Hieu is available for hire
Hire HieuHieu Pham
Verified Expert in Engineering
DevOps Engineer and Developer
Toronto, ON, Canada
Toptal member since April 22, 2020
Bio
Hieu is an Azure and AWS-certified DevOps Engineer and Architect with 20+ years of experience across insurance, healthcare, startup, financial services, government, and telecommunications. He designs cloud environments on Azure, AWS, and GCP using infrastructure-as-code with Terraform. He has expertise in container technologies, including Kubernetes and OpenShift, as well as Linux and Windows platforms. Hieu has architecture skills, security knowledge, and experience adopting Agile processes.
Portfolio
Employment and Social Development Canada (ESDC)
Azure, Azure DevOps, Azure Application Gateway, Azure Front Door...
Intact Insurance
Databricks, Snowflake, Terraform, Python 3, Python, Amazon S3 (AWS S3)...
MindBeacon
Azure, Terraform, Azure DevOps, Git, Kubernetes, Azure Kubernetes Service (AKS)...
Experience
- Azure Kubernetes Service (AKS) - 10 years
- Python - 10 years
- Azure - 10 years
- DevOps - 10 years
- Kubernetes - 8 years
- Azure DevOps - 5 years
- Terraform - 5 years
- Go - 3 years
Work Experience
Senior DevOps Architect
2024 - 2026
Employment and Social Development Canada (ESDC)
- Designed and deployed enterprise cloud solutions on Azure and AWS for the Curam project, establishing a comprehensive DevOps governance framework covering processes, practices, patterns, and standards to guide cloud adoption across the program.
- Architected Azure landing zone components using Hub/Spoke topology and services: Kubernetes, Application Gateway, API Management, FrontDoor, App Service, ARO (OpenShift), Container Apps, VM, PostgreSQL, SQL, DNS Zones, Firewall, and Load Balancer.
- Built and standardized Azure DevOps CI/CD pipelines using reusable YAML templates, release pipelines, and self-hosted agent configurations, enabling consistent automated delivery across multiple application teams.
- Developed and maintained all cloud infrastructure as code (IaC) using Terraform and Ansible, ensuring repeatable, auditable, and drift-free deployments across all environments.
- Hardened cloud environments to meet Government of Canada Protected B security requirements by integrating AquaSec, SonarQube, and Nexus IQ into CI/CD pipelines, achieving compliance with CIS Benchmarks and NIST security frameworks.
- Served as subject matter expert (SME) on Azure platform capabilities. Provided architectural guidance and mentorship to cross-functional teams on cloud-native patterns, DevOps tooling, and security best practices.
- Identified and documented cloud infrastructure security risks and proposed mitigating controls aligned with federal security compliance standards.
Technologies: Azure, Azure DevOps, Azure Application Gateway, Azure Front Door, Infrastructure as Code (IaC), CI/CD Pipelines, Containerization, Scripting, Disaster Recovery (DR), DevOps, Disaster Recovery Automation, GitOps, Kubernetes HorizontalPodAutoscaler (HPA), Role-based Access Control (RBAC), Microsoft Azure, Azure IaaS, Azure PaaS, Azure Cloud Security, Azure Monitor, VPN, Azure Virtual Network (VNet), Microsoft Entra ID, Azure Active Directory, Azure Kubernetes Service (AKS), Amazon Web Services (AWS), AWS DevOps
Senior DevOps AI/ML Engineer
2022 - 2024
Intact Insurance
- Supported the artificial intelligence/machine learning team by provisioning and maintaining Databricks clusters, Snowflake, AWS Lambdas, Amazon S3, and AWS IAM using Terraform (IaC), GitHub Actions/workflows, and Jenkins CI/CD pipelines.
- Managed Amazon EKS and on-prem OpenShift clusters for Private AI workloads, ensuring 99.9% uptime and optimizing resource utilization to support concurrent high-performance AI computations.
- Maintained CI/CD pipelines, ensuring proper security scanning in place (Prisma and SonarQube for DAST and SAST, OWASP) and linting/gating (Chekhov).
- Managed Azure SQL, Snowflake, Azure Storage Accounts (ADLS Gen 2), Azure Function Apps and Web Apps, Azure Event Grid, and MongoDB database upgrades and migration.
- Automated key rotation, maintenance, and cleanup processes using Python, Bash, and PowerShell in Azure DevOps and Jenkins, saving countless hours of manual engineering per month.
