Platform Engineer
I build and run production AWS platforms — EKS, Terraform, GitOps delivery — for teams that need to ship without filing a ticket. New York, NY.
Currently looking for a platform / infrastructure role.
last deploy: 9b9602c · 2026-09-01 03:38 UTC
A component is listed here only if it resolves to a specific number or a named decision. No adjectives, no percentages of things I half-know. What I don’t claim isn’t on this page.
Eight Amazon EKS clusters carrying 25+ services for four product teams — about 30 engineers depend on the platform day to day.
Health checks, autoscaling and rollback across environments; Helm charts with per-environment values.
Migrated 50+ Argo CD Applications across 25+ services from CI-driven Helm releases to pull-based GitOps, which cut configuration drift between environments.
Decision: ApplicationSets rather than App-of-Apps. The same services ran across a matrix of environments and clusters, and templating that matrix with a generator was cheaper to maintain than a hand-nested tree of applications.
15+ Terraform modules adopted by four product teams, covering EKS, VPC, IAM, ECR and RDS.
Provisioning that used to be a two-to-three-day ticket became a self-service environment in under 45 minutes.
GitHub Actions with reusable workflows; repeatable deploys in under 15 minutes with automated health checks and rollback.
Earlier, at HealthVerity: replaced weekly manual release windows for 12 containerized services with pipelines that test, scan images, publish to ECR and deploy — so teams could release on their own schedule instead of waiting for a window.
Decision: retired 60+ long-lived AWS keys by moving CI/CD to repository-scoped OIDC rather than rotating them. Rotation keeps the credential and just changes its value; short-lived OIDC sessions mean CI/CD holds no stored credential at all.
Decision: ten API Gateway routes were decoding JWTs without verifying them. Verification moved into one shared authorizer instead of patching ten routes — one place to get right, and no route can quietly miss the fix later.
Decision: set the Prometheus and Grafana alerting standard for 25+ services on availability and error-rate signals rather than static thresholds — thresholds page when nothing is broken, and an alert nobody trusts is worse than no alert.
Crash loops, OOM kills and elevated 5xx rates surface in under two minutes.
Owned reliability for a healthcare-data pipeline processing two million events daily.
Decision: failed records went to dead-letter queues with partial-batch retries and CloudWatch alarms, so a bad record became something you could see and replay rather than something that vanished. Detection went from 30 minutes to under five.
Patching and first-response diagnostics automated in Bash across 90+ Amazon Linux hosts, standardizing triage for a six-engineer on-call rotation.
Monthly worker-node spend across eight clusters went from about $60K to about $48K, measured in AWS Cost Explorer filtered to EKS worker nodes.
It came from right-sizing over-requested workloads and tuning Cluster Autoscaler so idle nodes could terminate without breaching minimum capacity — then watching utilization and cost afterwards so it didn’t drift back.
Claude Code skills I wrote, used across 20 repositories — roughly 15 application repos and 5 shared platform repos — generating Terraform from requirements and checking pull requests against acceptance criteria. They advise; a human still approves.
Decision: rds-terraform-provisioner refuses off-the-shelf modules
outright, asks before guessing on anything security-shaped, and carries a Gotchas section seeded
from failures I actually hit — including publicly_accessible defaulting to true when
requirements go quiet.
Mobile marketing analytics. Own an EKS platform used by four product teams. Moved delivery to pull-based GitOps, took stored credentials out of CI/CD, set the alerting standard, and brought provisioning down from a multi-day ticket to a self-service run.
Healthcare data platform. Replaced manual weekly release windows with pipelines teams could run themselves, made a two-million-events-a-day ingestion path observable and replayable, and consolidated JWT verification that ten routes had been skipping.
Static HTML and CSS, no framework and no build step, served from GitHub Pages. Components are
<details> elements that ship open and are collapsed by about ten lines of
JavaScript — so with JavaScript disabled or broken, this page is a complete document rather than a
row of empty boxes.
The deploy line at the top is the only live thing here: the commit and timestamp are written in by the GitHub Actions workflow that publishes the page. Nothing else on this page has a status indicator, because nothing else is being measured — a green dot I wasn’t measuring would be a fake instrument.