Case study / Client engagement, anonymized
Ransomware‑immune disaster recovery, built end to end with AI
A newly independent media production company had live production files spread across cloud systems, no disaster recovery, and a real ransomware threat model. I built the pipeline that protects them, working solo and directing Claude Code.
In production for the client- Multi-region AWS
- Immutable, versioned backups
- Built solo, directing AI
The engagement
Challenge
Live production files, no safety net, a real threat model
When the company was carved out to stand on its own, its production files lived across cloud systems with no disaster recovery and no protection against a ransomware actor encrypting or deleting them. Backups that can be overwritten are not backups against ransomware. The work could not pause while this was fixed.
Action
A hardened, monitored DR pipeline, shipped solo
I built a multi-region AWS disaster recovery pipeline end to end, directing Claude Code: Lambda-driven replication of live production files, versioned and immutable backups a ransomware actor cannot alter or delete, an isolated recovery vault, and monitoring with alarms. Alongside it, a full AI-assisted security audit hardening IAM, network, and storage.
Result
Protected in production, and the monitoring proved itself
Production files now replicate continuously into an isolated, immutable vault. The proof is not a claim: in operation, the monitoring surfaced a silent cross-account backup failure that had been failing quietly for weeks and would otherwise have gone unnoticed until it was needed. The system caught its own gap before it mattered.
How it is built
The architecture, in one line
Monitoring watches every hop with alarm-on-absence, the check that caught the silent failure.
- 01Replication. Event-driven Lambda copies live production files across regions as they change, not on a nightly cron that can silently stall.
- 02Immutability. Object versioning plus object lock, so a backup cannot be overwritten or deleted inside its retention window. This is the specific control that defeats ransomware.
- 03Isolation. The recovery vault lives in a separate, access-scoped account, so a compromise of production cannot reach the backups.
- 04Observability. Alarms fire on the absence of an expected replication, the failure mode most backup systems miss until recovery day.
- 05Hardening. An AI-assisted security audit across IAM, network, and storage, tightening the environment around the pipeline.
What it proves
I take a real operational risk in a client's own cloud and, working solo and directing AI, ship a hardened, monitored system into production, then build the observability that proves it actually works.
See the rest of the work →Client and infrastructure details are anonymized. A media production company; no names, account identifiers, or resource names are shown.