Senior DevOps and platform engineer. I build and run the Kubernetes platforms that put AI into production. Most recently that was Myriad's generative-AI platform: multi-model LLM serving, GitOps delivery, GPU autoscaling, and a Sigstore-signed supply chain.
Design and run clusters end to end, from managed EKS and OpenShift to kubeadm by hand. Autoscaling, multi-tenancy, and platforms teams can self-serve.
Everything in Git, reconciled continuously. Promotion through environments with canary analysis and fast rollback, driven by ArgoCD and GitHub Actions.
Models off laptops and into production: inference serving, fine-tuning, and evaluation on GPU infrastructure that scales to demand and back to zero.
Zero static credentials, OIDC for access, and images signed and verified at admission. Secrets and identity handled at the platform layer, not per app.
Multi-window burn-rate alerts on SLOs, distributed traces across the request path, and live GPU telemetry. Google-SRE-style incident response behind it.
AWS as code, and the networking layer underneath it: eBPF CNI, service mesh, Gateway API, and DNS that holds up under load.
Over the past year Myriad piloted a generative and agentic AI platform on EKS. I built the platform side of it. Four pieces of that work:
Architected the platform with Terraform for the cluster, VPC, IAM, and Karpenter node pools, and an ArgoCD App-of-Apps model that bootstraps Vault, External Secrets, cert-manager, Cilium, Istio, and Kyverno, then hands every downstream workload to GitOps. It serves nine models through vLLM, from Llama 3.1 8B on the fast path to 405B AWQ for reasoning, routed by a four-tier LangGraph classifier with cost- and latency-aware routing.
Moved the production data plane off the AWS VPC CNI and managed node groups onto Cilium eBPF with Karpenter. Only the Karpenter controller runs on a Fargate bootstrap; everything else, including CoreDNS, ArgoCD, and Istio, runs on Karpenter-provisioned EC2. Cilium handles ENI IPAM, kube-proxy replacement, and WireGuard encryption pod-to-pod and node-to-node. I wrote 36 network policies and 7 Tetragon tracing policies for runtime detection. This removed the per-node ENI-exhaustion ceiling the VPC CNI imposed.
Built a fine-tuning loop on EKS. The Kubeflow Training Operator runs an Axolotl QLoRA job on Llama 3.1 8B on a single A10G GPU, syncs the trained adapter to S3 through Pod Identity, and serves it back with vLLM's LoRA support. A parallel lm-eval run scores the tuned adapter against the base model and writes the results to Postgres, closing the loop for the next round of tuning.
Signed every image with Sigstore cosign, keyless through GitHub Actions OIDC with a separate IAM role per app, and enforced it at admission: six Kyverno policies check the registry allowlist, signature, and digest pinning before a pod runs. East-west traffic defaults to deny across namespaces with WireGuard underneath, and a three-node Vault HA cluster issues dynamic Postgres credentials and syncs secrets through both the Agent Injector and the Secrets Operator.
I'm a DevOps and platform engineer with 23 years running production infrastructure, the last 9 on HIPAA-covered clinical genomics at Myriad Genetics. That work set the bar for how I approach AI: it has to run reliably, scale, and survive a security review.
These days I focus on the platforms behind AI, the Kubernetes, GitOps, and security foundations that take a model from a notebook to something a business can depend on. I take on the stalled and high-risk work, and I mentor the engineers around me.
Open to senior and staff roles in platform, DevOps, and AI infrastructure. The fastest way to reach me: