Skip to experience
Contact→→

Surface

00 / SURFACE

Topology

01 / TOPOLOGY

CNCF Kubestronaut and DevOps Engineer with 4+ years across Linux systems engineering and cloud infrastructure, operating production Kubernetes platforms on AWS, Azure, Oracle Cloud and bare metal. Runs multi-tenant clusters serving enterprise SaaS customers, delivered a legacy-to-microservice migration for a regulated banking environment spanning a multi-cloud estate with cross-provider disaster recovery, and productised a complete application stack into a published AWS Marketplace appliance.

Years in production
0+
Roles traversed
0

Experience

R-0111/2025 — CurrentActive

DevOps Engineer

Raynet GmbH

Multi-tenant production Kubernetes for enterprise IT asset and endpoint management SaaS.

  • 01Operate multi-tenant production Kubernetes clusters (RKE2, OKD/OpenShift) spanning 10+ nodes across Hetzner, AWS and Azure, hosting enterprise IT asset management and endpoint management SaaS products.
  • 02Run a production CloudNativePG cluster serving tenant-isolated namespaces at scale; eliminated connection exhaustion incidents by redesigning PgBouncer session-mode pooling.

Full record — 9 entries

0+
Cluster nodes
0
Cloud providers
0
AWS Marketplace product
R-0203/2025 — 11/2025

DevOps Engineer

Bestcloudfor.me

Banking modernisation: legacy monolith to microservices across a multi-cloud estate with cross-provider DR.

  • 01Contributed, as part of a consultancy engagement, to a banking client's infrastructure modernisation programme, migrating legacy monolithic systems to a containerised microservice architecture with automated CI/CD and GitOps delivery.
  • 02Operated the client's multi-cluster Kubernetes estate: a large-scale production cluster on Oracle Cloud Infrastructure, a cross-provider disaster recovery cluster on Huawei Cloud, and a dedicated control plane cluster running core platform applications.

Full record — 6 entries

0
Kubernetes clusters
0+
Servers patched
0
Clouds, one DR path
R-0303/2024 — 02/2025

DevOps Engineer

Sensey

One pipeline definition that reads each service's runtime and picks its own build path.

  • 01Designed a language-aware CI/CD pipeline that detected each service's runtime stack and selected the matching build, test and deployment path, delivering a seven-microservice application through a single shared pipeline definition.
  • 02Designed, deployed and managed Azure cloud infrastructure for production application workloads.

Full record — 5 entries

0
Microservices
0
Shared pipeline definition
R-0412/2023 — CurrentActive

Linux System Support

Anabiltek

Part-time, ongoing: keeping production Linux estates healthy.

  • 01Provide ongoing Linux system administration, performance tuning and reliability improvements for production environments.
0.0yr
Continuous engagement
R-0501/2022 — 03/2024

System Specialist & DevOps Engineer

Freelance

End-to-end ownership for long-term clients: provisioning, hardening, incident response.

  • 01Provided end-to-end Linux system administration for long-term clients, covering provisioning, hardening, performance tuning and incident response.
  • 02Containerised client workloads and introduced automated deployment pipelines in place of manual release processes.

Full record — 4 entries

0yr
Independent practice
R-0601/2022 — 08/2022

IT Officer

AET Electronics

Where it started: keeping a manufacturing site running.

  • 01Maintained IT infrastructure across hardware, software and network layers for a manufacturing site, ensuring uninterrupted daily operations.
  • 02Applied security controls to protect company data and IT assets, and resolved end-user technical issues.
0→
The first layer

Skill graph

03 / SKILL GRAPH

A percentage next to a tool proves nothing. These are the systems and the technologies inside them — select one to see the roles it carried production traffic in, and what it ran alongside.

Select a technology

  • Kubernetes

  • Containers & Packaging

  • GitOps & CI/CD

  • Infrastructure as Code

  • Observability

  • Cluster Security

  • Cloud

  • Systems & Data

  • Scripting

Case studies

04 / BUILDS

01 / 05

P-012025

Regulated Multi-Cloud Estate

Bestcloudfor.me — banking client

A bank's monolith became microservices without giving up the requirement that it survive losing a cloud provider.

Problem
Legacy monolithic systems in a regulated banking environment had to become a containerised microservice architecture. Regulation meant the estate also had to keep running if an entire cloud provider became unavailable, which ruled out a single-region answer.
Outcome
The migration ran with automated CI/CD and GitOps delivery, monitoring and logging through Prometheus, Grafana and the ELK stack, and a DR path that does not depend on the primary provider being reachable.

0

Clusters

0

Cloud providers

0+

Servers auto-patched

replicateClientsKeepalived VIPFloating addressHAProxy AHAProxy BRKE2 APIIngressMicroservicesRedis SentinelStateful tierDR cluster — HuaweiCross-providerPrometheus · Grafana · ELK
P-022026

Procurement-Ready Appliance

Raynet GmbH

A complete application stack, productised into an AMI a stranger can launch — with nothing from the build machine left inside it.

