This site started from an empty domain and a simple goal: create a clean one-page marketing/operations landing page that behaves like something I would advocate for a client—fast, measurable, privacy-conscious, and built on infrastructure that actually scales.

In this article I walk through what I set up:

  • A static, CDN-served landing page on AWS (S3 + CloudFront).
  • First-party event collection via a custom analytics endpoint.
  • Google Tag Manager and Google Analytics 4 with custom events.
  • A serverless contact form using Lambda + API Gateway + S3.
  • reCAPTCHA-protected submissions to keep out bots.
  • SEO-ready metadata, schema, and content (including this article).
Why this matters for hiring managers: it demonstrates not just that I can talk about “data-driven marketing,” but that I can design and implement an end-to-end analytics and lead capture pipeline on modern cloud infrastructure.

1. Hosting the landing page on AWS: S3 + CloudFront

The foundation is intentionally simple: a static HTML/CSS site hosted in an S3 bucket, fronted by CloudFront with a custom domain and TLS.

1.1. Buckets, domains, and distribution

I created a dedicated S3 bucket for mattcmoran.com, configured for static website hosting, and pointed a CloudFront distribution at it. In Route 53, I routed the root domain and www through A/AAAA aliases to CloudFront. This gives me:

  • Global CDN caching and SSL termination.
  • Cheap, durable static file storage.
  • A structure that can evolve into a more complex app later if needed.

From a marketing/ops point of view, this means I control the stack, but it’s still inexpensive and boring in the best way. I've primarily used WordPress in the past, and Wix and Squarespace for some clients, I chose AWS + static hosting for myself to demonstrate my curiosity and capacity to handle marketing from the ground up. Even on a low to no budget.

2. First-party analytics: custom events + GA4

I didn’t want to rely solely on a black-box pixel. So the site uses two layers:

  • A lightweight custom event pipeline (my own endpoint).
  • Standard GA4 via Google Tag Manager with enhanced measurement.

2.1. Google Tag Manager & GA4 setup

On every page, I load:

  • The GA4 gtag.js snippet with my measurement ID.
  • The Google Tag Manager container that drives GA4 configuration and events.

In Tag Manager, I then:

  • Configured a GA4 Configuration tag tied to the measurement ID.
  • Created custom event tags to track key actions (resume downloads, nav clicks, contact form attempts).
  • Verified everything via the GTM preview/debugger before publishing.
GTM gives me a clean place to add future events or pixels without editing HTML. For a small team, it’s a pragmatic compromise between flexibility and control.

2.2. First-party analytics endpoint

In parallel to GA4, I wired a custom event pipeline that can be pointed at S3 or other storage via a Lambda/API Gateway endpoint. The idea is simple:

  1. The page emits a JSON payload on specific events.
  2. A tiny Lambda receives the payload via API Gateway, validates it, and can log it or write it to S3.
  3. Later, I can query these logs via Athena for deeper analysis.

From a hiring manager’s lens, this shows I understand:

  • Why first-party data collection matters post-cookie.
  • How to keep event schemas simple and query-friendly.
  • How to avoid over-engineering while still leaving room to grow.
The kinds of questions I'd want to answer from this data include but are not limited to Which CTAs drive the most contact form starts? How do resume downloads correlate with subsequent outreach? Where are my viewers coming from? Can I trace a specific job application to an increase in traffic from an expected region? Where is my traffic originating? Etc...

3. A serverless contact form that doesn’t leak data

Many portfolios either use mailto links or send form data through third-party widgets. I wanted something I could own end-to-end:

  • A minimal contact form on the landing page.
  • A serverless API that validates, stores, and protects submissions.

3.1. The front-end form

The form itself is straightforward: Name, Company, Email, and a short Message. It lives inside a styled “Get in touch” section and feeds into a single submit handler that:

  • Performs basic required-field checks.
  • Calls reCAPTCHA v3 to get a token.
  • POSTs a JSON payload to my API Gateway endpoint.
  • Shows a success/failure status message inline.

The client-side payload looks roughly like: 

{
  name,
  company,
  email,
  message,
  recaptchaToken
}

This same submit event is also tracked as a custom analytics event, so I can see how often people start the conversation, not just page views.

3.2. Lambda + API Gateway + S3

On the backend, I wired an HTTP API in API Gateway with a POST /contact route pointing at a Node.js 22.x Lambda function. The Lambda:

  1. Parses the JSON body and checks that name and email exist.
  2. Calls the official reCAPTCHA site verify endpoint on Google’s side using the secret key stored as a Lambda environment variable.
  3. Rejects requests with a low reCAPTCHA score or failed verification.
  4. Writes a JSON record of the submission into an S3 bucket dedicated to contact form submissions (with a timestamped key such as submissions/yyyy/mm/dd/<id>.json).

IAM policies are scoped so that this Lambda role can only write to the specific S3 bucket—not do anything broader across the account. That’s an important piece for production-ready setups that need to balance flexibility with blast radius.

This pattern scales well: I get low-maintenance, pay-per-use backend logic, first-party storage, and a clear path to plug in notifications or CRM integrations later without changing the form. [You can mention here how you might later wire this into a CRM or email automation tool—e.g. piping S3 or Lambda events into something like SES, a webhook, or a marketing automation platform.]

