side Software since August 2026

Karim El Atfy

Cloud Engineer
Infrastructure and Security

I look after Microsoft Azure environments, identity and the security posture around them, at a Milan consultancy. Before that I spent nine months as the cloud and delivery half of a university-connected startup team, turning their product into an environment they could keep deploying to after I left.

See the work Curriculum GitHub LinkedIn
Karim El Atfy

01 Work

Where I am now, and what came before

Aug 2026 – Present

Cloud Engineer

Dev4Side Software, Infrastructure and Security team · Milan, hybrid

Dev4Side Software is a Milan consultancy working exclusively on the Microsoft stack. My team looks after Azure environments, identity and access, networking, and the security posture around all of it, for enterprise clients across luxury, transport, shipping and the public sector.

In my first month I brought the Azure estate of a global luxury goods group, grown by hand for years, under Bicep infrastructure as code: about fifty resources across three environments, normalized end to end, with the complete Azure DevOps deployment pipeline built around it. Next up: user lifecycle automation for a multinational fresh-produce group.

Azure infrastructure

Environments, resources and services, migration support, and the governance of Microsoft cloud tenants.

Identity and access

Entra ID, role assignments, conditional access, privileged identity, and endpoint policy.

Networking

Address plans, segmentation, peering, and a considered answer to what is published to the internet.

Automation and delivery

PowerShell and the Microsoft Graph SDK, Azure DevOps pipelines, and infrastructure described in Bicep.

Dec 2025 – Aug 2026

Independent Cloud and DevOps Engineer

University-connected teams and early-stage initiatives · Milan

For nine months I was the cloud and delivery half of a university-connected team building an early-stage product, taking it from hand deploys to an environment they could keep deploying to. The shape of the work: infrastructure that can be rebuilt from what is written down, a pipeline in front of it, failure made visible, and enough documentation for the two founders to carry on without me, which they do.

The collaboration is written up below, sanitized and published with the team's agreement.

02 Projects

One collaboration, and six public repositories

Each of these was built because the one before it was missing something. They are all public, and they are all Terraform first.

Case study

FlowLedger

An early-stage invoicing product was deploying by hand, and had just spent thirty five minutes broken without anyone noticing. I left the two founders a delivery setup they could keep running on their own: reproducible, gated by CI, and watched by alerts that map to something a customer would feel.

  • Docker Compose
  • GitLab CI
  • Jenkins
  • Prometheus
  • Grafana

Read the case study

The Grafana dashboard built for the team, showing uptime, request rate, error rate and latency

Public repository

AKS GitOps platform

An end to end AKS delivery platform: layered Terraform with remote state, Flux reconciliation, Helm packaging, workload identity, and secrets mounted rather than copied. A single node rollout failure here became an incident note and a decision record about deployment strategy.

  • Terraform
  • AKS
  • Flux
  • Helm
  • Checkov

Open on GitHub

Public repository

DevSecOps container platform

A containerised FastAPI service on Azure Container Apps through a three stack Terraform design. Deployment is secretless over OIDC, images are tagged by commit, runtime and deployment identities are kept apart, and no secret value reaches Terraform state.

  • Container Apps
  • OIDC
  • Key Vault
  • Trivy
  • OpenTelemetry

Open on GitHub

Four repositories

The Azure progression

Four repositories that step up one constraint at a time: a Linux virtual machine bootstrapped with cloud-init, then segmented two tier networking, then private compute reached through Bastion with secrets in Key Vault, then a load balanced platform with private ARM64 backends. Reading them in order is the clearest thing I can show about how I learn a domain.

Browse the repositories

  • 01 Linux VM and cloud-init
  • 02 Segmented two tier
  • 03 Private compute and Bastion
  • 04 Load balanced ARM64

03 Stack

What I actually reach for

Azure

  • Azure
  • Entra ID
  • Microsoft 365
  • Exchange Online
  • Azure Policy
  • Lighthouse
  • Container Apps
  • AKS

Infrastructure & systems

  • Bicep
  • Terraform
  • ARM
  • Ansible
  • cloud-init
  • Linux
  • Windows Server
  • Proxmox

Containers

  • Docker
  • Compose
  • Kubernetes
  • Helm
  • Flux

Delivery

  • Azure DevOps
  • GitHub Actions
  • GitLab CI
  • Jenkins

Security

  • Key Vault
  • Managed Identity
  • OIDC
  • Defender
  • Trivy
  • Checkov
  • Gitleaks

Observability

  • KQL
  • Azure Monitor
  • Log Analytics
  • Prometheus
  • Grafana
  • Loki
  • OpenTelemetry

Code and data

  • Python
  • FastAPI
  • PostgreSQL
  • MySQL
  • PowerShell
  • Bash

04 Learning

Studying alongside the job

Politecnico di Milano

Computer Engineering, BSc, in progress · Sep 2024 – Present

Software, mathematics, electronics and computer systems, taken in parallel with full time work. Before it, a scientific high school diploma from IIS Carlo Alberto Dalla Chiesa in Sesto Calende, finished at 96 out of 100.

Certifications

  • AZ-900 Microsoft Azure Fundamentals Earned
  • AZ-104 Microsoft Azure Administrator In preparation
  • CCNA Cisco Certified Network Associate Study track

Languages

  • Italian Sesto Calende, then Milan Native
  • English Working language, written and spoken C1
  • French Conversational B1
  • Spanish Basic A2
  • German, Hochdeutsch Started Beginner
  • Swiss German In progress, for the region next door Learning
  • Russian Started Beginner

05 About

Beyond the job description

What draws me to infrastructure is not the tooling. It is wanting to know why something broke, and being unsatisfied with an answer that only holds once.

I like systems you can take apart, explain to someone else, and put back together the same way tomorrow. That is most of what I do at work, and most of what I do on my own time with a subscription and a Terraform file. The same instinct runs the house: a small Proxmox lab with a VLAN-segmented network, a NAS, and Home Assistant keeping the lights honest.

I grew up in Sesto Calende, near Lake Maggiore, and I moved to Milan for the degree I am still finishing. Away from a keyboard I take photographs, follow motorsport and race in simulators, and read about aviation for no professional reason at all. Probably the same instinct: things that are built precisely, and fail interestingly.

  • Photography
  • Motorsport
  • Simulators
  • Aviation

Community

Furizon APS

Administrative and accounting support for a non-profit of around five hundred members that runs two events a year: member records, invoices, reimbursements, reconciliation, and the data behind the annual report. Since September 2025.

Earlier

Before the cloud

Five months of retail operations at Libraccio, handling orders, delivery notes and stock records, and a short data quality internship at Whirlpool. Neither was engineering. Both taught me what happens when records and reality disagree.

Get in touch

Contact

Email is the fastest way to reach me, and I read all of it.

karim.elatfy2005@gmail.com