- Deployed highly available, multi-region, and zone SQL servers on the cloud using a failover group.
- Mentored more junior members of the core and cross-functional teams. As a senior member, I also participated and presented at the company's weekly lunch and learned interesting technical topics.
- Wrote detailed technical documentation for new technologies and processes for the core team.
- Participated in weekly syncs with other business units and stakeholders on the status of ongoing projects and initiatives.
Technologies: Databricks, Snowflake, Terraform, Python 3, Python, Amazon S3 (AWS S3), AWS Lambda, Amazon EKS, Jenkins, OpenShift, Prisma, Bash, Kubernetes, Networks, Application Security, Grafana, Infrastructure as Code (IaC), Cluster, DevOps Engineer, CI/CD Pipelines, GitHub, Google Cloud Platform (GCP), Azure Databricks, VPN, AWS DevOps
Principal DevOps Engineer
2020 - 2022
MindBeacon
- Directed the cloud engineering infrastructure team through a period of hyper-growth, ensuring a scalable and compliant architecture that culminated in a successful company IPO in December 2021.
- Architected and secured highly available, multi-region Kubernetes (AKS/GKE) clusters across Azure and GCP, achieving 99.99 uptime and seamless scalability for thousands of concurrent users.
- Formulated comprehensive capacity planning and disaster recovery strategies for Azure cloud resources, minimizing potential downtime and establishing strict RTO/RPO objectives of under 2 hours.
- Migrated legacy in-house CI/CD to Azure DevOps pipelines, leveraging Azure Key Vault, HashiCorp Vault, and Consul to streamline deployments and reduce release times by 50%.
- Spearheaded the adoption of 100% Infrastructure as Code (IaC) on Azure using Terraform, eliminating configuration drift and reducing manual provisioning time significantly.
- Shifted security left by embedding container scanning (DAST) and SonarCloud code analysis (SAST) directly into CI/CD pipelines, proactively mitigating vulnerabilities before production releases.
- Hardened the enterprise security posture to align with stringent healthcare compliance (SOC 2) by implementing private endpoints, strong encryption, RBAC, and MFA across all cloud resources.
- Deployed Azure Front Door with WAF and Microsoft Sentinel SIEM, alongside a comprehensive observability stack (Grafana, Prometheus, ELK) to decrease incident response times.
- Refactored Azure infrastructure to strictly align with Microsoft best practices, utilizing Availability Zones, PIM, MITRE ATT&CK frameworks, and CIS benchmarks to ensure robust resilience.
- Engineered scalable Azure Machine Learning infrastructure, including Databricks and Data Factory, automating environments with Terraform to accelerate data science initiatives and model training.
Technologies: Azure, Terraform, Azure DevOps, Git, Kubernetes, Azure Kubernetes Service (AKS), Rancher, Helm, Amazon, Amazon EKS, OpenShift, Bash, Networks, Application Security, Grafana, Infrastructure as Code (IaC), SOC 2, Cluster, Architecture, DevOps Engineer, CI/CD Pipelines, GitHub, MITRE ATT&CK, Microsoft Azure, Azure IaaS, Azure PaaS, Azure Cloud Security, Azure Monitor, VPN, Azure Virtual Network (VNet), Microsoft Entra ID, Azure Active Directory, Observability
Senior DevOps Engineer
2018 - 2020
Canada Life
- Provided highly available Azure Kubernetes and OpenShift clusters, both on-premises and cloud environments, to the digital hub agile teams, serving millions of customers in Canada and Europe.
- Configured Istio, Envoy, and Jaeger for service mesh on Kubernetes on both on-prem and Azure and Google Cloud.
- Created and maintained Dockerfile to produce lean, secure Docker images along with Kubernetes manifests and Helm charts and templates.
- Secured cloud infrastructure by maintaining and applying Calico and Kubernetes network policies, enforcing secrets with Hashicorp Vault, and security hardening with Prisma Cloud and Twistlock.
- Implemented security protocol and process compliant with the company’s enterprise ISOC team; set up North-South and West-East Azure Firewall and Network Security Group; implemented a local DNS server for proper Azure Private Endpoint DNS resolution.
- Implemented Azure Databricks (Apache Spark), Data Factory, Azure KeyVault, and Azure Storage on the cloud securely using private endpoints and private links.
- Managed continuous integration, continuous delivery, and release management pipelines to the development teams using the Atlassian Suite, Harness.io, Azure DevOps, Jenkins, Twistlock and Prisma Cloud, Hashicorp Vault, and SonarQube.
- Took on the role of site reliability engineer (SRE) to ensure 24/7 operations, using Prometheus, various exporters (cAdvisor, MongoDB, Actuator, and Node.js), Grafana, AppDynamics, PagerDuty, and Splunk.
- Provided third-level support software stack comprising Spring Boot, Java, AngularJS, MongoDB, Go, and Node.js.
Technologies: Prometheus, Python, Jira, Git, Jenkins, Ansible, Vault, Terraform, Kubernetes, Docker, Azure, Azure DevOps, Azure Kubernetes Service (AKS), Google Cloud Platform (GCP), Bash, Networks, Application Security, Grafana, Infrastructure as Code (IaC), Rancher, Cluster, DevOps Engineer, CI/CD Pipelines, GitHub, Orchestration, Packer, GitLab, GitLab CI/CD, Kubernetes HorizontalPodAutoscaler (HPA), Microsoft Azure, Azure IaaS, Azure PaaS, Azure Cloud Security, Azure Monitor, VPN, Datadog, Observability
Cloud DevOps Migration Engineer
2016 - 2018
Road User Safety | Ministry of Transportation
- Rolled out OpenShift and Kubernetes clusters on Azure Cloud using Terraform as infrastructure as code.
- Created a tool that can create sophisticated WebLogic domains from YAML definitions with Go. Turned a 1-2 day process into as short as 15 minutes.
- Participated in a multi-million dollar cloud migration project for the Ministry.
- Performed Azure Cloud migration of Siebel/OCH, Oracle LDAP directory, WebLogic, Websphere, BPM, BIP, OPA, EDQ, Oracle Database, and Oracle POS software stack from Solaris/AIX to Red Hat Enterprise Linux 6/7.
- Performed systems and O/S optimization (JVM, Database, Jakarta EE tuning, and profiling), network tuning, and troubleshooting (e.g., load balancing and clustering) by analyzing network capture with Wireshark.
- Developed in-house solutions with Prometheus to monitor Java, predict failure, and send alerts.
- Acted as a tier-3 technical lead and SRE for middleware incident escalation on high availability (24/7). Secured production environments that directly affected public safety (e.g., license lookup service for law enforcement).
Technologies: OpenShift, Docker, Kubernetes, Go, Python, WebSphere, WebLogic, Ansible, Terraform, DevOps, Azure, Bash, Networks, Application Security, Infrastructure as Code (IaC), Cluster, DevOps Engineer, CI/CD Pipelines, GitHub, Microsoft Azure, Azure IaaS, Azure PaaS, Azure Monitor, Observability
Senior System Administrator
2010 - 2016
Carrier Modernization Project | Ministry of Transportation
- Led, as a senior DevOps and lead consultant, a billion-dollar, multi-year project to modernize the Ontario IT systems that deliver carrier, driver, and vehicle services.
- Participated in the migration of over 150 Linux, Solaris, and Windows servers and enterprise COTS which include Siebel CRM, Oracle Customer Hub, Informatica, Oracle LDAP, IBM Business Process Manager, Oracle E-Business Suite, WebSphere, and WebLogic.
- Performed systems and O/S optimization (JVM, Database, J2EE tuning and profiling), network tuning and troubleshooting (e.g. load balancing and clustering) by analyzing network captures with WireShark.
- Automated day-to-day tasks such as deployment to logs management with Bash/Korn shell and Python scripting.
- Worked closely with scrum masters (Kanban, Trello), developers, DBAs, project managers, and architects to provide support throughout the entire application agile release cycles (development to production turnover).
- Developed numerous in-house solutions to streamline and automate Middleware deployments on WebLogic and Websphere using BASH shell, Go and Python scripting to facility larger-scale infrastructure rollouts.
- Administered multi-tier solutions comprising Microsoft Dynamics CRM, WebLogic, Websphere, Tomcat, Apache Webserver, MQ series, HP Openview, Informatica, Cognos, Webfocus and Mainframe DB2, UAG, TMG, SCOM, Hyper-V, and IIS.
