Kenneth Tafadzwa
Zendera

Multi-provider payment orchestration API for African rails — M-Pesa, Flutterwave, Paystack, Stripe. Double-entry ledger, payment routing/split/payout engine, reconciliation, idempotency and rate-limiting middleware, webhook signature verification, and a published-style TypeScript SDK.

Multi-account AWS audit platform. Ten security, cost, and optimization scans executed through cross-account IAM role assumption — deployable via CloudFormation, orchestrated by an async FastAPI backend, surfaced in a React dashboard.

Conversational AI across chat and voice channels — Python Lambda adapters, Amazon Connect with Nova Sonic, Bedrock inference, Comprehend language detection, DynamoDB session state. Fully Terraform-deployed and verified live in AWS.

Six years of multi-client AWS delivery distilled into 100+ production operational scripts — security baselines, Control Tower control governance, org-wide audits, CloudWatch alarm lifecycle, account migrations between Organizations, and recurring cost reporting. Every mutating script is dry-run-first; all fan out across accounts via STS assume-role with org auto-discovery and drift guards.

Monthly multi-account AWS cost reporting, run straight from the payer account — Cost Explorer queried directly with no role assumption into member accounts, Organizations auto-discovery, tag-based account inclusion, and six-month trend reporting. Built as a 750-line CLI tool with profile and instance-role run modes.

Self-managed GitLab in Docker kept going down with 502s — a cron log-rotation race was SIGKILLing Postgres mid-checkpoint. Root-caused from container logs, then hardened: safe in-place log truncation, container stop-timeouts, rotation ordering, and a dry-run/apply tool with post-change validation.

EU AI Act audit-ready evidence collection for AI agent deployments. Cryptographically signed audit trails, real-time OPA policy evaluation, and PDF reports you can hand to a regulator. Python SDK + MCP integration.

Reusable module enabling Security Hub (CIS + FSBP), GuardDuty, Config with managed rules, multi-region CloudTrail with KMS, and IAM Access Analyzer — all in one apply.

Private, VPC-endpointed Amazon Bedrock with Guardrails, Knowledge Base, and CloudWatch monitoring. Every resource annotated to the ISO 42001 control it satisfies.

Self-healing CloudWatch Agent deployment via SSM State Manager. ASG-dimensioned alarms that survive instance replacement — fixes the two most common ways this is done wrong in production.

Read-only cross-account cost reporting using Cost Explorer. Month-over-month variance flagging, top-N services per account, EC2 rightsizing summary. CloudShell-native, no profile required.

Practitioner templates for EU AI Act risk classification, ISO 42001 clause-by-clause audit, NIST AI RMF implementation, incident response playbook, and vendor assessment questionnaire.