summary
Cloud infrastructure engineer who builds and operates AWS environments as code. Provisions multi-tier VPCs, EKS clusters, and containerized services with Terraform; automates delivery through GitHub Actions pipelines authenticated with OIDC; and instruments systems with CloudWatch and Prometheus/Grafana. Diagnoses production failures across networking, IAM, DNS, Kubernetes, and system layers — documented in eight incident write-ups and a seven-signature Kubernetes troubleshooting runbook. Two years operating mission-critical satellite ground systems at NOAA as a shift lead.
skills
cloud / iac
AWS — S3, CloudFront, Lambda, DynamoDB, API Gateway, IAM, VPC, ALB, CloudWatch, Route 53, ACM; Terraform (remote state, drift detection); IAM Identity Center (SSO)
ci/cd
GitHub Actions; OIDC role-based auth (no long-lived keys); remote S3 state with native locking; automated plan / apply and deploy pipelines
networking
TCP/IP, DNS, subnetting / CIDR, routing, load balancing, security groups vs. NACLs
observability
CloudWatch (metric alarms, dashboards, custom metrics via SSM agent, EventBridge drift detection, Synthetics canaries); Prometheus / Grafana / PromQL; Kibana / ELK; Nagios; SolarWinds; JIRA incident workflows
containers / k8s
Docker; ECS Fargate; Kubernetes (EKS) — Deployments, Services, Ingress, ConfigMaps, Secrets, HPA; Helm; IRSA (keyless pod-to-AWS auth via OIDC); kubectl troubleshooting
scripting
Python + boto3 — production diagnostic tooling (argparse, structured logging, pagination, JSON output for pipelines); Bash; Git / GitHub
projects
EKS Lab — Kubernetes on AWS
- EKS cluster provisioned entirely in Terraform: VPC across two AZs, managed node group, OIDC provider, and the subnet tagging the AWS Load Balancer Controller requires.
- App exposed through an ALB Ingress — Load Balancer Controller installed with Helm and wired to an IAM role via IRSA, assuming AWS permissions through OIDC with no stored credentials; ALB registers pod IPs directly across both AZs.
- ConfigMaps, Secrets, and a HorizontalPodAutoscaler (min 2 / max 5, 50% CPU) backed by metrics-server.
- Paired with a Kubernetes troubleshooting runbook covering seven failure signatures, each reproduced and diagnosed on a live cluster.
AWS Diagnostic Toolkit
- Four read-only diagnostic tools: a per-tier security-group drift checker, a VPC route path tracer that reports the first broken link, an IAM access diagnoser using the policy simulator, and a cost auditor that quantifies waste in dollars.
- Built to production standard — idempotent, structured logging, ClientError handling, argparse parameterization, paginated scans, and JSON output with exit codes so the tools compose into pipelines.
Observability Lab — Prometheus & Grafana
- kube-prometheus-stack on Kubernetes — Prometheus, Grafana, Alertmanager, node-exporter, kube-state-metrics.
- Verified scrape-target health through the Prometheus API and queried live cluster metrics with PromQL rather than relying on prebuilt panels.
ECS Fargate Lab
- Load-balanced Fargate service across two AZs in private subnets, ALB routing to task IPs directly.
- Pipeline builds the image, pushes to ECR, and deploys — authenticated via OIDC.
AWS Break/Fix Lab
- Multi-tier AWS VPC in Terraform: public/private subnets across two AZs, ALB, NAT, three layered security groups, scoped IAM, DynamoDB with a Gateway VPC endpoint, CloudWatch + SNS alerting.
- Authenticated via IAM Identity Center (SSO) with no long-lived keys; root protected with MFA — least privilege from the ground up.
- Diagnosed and documented eight production-style incidents — connectivity, IAM, load-balancer health, routing, DNS, disk, CPU, and security-group drift — each with a full root-cause write-up.
Cloud Resume Challenge
- Serverless site on private S3 + CloudFront (OAC) over HTTPS with a custom domain via Route 53 and ACM.
- Visitor counter: Python Lambda → DynamoDB → HTTP API Gateway (the count in the header above is live).
- CI/CD with GitHub Actions and OIDC — frontend auto-deploys to S3 and invalidates CloudFront; Terraform runs plan on PR, apply on merge, against remote S3 state with native locking.
experience
FedGeek / ERT — NOAA AffiliateMar 2024 – Present
Operations Support Specialist — ESPC Help Desk
- Monitor satellite data ingestion across five ground-system programs (GOES, JPSS, EUMETSAT, DMSP, JMA) within NCCF; flag threshold exceptions for escalation.
- Triage and escalate data anomalies to Tier 2 via JIRA within SLA windows; maintain real-time awareness on Nagios, SolarWinds, and Kibana.
- Coordinated multi-team incident response during the Asheville outage, rerouting ingestion to Wallops Island across network, PDA, and product-delivery engineers.
- Selected 1 of 4 from a 24-person team for L3Harris GeoCloud training; promoted to shift lead; 2025 Peer Award.
Mayor's Office of Community Relations & Services2018 – 2019
Specialist
- Tracked resident cases across District agencies in Salesforce; coordinated 24-hour emergency response and weekly reporting.
United States Holocaust Memorial Museum2006 – 2018
Project Advisor / Student Ambassador
- Advised program leadership; led tours for VIPs, law enforcement, and international visitors; trained guides and curated the Main Exhibition visitor experience.
certifications & education
certs
CompTIA A+ · CompTIA Security+ (2023–2026) · IBM Cybersecurity Analyst (Coursera)
education
B.A. English — University of the District of Columbia