I build and operate cloud platforms, focusing on infrastructure automation, application delivery, observability, security, and incident response.
Cloud Engineer at Cars Commerce
June 2025 — Present01 AWS & Kubernetes
Multi-tenant fleet ownership.
Terraform to production
operations.
EKS Auto Mode & self-hosted Karpenter
01 / Automation
Built an EKS control-plane upgrade pipeline covering preflight checks, blocking disruption-budget remediation, add-on upgrades, node convergence, and Slack reporting.
Captured a node-version baseline to verify convergence, added an idempotent verify-only rerun, and handled three-hour OIDC session limits so long-running upgrades survive credential expiry.
02 / Infrastructure as code
Migrated the EKS fleet from direct Terraform state to env0-managed workflows, with per-cluster configuration and organization-level OIDC access.
Generated tfvars for the Auto Mode fleet, established the env0 identity provider, and migrated the Datadog Terraform workspace from its S3 backend. Tenant workloads retain dedicated AWS account boundaries.
03 / Deployment guardrails
Built a Python tool that triggers env0 plans, retrieves pending Terraform changes, and uses Claude on AWS Bedrock for risk assessments before approval.
Supports multi-cluster targeting, sub-environment detection, dry runs, apply timeouts, and per-deployment error isolation. Separate review prompts across 6+ infrastructure repositories cover IAM trust policies and GitOps deployment risk.
Central Terraform for IAM and Identity Center, cross-account KMS and Secrets Manager policies, and organization-wide CloudFormation StackSets.
Analyzed 300+ EBS volumes, built a multi-region unused-volume scanner, and evaluated Auto Mode against self-managed Karpenter in an architecture decision record.
Terraform / OpenTofu / env0 / EKS / Karpenter / IAM / Identity Center / KMS / EC2 / EBS / RDS / SQS / SNS / Route53
02 Platform systems
How applications ship, workloads run,
and failures get
understood.
Fleet-wide application delivery across 6 business units.
A single-replica External Secrets webhook had a disruption
budget that allowed no evictions. I used an Argo CD
ignoreDifferences guardrail to prevent
self-heal from reversing the temporary change.
Executed across the self-managed fleet at roughly 7 minutes per cluster, with zero failed evictions.
Helm · Argo CD · Renovate · External Secrets
Self-hosted runner infrastructure across multiple GitHub organizations.
Led SEV-1 incident response for an Actions Runner Controller bug that blocked team deployments, then authored the postmortem.
GitHub Actions · Runner Scale Sets · AMI pipelines
Monitoring as code, fleet-wide agent standards, and difficult failure analysis.
A version upgrade silently stopped PostgreSQL cluster checks while the cluster agent remained healthy. Comparing working and broken startup logs exposed a removed configuration-copy step.
Fixed the canonical configuration mount and verified both database instances dispatching again in production.
Historical dashboards correctly showed roughly 6 GiB usage, but cold-start resource discovery peaked near 10.2 GiB. Limits based on steady state caused startup OOMs on large clusters.
Sized limits to the startup burst, resolving crash loops on multiple clusters exceeding 200 nodes.
Datadog Operator · Prometheus · OpenCost
Falcon lifecycle management and security workload reliability across the fleet.
A Falcon admission controller recorded 1,115 restarts over eight days. One undersized node accounted for 77% of major page faults, with storage reads saturating and kubelet probes timing out.
I confirmed the same signature on four additional clusters and traced it to a NodePool with no instance-size floor. Increasing pod memory had not addressed the cause.
Directed remediation at node supply and page-cache pressure rather than treating it as a security-agent defect.
Falcon Sensor · Falcon Operator · Kubernetes
Independent project
A retrieval-augmented document Q&A system combining semantic search, open-weight models, and a dual-agent workflow.
Document Q&A / Architecture
Select a stage to explore
PDFs are loaded, split into overlapping text chunks, and embedded for storage in Chroma. This prepares the document collection for semantic retrieval.
LangChain · Sentence Transformers · Chroma03 Get in touch