- Optimized Apache HTTP server, WebLogic/Websphere J2EE servers for greater performance with profiling and tuning JVM memory usage and settings, threads and workers, JDBC data pool size, and JMS queues.
Technologies: Agile, Linux, Windows, Windows PowerShell, Python, Ansible, Jenkins, Java, WebLogic, WebSphere, Oracle, LDAP, Siebel, Bash, Networks, Application Security, Infrastructure as Code (IaC), Cluster
Project History
WebLogic Domain Creator
A Go-based application for creating and automating the WebLogic domain. I was the sole developer of this application. The tool allows the creation of full, sophisticated WebLogic domains from YAML definitions (database, JMS, etc.). This tool allows a domain to be created from code that enables speed, simplicity, consistency, risk mitigation (i.e., human error), and is repeatable.
Cloud Migration
I was on the cloud core team, responsible for migrating Linux (Red Hat) and Windows servers, on-prem Kubernetes clusters, and Docker containers (Swarm and Docker EE) to Azure using Terraform and Packer.
Automated CI/CD Pipelines on Azure DevOps Cloud
I designed and maintained dozens of CI/CD pipelines on Azure DevOps, responsible for building the source code, creating Docker containers, and Helm charts for production deployment. Incorporated code scanning with SonarCloud and Docker image scanning with Harbor and Aquasec.
Certifications
APRIL 2026 - APRIL 2029
AWS Solutions Architect Associate
Amazon Web Services (AWS)
APRIL 2026 - PRESENT
Microsoft Certified: Azure Solutions Architect Expert (AZ-305)
Microsoft
APRIL 2026 - PRESENT
Microsoft Certified: Azure Administrator Associate (AZ-104)
Microsoft
APRIL 2008 - PRESENT
Networking and Internet Engineering
HiTech Institute
Skills
Tools
Azure Kubernetes Service (AKS), Grafana, Terraform, Ansible, Shell, Apache Tomcat, Cluster, GitHub, Azure Monitor, VPN, Splunk, Elastic, Vault, Hyper-V, Istio, Jira, Bamboo, Git, Jenkins, Helm, Docker Swarm, Packer, Puppet, Google Kubernetes Engine (GKE), Amazon EKS, Prisma, Azure Application Gateway, Kubernetes HorizontalPodAutoscaler (HPA), GitLab, GitLab CI/CD
Languages
Python, Go, Bash, Java, Snowflake, Python 3
Paradigms
DevOps, Agile, Scrum, Continuous Deployment, Continuous Delivery (CD), Continuous Integration (CI), Azure DevOps, Role-based Access Control (RBAC)
Platforms
Rancher, Kubernetes, Docker, Linux, Windows, Azure, Amazon Web Services (AWS), Azure IaaS, Azure PaaS, WebSphere, KVM, Xen, Google Cloud Platform (GCP), OpenShift, OpenStack, Icinga, Oracle, AWS IoT, Amazon, Databricks, AWS Lambda
Storage
Microsoft Entra ID, Azure Active Directory, MongoDB, PostgreSQL, Datadog, Google Cloud, Amazon S3 (AWS S3)
Frameworks
Windows PowerShell
Other
CI/CD Pipelines, Prometheus, WebLogic, Transport Layer Security (TLS), IT Networking, SSL, Infrastructure as Code (IaC), Networks, Application Security, Architecture, DevOps Engineer, Orchestration, Microsoft Azure, Azure Cloud Security, Azure Virtual Network (VNet), AWS DevOps, Content Delivery Networks (CDN), VMware ESXi, SOC 2, Azure Databricks, Observability, Consul, Containerization, LDAP, System Administration, Siebel, MITRE ATT&CK, Storage, Virtual Networking Implementation and Management, Cloud Architecture, AWS Cloud Architecture, Cloud Infrastructure, Azure Front Door, Scripting, Disaster Recovery (DR), Disaster Recovery Automation, GitOps
Collaboration That Works
How to Work with Toptal
Toptal matches you directly with global industry experts from our network in hours—not weeks or months.
1
Share your needs
Discuss your requirements and refine your scope in a call with a Toptal domain expert.
2
Choose your talent
Get a short list of expertly matched talent within 24 hours to review, interview, and choose from.
3
Start your risk-free talent trial
Work with your chosen talent on a trial basis for up to two weeks. Pay only if you decide to hire them.
Top talent is in high demand.
Start hiring