Build.Secure.Scale.

CI/CD pipelines

Set up pipelines for 25+ projects using GitHub Actions and ArgoCD. Every build goes through SAST, dependency checks and image scanning, and all config sits in one central repo. Deploys now take seconds.

Kubernetes audits

Went through our live clusters one by one and fixed what wasn't ready for production: CIS Benchmark checks, tighter RBAC and proper audit logs. They now run 30+ apps at 99.9% uptime on 256GB of RAM.

Smaller, safer images

Rebuilt our container images without a shell, package manager or sudo. If someone does get code execution, there isn't much they can install or use to move around.

Secrets and policies

Moved secrets into Vault and Sealed Secrets/SOPS. Added OPA, Kyverno and Gatekeeper rules to the GitOps flow so insecure manifests get rejected before they reach production.

Networking with Cilium

Helped split a monolith into microservices on Istio, then added Cilium/eBPF network policies and runtime monitoring. Prometheus and Grafana for metrics, Karpenter, KEDA, VPA and HPA for scaling.

GPU sharing for AI

Used MIG, vGPU, time slicing and fractional GPUs so more teams could share the same cards safely, including teams running 671B and 405B parameter LLMs. Also set up KubeVirt with SR-IOV passthrough for VMs.

AWS setup

Built AWS environments (EC2, Fargate, ECR) with CloudFormation and kept security groups, IAM roles and load balancers on least privilege.

Terraform

Wrote Terraform for VPCs, subnets and compute across availability zones, with a disaster recovery plan and reviewed changes.

Monitoring

Set up Prometheus, Grafana and AlertManager and wired in audit logs. Incidents got picked up and fixed about 25% faster.