4. Keeping bots out: reCAPTCHA v3

To keep the contact endpoint from becoming a spam magnet, I used reCAPTCHA v3. Instead of showing a visible challenge, the client requests a token behind the scenes and sends it along with the form payload.

On the server, the Lambda calls Google’s verification API with:

  • My secret key (stored as RECAPTCHA_SECRET in Lambda env vars).
  • The token from the client.
  • The user’s IP address.

The response includes a score and action. I reject anything below a configurable threshold (for example 0.5) and make sure the action matches what I’m expecting (e.g. contact). That gives me a simple, tunable spam filter without degrading UX.

5. SEO, schema, and why this article exists

From a search perspective, a single sparse landing page isn’t ideal. This article exists partly as documentation for my process, and partly as a deliberate SEO asset:

  • It introduces relevant long-tail phrases around marketing analytics, AWS, and first-party data.
  • It’s internal-linked from the main site, reinforcing topical relevance.
  • It’s backed by BlogPosting schema so search engines can parse it cleanly.

Alongside the article, the site uses:

  • Clean, descriptive <title> and <meta name="description"> tags for both the home page and this post.
  • Open Graph and Twitter card metadata for shareability.
  • Structured data for Person, WebSite, and BlogPosting.

Relevant, honest content about what I actually built is both solid content-driven SEO and a decent interview prep tool for my use-cases: I'm effectively writing my own case study. I built this site as a portfolio that behaves like my work actually does: practical, measurable, and built to earn trust fast. In behavioral health marketing, I learned the difference between channels that feel good and channels that reliably deliver. When I ran Google Ads for treatment, I could predict outcomes almost day by day. A single day of well targeted PPC would reliably produce at least one client intake, and that intake typically represented fifteen to thirty thousand dollars a month in billable insurance revenue. Alongside paid search, I used long form articles as informative landing pages, written to answer real questions people were searching for and to gently guide them toward care.

That mix of performance ads and content that educates is still the core of how I think about growth: build the funnel, instrument it, then keep tightening the message until results are consistent. This site is where I show that approach in public, not just by describing it, but by structuring the site itself the same way I structure campaigns. I also built this site because my career has always lived at the junction of marketing, operations, and learning whatever the job demanded. At West Coast Recovery Centers I did not just market the program. I wrote the business plan that justified expanding from men only to men and women, doubled capacity, and helped double revenue, then built the HR and compliance systems that kept that growth stable. I automated onboarding inside a custom HIPAA compliant HRIS so every signature, credential, training record, accrued benefit, and Joint Commission and DHCS requirement stayed organized and audit ready, for both staff and admins. In deep tech at Okika, I stepped into a different kind of complexity.

Field Programmable Analog Arrays are not a product you can market with buzzwords, especially when the community has not seen real public use cases yet. So I embedded myself in the technology, learned the toolchain, soldered, debugged, and built demos personally. I pushed for academic and maker partnerships, created GitHub examples that people could actually build on, and owned everything public facing from the site to datasheets to investor decks. Pre sale traction for the Raspberry Pi HAT came directly from that work, from landing pages and email funnels to community outreach and deadline management with engineering and leadership.

Finally, this site exists because some of my most meaningful growth work has happened outside conventional categories. Through consulting I have helped everyone from local gyms and nonprofits to large DAOs, including designing a global mixed media ARG campaign that scaled from zero to twelve hundred active participants in six months and hit twenty five thousand page views in a single day. In crypto, I saw firsthand how community driven meaning can translate into market movement. One of the most rewarding campaigns I ran was an Acts of Kindness exchange where people submitted verifiable good deeds, received crypto rewards, and watched a shared story of anonymous generosity unfold in public. It boosted engagement, participation, and real value in the market. That kind of work taught me that marketing is not just persuasion. Done right, it is architecture for belief, behavior, and community. This perpetually-to-be-under-construciton portfolio-esque site is my way of making that architecture visible, with proof that I can carry a project from idea to build to adoption, whether the medium is healthcare, hardware, or mythic narrative.

6. What this demonstrates to a hiring manager

Technically, this stack is modest on purpose. The point isn’t to showcase a sprawling microservices architecture—it’s to show that I can:

  • Start from a blank domain and design a pipeline that makes sense.
  • Balance off-the-shelf tools (GA4/GTM) with first-party data collection.
  • Use AWS primitives (S3, CloudFront, Lambda, API Gateway, IAM) in a way that’s safe and understandable.
  • Implement real-world protections (reCAPTCHA, CORS, least-privilege IAM).
  • Document the work clearly enough that someone non-technical could still follow the story.

For a small team or early-stage company, that combination—strategy, systems thinking, and willingness to do the hands-on wiring—is often exactly what’s needed to get from “we have a website” to “we know what’s working, and we can double down on it.” If you’re trying to connect your marketing efforts to real data without hiring a full engineering team, this is just a small sample of the kind of work I can own.

Tags: AWS, CloudFront, S3, Lambda, API Gateway, Google Analytics 4, Google Tag Manager, First-Party Analytics, Serverless, reCAPTCHA, Marketing Operations, SEO