Nestlé WebCMS platform
Architecture, automation and applied AI for a platform that serves 300+ Nestlé sites worldwide.
- Role
- Technical Lead · architecture, delivery and team lead
- When
- 2023 – 2026
- Repo
- Confidential, not public
- enterprise sites on the platform
- 300+
- manual compliance effort with Cerberus
- −80%
- automated rotation of every in-scope secret
- <1h
Described at a level that respects confidentiality: no internal names, data or architecture diagrams.
Context
Nestlé’s WebCMS ecosystem runs hundreds of brand and market sites on several managed PaaS providers (Pantheon, Acquia, Platform.sh). As Technical Lead I was responsible for the architecture and engineering delivery around it, and I led a distributed team of six across development, DevOps and operations.
Cerberus: compliance on autopilot
Access recertification and audits across several platforms used to be manual, repetitive and error-prone. I designed and built Cerberus, a Python/FastAPI microservice platform that collects access data from each platform, runs the recertification workflow and produces audit evidence. It cut manual compliance effort by more than 80%.
As it grew, I guided the team through the hard part: reading from several platforms concurrently while writing safely to one database. That meant handling overlapping runs, keeping writes idempotent and persisting each run atomically, so a rerun never duplicates or half-writes audit evidence.
AI Hackathon: an agent for compliance work
I co-led the winning team at the Nestlé AI Hackathon with Claude Code and the Anthropic SDK. We built a VS Code extension in TypeScript: an agent that helps engineers through compliance workflows from inside their editor, with tool calls into the systems they already use. That work led to an invitation to represent Nestlé IT Innovation at the Microsoft AI Tour in Zurich (2026).
Data Leak Mitigation
I ran the data-leak prevention programme for the WebCMS estate:
- 100% of in-scope secrets centralised in Azure Key Vault behind strict RBAC.
- Automated secret rotation that finishes in under an hour.
- A guarantee that no production data reaches non-production environments.
Ops automation and integrations
I designed the WebCMS Ops automation layer (Flask, Azure Functions, Cosmos DB, Event Hub) and the integration services for the mseONE platform (GraphQL/Drupal). They automate site provisioning, SAML/SSO onboarding and GDPR right-to-erasure requests.
Leadership
I wrote the engineering standards, architecture runbooks and delivery frameworks the team works by, and was promoted from Tech Specialist to Tech Lead along the way.
In November 2026 I moved on to a new role at Nestlé: Tech Lead for the Business Architecture Engine, connecting value chains and processes to the services and applications behind them in SAP LeanIX.