proof of work

Key engagements, delivered as embedded lead within LiSEC Austria's Cloud Operations & Observability function.

Enterprise Observability Modernization — OpenTelemetry & Datadog

  • Challenge. Fragmented, agent-based monitoring across on-prem Java and .NET systems and AKS made incident diagnosis slow and created vendor dependency.
  • Approach. Directed OpenTelemetry rollout across on-prem and AKS environments, redesigned Datadog tagging architecture, and ran internal enablement through training sessions and tech talks.
  • Outcome. Standardized telemetry collection org-wide and reduced reliance on legacy monitoring agents.

AKS Ingress Modernization — NGINX App-Routing to Istio/Traefik

  • Challenge. Microsoft's planned end-of-life of the AKS NGINX App-Routing extension put production ingress at risk across multi-region clusters.
  • Approach. Led a proof-of-concept evaluating Traefik and Istio, authored an architecture decision record, and defined the migration path.
  • Outcome. Delivered a documented ingress replacement strategy ahead of the platform's EOL deadline.

Datadog & Azure Cost Optimization (FinOps)

  • Challenge. Uncontrolled growth in Datadog APM hosts and licenses, alongside unattributed Azure spend across a multi-customer analytics platform.
  • Approach. Led an APM Enterprise host cost reduction initiative and built an Azure cost attribution model across the customer base.
  • Outcome. Eliminated redundant Datadog spend and created cost visibility that hadn't previously existed for stakeholders.

Messaging Infrastructure Security — ActiveMQ TLS/AMQPS Rollout

  • Challenge. ActiveMQ (Artemis) brokers were running without transport encryption across on-prem and analytics environments.
  • Approach. Designed and rolled out amqps/TLS across broker infrastructure, coordinating directly with customer-site stakeholders.
  • Outcome. Closed a security gap across production messaging infrastructure with no service disruption.

Least-Privilege Azure RBAC Design

  • Challenge. The SRE support team lacked a scoped access model for the production Azure subscription, risking over-permissioning.
  • Approach. Designed a custom least-privilege Azure RBAC role tailored specifically to SRE support operations.
  • Outcome. Delivered a governance-aligned access model balancing operational need against security exposure.

CI/CD Pipeline Security Hardening

  • Challenge. CI pipelines for the NG platform lacked vulnerability scanning and software bill-of-materials (SBOM) generation.
  • Approach. Integrated Trivy scanning and CycloneDX SBOM generation into shared CI templates for .NET and npm builds.
  • Outcome. Improved supply-chain security posture across the pipeline template used organization-wide.

personal projects

Multi-cloud Terraform & OpenTelemetry — built to the same standard, on my own time.

A personal build implementing the same infrastructure design on both Azure and AWS, plus a full OTel observability stack running on-prem and across both clouds. Built to prove out patterns beyond what any single engagement required.

scope personal project stack terraform, terragrunt, github actions auth oidc, no stored credentials
  • Subnet model. Azure spreads a subnet across availability zones automatically; AWS needs one subnet per AZ. The shared interface takes one CIDR per role either way — the AWS module carves it into per-AZ blocks internally.
  • Workload identity. AKS auto-exposes an OIDC issuer the moment workload identity is enabled. EKS exposes one too, but AWS doesn't register it as a trusted identity provider automatically — that's a separate resource and a live certificate-thumbprint fetch.
  • Registry pull scope. ACR pull access is a role assignment scoped to one registry. ECR pull comes from a managed policy already on the node role — free, but broader than it needs to be. Flagged in the ADR rather than quietly fixed.

Agent, gateway, backend — on-prem and in two clusters.

traces tempo logs loki metrics prometheus + grafana
  • Tail sampling, not head sampling. Deciding per-trace before you know if it errored means you can throw away exactly the traces worth keeping. The gateway waits, sees the whole trace, always keeps errors.
  • The multi-replica bug this creates. Two gateway replicas for availability means one trace's spans can land on different pods — neither sees the whole trace. Fixed with a load-balancing exporter that hashes by trace ID, so every span of one trace reaches the same replica.
  • Same design, two clusters. The AKS and EKS manifests are identical except for one environment variable identifying which cluster the telemetry came from — verified with a diff, not just claimed.