100+ TLS, Kafka, ingress and domain certificates across dev, SIT, staging and production used to be requested and renewed by hand, and ops had missed 10–20 renewals over time. Now a team declares a certificate in a file and the platform does the rest. No missed renewals since.

flowchart TB
    A["Certificate declared in Git"] --> B["cert-manager<br/>Helm, per namespace"]
    B -->|request| C["Venafi<br/>security approval"]
    C -->|signed certificate| B
    B --> D["Kubernetes Secret"]
    D --> E["Ingress · services · Kafka"]
    classDef src fill:#0f766e,stroke:#0f766e,color:#ffffff
    classDef step fill:#e0f2f1,stroke:#0f766e,color:#134e4a
    classDef gate fill:#fff4e5,stroke:#d97706,color:#7c2d12
    classDef out fill:#e0f2fe,stroke:#0369a1,color:#0c4a6e
    class A src
    class B,D step
    class C gate
    class E out

Jenkins shared libraries in Groovy and GitHub Actions workflows that developers and QA release through: builds from Bitbucket, Checkmarx SAST as a gate, images in Harbor, Flux for GitOps deploys to EKS. Cut build and test time for a Lerna monorepo by about half.

flowchart LR
    A[Bitbucket] --> B["Jenkins /<br/>GitHub Actions"]
    B --> C{Checkmarx SAST}
    C -->|pass| D[Harbor]
    D --> E[Flux]
    E --> F["EKS<br/>dev → prod"]
    classDef src fill:#0f766e,stroke:#0f766e,color:#ffffff
    classDef step fill:#e0f2f1,stroke:#0f766e,color:#134e4a
    classDef gate fill:#fff4e5,stroke:#d97706,color:#7c2d12
    classDef out fill:#e0f2fe,stroke:#0369a1,color:#0c4a6e
    class A src
    class B,D,E step
    class C gate
    class F out

From an empty AWS account to devices in customers' homes: clustered HiveMQ (MQTT 3.1 and 5) with authentication and authorization; Kafka, Kinesis, Firehose and SQS pipelines; MongoDB, Cassandra, DynamoDB, RDS and Redis; Kubernetes built with kops and kubeadm; blue-green releases; ELK and Prometheus monitoring. Then I ran it: AWS bill down ~30% and broker performance up ~40% after fixing crypto and code-path issues.

flowchart LR
    D[IoT devices] -->|MQTT over TLS| H["HiveMQ cluster"]
    APP[Mobile app] --> GW["API Gateway<br/>Lambda · Cognito"]
    H --> K["Kafka · Kinesis<br/>Firehose"]
    K --> DB[("DynamoDB · MongoDB<br/>Cassandra · RDS · Redis")]
    K --> S3[(S3)] --> CF[CloudFront]
    classDef src fill:#0f766e,stroke:#0f766e,color:#ffffff
    classDef step fill:#e0f2f1,stroke:#0f766e,color:#134e4a
    classDef gate fill:#fff4e5,stroke:#d97706,color:#7c2d12
    classDef out fill:#e0f2fe,stroke:#0369a1,color:#0c4a6e
    class D,APP src
    class H,GW,K step
    class DB,S3 out
    class CF out

• Shared pipelines that take other teams' AI applications to production on AWS Bedrock, using IRSA instead of long-lived AWS keys.
• Internal MCP servers for AWS, AWS Knowledge Base, Atlassian and Instana, so on-call engineers get context in one place. MCP also keeps our Confluence docs current.
• Bedrock RAG over runbooks and incident history, plus a local RAG stack on Ollama, FastMCP and ChromaDB.
• SmartOps (internal AI hackathon): one search across Jira and Confluence to find related incidents faster.

• Kubernetes spend down ~15%: right-sized workloads, cluster downscaler, non-production shut down at weekends.
• RDS, DocumentDB and ElastiCache spend down ~20%: right-sized instance classes, idle capacity removed.
• ~25% faster issue resolution: one log format for frontend, backend and platform services in OpenSearch.
• Reworked dashboards and alerts to cut noisy pages; set and report SLOs and MTTR; lead incident RCA and postmortems.