Selected work
Three bodies of work, written at architecture and decision level. Client names, network topology, hostnames, and control identifiers are deliberately withheld — each case study states what was left out and what I'm glad to walk through live.
A multi-tenant secrets platform, from proof-of-concept to security approval
Took the platform's secrets service through HA, PKI, SSO, backup and restore, tenant isolation, root-credential custody, and customer onboarding — then carried the isolation model through peer review to a formal security submission.
Self-hosted AI developer tooling inside an air-gapped boundary
Delivered a self-hosted AI gateway backed by a managed foundation-model service, in an offline-licensed cluster that cannot reach the public internet — then built the metrics, dashboards, cost tracking, and compliance-grade log redaction it had none of.
Cluster lifecycle, recoverability, and release engineering
Owned Kubernetes version upgrades across environments, built tested backup and restore into the delivery pipeline, ran the certificate lifecycle, and drove nine production releases — including one that had to slip and recover.
Where I'm strongest
I work at the seams — the places where two systems each look healthy in isolation and the failure only exists between them.
Secrets, identity & PKI
Multi-tenant isolation without enterprise tenancy primitives; workload identity bound to the orchestrator; OIDC single sign-on; certificate lifecycle and trust distribution; credential custody designed so the master credential doesn't survive bootstrap.
Kubernetes & GitOps platforms
RKE2 lifecycle and version upgrades; Helm umbrella and overlay patterns; Flux and Argo CD
delivery; service-mesh ingress and STRICT mTLS; policy enforcement; network
policy scoped to specific ports and namespaces.
Cloud & infrastructure as code
Terraform on AWS GovCloud; compiled configuration and Crossplane compositions for managed databases and object storage; IAM roles for service accounts; KMS-routed encrypted secrets; ephemeral-environment provisioning with verified teardown.
Secure delivery & CI/CD
GitLab CI pipelines from cluster bootstrap through application delivery; accredited-image registries; encrypted secrets flowing pipeline→vault→workload; release management across four environments; merge-request-driven change control throughout.
Observability & recoverability
Metrics exposure under mutual TLS; RED/USE dashboards built for services that had none; alerting and cost-tracking rules; log pipelines with PII redaction; and backup designed around tested restore rather than successful backup jobs.
Generative-AI infrastructure
Self-hosted AI gateway deployment, model registration against a managed foundation-model service, offline licensing, egress allowlisting, and idempotent application bootstrap — all inside an accreditation boundary that forbids calling out.
How I work
Six habits that show up in every project, and that I'd rather be judged on than any tool list.
Go one layer down
When a fix doesn't work, I stop patching and run a read-only audit of the whole path. The expensive bugs I've found were three layers from the symptom, and the loudest error in the log was almost never the real one.
Prove it against the running system
Documentation and charts describe intent; live state describes reality. When the two disagree I trust the cluster, and I'd rather demonstrate a claim than assert it.
Decompose before building
A proof-of-concept's real output is a named list of the work it revealed. I split discovery into sequenced, owned workstreams so the hard parts are visible early instead of arriving as surprises.
Design the ceiling into delegation
Self-service without an explicit ceiling is privilege escalation with better branding. If I'm handing out administrative capability, the boundary gets designed, tested, and reviewed before anyone gets the keys.
Treat recovery as a security property
A successful backup job proves nothing. I care about tested restore, documented prerequisites, and knowing the order things have to come back in.
Write it down for the next person
Runbooks, operator guides, and architecture decision records are the deliverable, not the paperwork after it. The measure is whether someone else can operate the thing without me.
A note on what isn't here. Most of this work was delivered inside federal and other regulated environments. Everything on this site is written at architecture and decision level. Client and program names, network topology, hostnames, policy contents, control identifiers, and anything else operationally sensitive or trivially reusable is deliberately withheld. That constraint is part of the job, and I'd rather demonstrate that I know where the line is than show you a diagram I shouldn't have published.