I look after infrastructure, security and cloud cost for Crafto, Kutumb and our other apps, which serve around 4M daily active users with traffic peaks of 1M+ TPM. In 2024 I was the only DevOps engineer for a few months. Since then I've built a small infra team, which I now lead.

Platform

• Moved production from kOps to Terraform-managed EKS, with efficient node autoscaling using Karpenter. On festival days the cluster grows to around 800 nodes and shrinks back the next day.
• Set up an ECR pull-through cache so images come from inside AWS instead of public registries. With DaemonSets running on every node, this mattered at scale: no more Docker Hub rate limits, and lower NAT costs.
• Run infrastructure for our GenAI workloads, including GPU node pools with Karpenter and planning reserved H100 capacity.
• Migrated six Redis databases from Redis Enterprise to ElastiCache Valkey with almost no downtime.
• Moved our infra to Terraform with shared modules and remote state. Database users and grants are managed as code through GitHub Actions with OIDC.
• Built reusable, throwaway load-testing setups to check the platform before big traffic events.
• Made developers' lives easier with per-PR preview environments (ArgoCD PR Generator), self-hosted GitHub Actions runners that scale with the queue, and Vault for secrets (blog).

Cost

• Own cloud cost end to end and keep leadership updated on spend. Built Slack bots that post daily, per-product cost reports for AWS, GCP, OpenAI and other vendors, along with anomaly alerts. Cut spend by moving Redshift to Serverless ($3k+ a month), right-sizing RDS (about $1k a month), and switching to Graviton builds and single-AZ observability.
• Saved about $6k a month on S3 with lifecycle rules that clean up unused files after special-day events. This meant working with the backend team to agree on a consistent way of storing files in S3.

Observability

• Moved metrics from Prometheus to VictoriaMetrics after trying Thanos. It now holds about 10M active series. Also run a distributed Loki setup (around 3 TB of logs a day) and Elastic APM across 30 services (around 13M transactions a day, about 1 TB of trace data on a 15-node Elasticsearch cluster).
• Added APM to our backend services and extended it with custom code to capture traces the default SDK was missing.
• Self-hosted Langfuse on EKS for LLM tracing, with replicated ClickHouse (now about 190 GB of traces) and PostgreSQL, S3 and secrets set up in Terraform. Added tracing to our GPT-4o workers with 10% client-side sampling, capturing prompts, tokens and latency.
• Wrote alerts as code for almost every AWS resource by extending Marbot with Terraform, plus Kubernetes, WAF/Shield and GuardDuty alerts routed to the right Slack channels.

Security

• Handle security end to end: an all-region AWS baseline (GuardDuty, Security Hub, Config, Inspector) tuned to what actually runs, which cut active findings from ~1.6M to ~390k. CloudFront with WAF and Shield sits in front of every app, and I've fixed vulnerabilities I found, such as file overwrite and SSRF in our upload service.
• Built our DevSecOps pipeline: a reusable GitHub Actions workflow that runs Gitleaks, Semgrep, Trivy and Checkov on our services, plus MobSF for the Android apps. Every finding lands in a self-hosted DefectDojo (HA on EKS, Google SSO), alongside Security Hub findings, so we have one place to track them.
• Brought SSO to Vault, ArgoCD, Argo Workflows, our VPN and many other open-source and internal tools, so one identity opens everything. Took the VPN from a single OpenVPN server to Pritunl, then Headscale, and now NetBird (blog on the early setup).

Ownership

• Interviewed 100+ candidates, mentored two DevOps engineers and hired our first security engineer. For that role I built a take-home where each candidate gets their own vulnerable app on AWS to break into.
• Write RCAs after incidents and keep runbooks up to date. I also own our relationship with AWS: I work with our TAM and account manager on reviews and pricing, and lead AWS Countdown Premium (CDP) engagements before our biggest traffic days, covering EC2 capacity, load balancer readiness, database tuning and AWS on-call cover.

Worked on multiple projects of various scale of different domains across various geographies.
In these, I've transcended from apprentice to architect, weaving together the threads of development and operations to achieve utmost efficiency.

• Automated creation of an Infra from scratch using AWS Cloudformation, Ansible using ECS Cluster, Nodes and Services.
• Used Single Load Balancer for multiple Ingresses using "Ingress Group" to save some costs.
• Optimized CI/CD pipelines - Build Once, Deploy Everywhere.
• Custom GitHub Action to send Slack Alerts to notify CI/CD pipeline success/failures.
• Migration of a three tier application from bare metal servers to Docker Swarm Cluster.
• Created Self Exploding testing infra stack using AWS Cloudformation. Also wrote blog on this here.
• Setup of an NGINX reverse proxy Django app using Gunicorn.
• Ensured all the best practices being followed in my projects.
• Contributed in some Python projects.

During my Internship, I was given training on Linux, Networking, Git, Docker and Kubernetes. I got to work on a project during my internship where we were ingesting TBs of logs daily in our system to power a SOC tool. My job was to keep our self-hosted Kubernetes cluster running reliably. I was appraised for a tool I created to send hourly slack alert which will collect data from various data sources and will give precise system health status. (Kafka Lag, Query Performances, NotReady nodes and pods, etc.)

• Replicated the exact prod cluster on smaller machines using Vagrant & Ansible.
• Debugged various K8s related issues, e.g. - IPAM exhaustion of Weave CNI.
• CronJob for cleanup of some dangling resources.