Problem
Enterprise buyers want to acquire software through AWS procurement, not through a deployment project. That means the entire stack has to ship as one image. It also means every image is handed to people who did not build it, so anything the build process left behind becomes a customer-facing security problem.
Outcome
A published, maintained AMI-based server product on AWS Marketplace, where no build-time credential or identity persists into a customer instance.

0

Published Marketplace product

0

Build credentials in the image

sharereviewlaunchSource & chartGitLab CIBake AMISanitisekeys · cloud-init · journalsSnapshotScanner accountcreate-volume grantMarketplace listingCustomer instance
P-032026

Tenant-Isolated Data Plane

Raynet GmbH

Connection exhaustion is not a database problem. It is a pooling-mode problem.

Problem
A production CloudNativePG cluster serves tenant-isolated namespaces at scale. As tenants multiplied, the shared connection budget did not, and the platform hit connection exhaustion incidents that surfaced to customers as failures in unrelated features.
Outcome
Connection exhaustion incidents eliminated. Alerting rules across infrastructure, database, GitOps and backup domains route to Alertmanager, and a service opens and resolves GitLab issues automatically so an alert becomes tracked work without a human relaying it.

0

Connection exhaustion incidents

0

Alerting domains

streamcompressopen / resolveTenant namespacesPgBouncersession mode, boundedCloudNativePG primaryReplicaBackup CronJobHetzner S3AlertmanagerGitLab issuesopened & resolved automatically
P-042024

Language-Aware Delivery

Sensey

Seven services in different runtimes, delivered by one pipeline definition that reads what it is building.

Problem
A seven-microservice application spanned several runtime stacks. The obvious answer — a pipeline per service — means seven definitions to keep in sync, and seven places for a build convention to quietly drift.
Outcome
Seven microservices delivered through one definition, with Prometheus and Grafana providing real-time metrics on what the pipeline put into production.

0

Microservices

0

Pipeline definition

CommitDetect runtimeselects the pathPath APath BPath CTestContainer imageHelm releaseAKSPrometheus · Grafana
P-052026

Admission & Secret Baseline

Raynet GmbH

Make the safe path the default path, so no workload has to remember to be safe.

Problem
Cluster defaults let workloads request more privilege than they need, and secrets arrived through whatever route the deploying human chose. Both are fine until the cluster is multi-tenant, at which point they are the whole risk surface.
Outcome
Policy and secret handling became properties of the platform rather than instructions in a runbook — a new namespace inherits both.

RS256

JWT authentication

0

Hand-delivered secrets

applymaterialiseadmitmountGitHashiCorp VaultArgoCDExternal SecretsRS256 JWTKyverno admissionreject, not auditSecretWorkload

Pipeline

05 / PIPELINE

  1. 01Commit—

    A change enters the system with an author and a reason.

  2. 02Plan—

    State the intended change against real infrastructure before touching it.

  3. 03Build—

    Detect the runtime, take the matching path, produce an artefact.

  4. 04Test—

    Prove the change before it can reach anything that matters.

  5. 05Security scan—

    Turn scan findings into remediation that actually runs.

  6. 06Containerise—

    Package the release so the cluster receives one thing, versioned.

  7. 07Deploy—

    Git is the desired state; the cluster converges toward it.

  8. 08Observe—

    The deploy is not finished until something is watching it.

pipeline #44170/8 stages

Awaiting trigger…

Credentials

06 / CREDENTIALS

Keystone

CNCF Kubestronaut

02/2025

Select a code for the full credential

  • Certified Backstage Associate
  • Kyverno Certified Associate
  • Prometheus Certified Associate
  • Certified Argo Project Associate
  • Certified GitOps Associate
  • Certified Cloud Native Platform Engineering Associate
  • AWS Certified Solutions Architect — Associate
  • AWS Certified Cloud Practitioner
  • CNCF Kubestronaut
  • Certified Kubernetes Security Specialist
  • Kubernetes and Cloud Native Security Associate
  • Certified Kubernetes Application Developer
  • Certified Kubernetes Administrator
  • Microsoft Certified: Azure Fundamentals
  • Kubernetes and Cloud Native Associate

Operator

07 / OPERATOR

Reliability
Systems are judged on their worst day. Design for the failed upgrade, the exhausted connection pool, the region that went away.
Automation
A procedure that lives in someone's memory is an outage waiting for a holiday. Put it in a playbook, a chart, or a pipeline.
Observability
You cannot operate what you cannot see. Alerts should describe a symptom a human recognises, and route to someone who can act.
Simplicity
Every abstraction is a thing to debug at 03:00. The best platform is the smallest one that meets the requirement.
Ownership
Shipping it is not the job. Running it, patching it, restoring it and being the one who is called — that is the job.

Core

08 / CORE

Contact→→[email protected]