Improve Cloud Security & Compliance
Practical, enforceable security for your AWS or Azure accounts: fewer passwords and keys to leak, and a clear list of what to fix first.
Shane Schlabach · AWS Solutions Architect – Professional · 12+ years in AWS & Azure · Remote across the US
Overview
I focus on structural security improvements over reactive ones: locking down the root account, enforcing Multi-Factor Authentication (MFA), applying least-privilege IAM, and turning on encryption defaults once at the account or subscription level, instead of configuring each resource individually after deployment.
The same principle applies to how people and services actually authenticate. Passwords and long-lived credentials are among the easiest things to leak, forget to rotate, or leave behind when someone leaves or changes roles, so I move accounts toward identity-based access instead: managed identities, IAM roles, and Entra-based login that eliminate that category of risk.
An audit only matters if it produces something you can act on. I deliver specific, prioritized findings tied to real risk, not a generic checklist, along with a remediation plan to close each gap without breaking anything currently in production.
Selected work
Examples from enterprise production environments I've led. Client names are kept private.
Import live AWS services into Terraform
- Problem
- Production AWS infrastructure had been built and modified by hand, making it hard to review, reproduce, or hand off.
- What I did
- Imported the live environment into Terraform, organized it into reusable modules, added Checkov security scanning, and rolled out AWS best-practice settings, including encryption, tighter access controls, and logging.
- Result
- Every infrastructure change and new service now goes through version-controlled code: reviewable, repeatable, and easy to hand off.
Deploy a SaaS platform on Azure with Bicep
- Problem
- A SaaS product needed its Azure services (App Service web apps, Function Apps, Azure SQL, Storage, and Key Vault) deployed consistently and securely.
- What I did
- Defined everything in Bicep, with managed identities for app access, RBAC role assignments alongside the resources, and secrets centralized in Key Vault.
- Result
- The proof of concept moved to production with VNet integration and private endpoints through reviewed template changes, not a manual rebuild, and every environment deploys the same way.
How engagements work
Every engagement starts with a free, no-obligation conversation. Project work is $150/hour with scope agreed up front, or ongoing care as a monthly managed service.
- 1
Discovery
What you run today, where it hurts, and what “done” looks like.
- 2
Plan
A written roadmap: options, sequence, and what I would touch first.
- 3
Build
Infrastructure, automation, and security — as code, in your accounts.
- 4
Support
Monitor, patch, and keep changing it as the workload changes.
Common questions
Who will I be working with?
Me, Shane Schlabach. The person on the first call is the person doing the work. There are no account managers and no handoffs to junior staff.
How much does it cost?
Project work is $150/hour, with scope and a plan agreed before work starts. Managed service starts at $2,000/month and is scoped after a review of your environment.
Do you work with companies outside Ohio?
Yes. I'm based in Cincinnati, Ohio and work remotely with teams across the United States.
Who owns the code and documentation?
You do. Everything is built in your own AWS or Azure accounts and source control, with handoff documentation so your team can run it without me.
How do we get started?
Use the form below to send a few sentences about where things stand. I reply within one business day, and the first conversation is free with no obligation.