DevOps & Infrastructure Engineer
Three-plus years designing, automating, and hardening hybrid infrastructure across Azure, AWS, GCP, and on-premise environments. I focus on Infrastructure as Code, CI/CD automation, enterprise-grade observability, and security hardening.
Infrastructure I have designed, deployed, and operate. Client identifiers are anonymized; the engineering is exactly as running in production.
A self-hosted monitoring and SIEM platform for a small fleet of production servers. Prometheus, Grafana, Loki, and Alertmanager for metrics and logs; Wazuh for intrusion detection and log correlation. Twenty alert rules split by scope, fail2ban and nginx rate limiting, all deployed from code.
A Proxmox host mined Monero behind a userland rootkit disguised as a system service. I traced the evidence, mapped the hiding techniques, and led the rebuild and hardening. The write-up covers the detection path and the indicators that catch this class of attack early.
A CI/CD architecture for teams where not everyone who writes code should be able to reach production. Four automated quality gates on the forge where contributors work, a single reviewed path to the forge holding the deploy credentials, and a manual deploy as the last gate. Built with GitHub Actions, GitLab CI/CD, Docker, Ruff, ESLint, pytest, Trivy, Bandit, and SonarQube.
Dual-node Proxmox cluster with a backup server as a VM on the second node. Snapshot backups, least-privilege tokens, tested restore, and a documented failover runbook for node-1 failure.
Five reusable Terraform modules across Azure, AWS, and GCP — VNet and subnets with service delegation, Linux VMs with managed disks, App Service with VNet integration and deny-by-default restrictions, a two-tier AWS VPC, and a private GCP instance. Secure defaults, explicit egress, and the reasoning documented alongside the code.
Technical incident write-ups and detection guides. Anonymized, evidence-based.
How a hidden XMRig miner disguised itself as a Proxmox health service, used an LD_PRELOAD library to hide its process, files, and port, and updated itself daily to survive cleanup. Includes the forensic evidence, the rebuild, and the hardening that followed.
The concrete indicators from the case above: unexpected systemd units,
LD_PRELOAD outside distribution packages, processes running from improbable
paths, mining-pool connections, and an immutable ld.so.preload.
Each with the exact command to check it.
A CI/CD design where contributors push code freely but cannot reach production: four automated gates on the forge they work on, a single reviewed path to the forge holding the deploy credentials, and a deploy that stays manual. Includes the token-scoping problem that took three attempts, and where this pattern stops being worth its cost.
Microsoft Azure, AWS, GCP, Terraform, Terraform Cloud, Proxmox VE, PBS
Docker, Kubernetes (KubeAdm), Dokku, Nginx, Nexus3
Azure DevOps, GitLab CI, Jenkins, GitHub Actions, SonarQube, Git
Prometheus, Grafana, Zabbix, Loki, ELK, Alertmanager, Uptime Kuma, Wazuh SIEM
Active Directory, Azure Key Vault, Private Endpoints, NSG, SSL/TLS, fail2ban, IAM
Linux (Debian, AlmaLinux, Rocky), Bash, Python, PowerShell