I take snowflake Kubernetes clusters, overcommitted hypervisors and hand-built virtual machines and rebuild them as version-controlled platforms: GitOps with a Dev → Test → Prod cascade, golden images on bare metal, and identity-driven access that holds up in an ISO 27001 audit. No unplanned downtime, no proprietary lock-in.
Reconcile the fleet to declared state.
These are not hypothetical. Every engagement below started in one of them — usually two at once, with a deadline attached.
Twenty-some Kubernetes clusters, each drifted a little further from the last one. Nobody can tell you the exact configuration of production. Platform upgrades break workloads, and everyone waits for the one person who remembers how it was installed.
Hundreds of hand-built virtual machines eating 100% of the on-prem hardware, and the quote for new hosts is months out. Moving to a public cloud would double the monthly bill for a workload that never needed it.
A flat network, shared SSH keys, no central logging, no idea who touched what. Compliance asks for evidence you cannot produce, and the deadline is already in a signed contract.
Forty-minute pipelines, agents that fall over at peak, dependencies downloaded from scratch every run. Every release is a coin flip, and the team quietly stops shipping on Fridays.
Recent platform engagements. For each one: the state I walked into, the architecture I put in place, and what changed — stated only as far as I can stand behind it.
Tens of Kubernetes clusters and a set of shared platform services — ingress, certificate management, DNS, monitoring — each configured a little differently. Platform component upgrades regularly broke team workloads, because no team had a way to test its services against the incoming platform version.
Moved the platform into a GitOps repository driven by Argo CD and introduced a cascaded release model: Dev on the latest version, Test one step behind, Prod two steps behind. Standardised the observability stack on Grafana, Loki and Thanos, managed the CI/CD execution agents (GitHub runners, Azure DevOps agents) and owned platform networking — DNS, firewall, CNI.
Configuration drift is gone: platform state is declared in Git and reconciled automatically. Engineering teams can validate their workloads ahead of production instead of meeting a platform upgrade in prod, and cluster changes became reviewable like any other code.
Hundreds of Hyper-V virtual machines built by hand over the years, on ageing operating systems, with the on-prem hardware pinned at capacity — which was blocking new client projects. At the same time the company needed infrastructure that could stand up to an ISO 27001 audit.
Built an Ansible-driven golden image that deploys identically on the existing Hyper-V estate and on new Hetzner bare-metal servers. Stood up RKE2 clusters managed through Rancher, mapped Active Directory LDAP groups onto Rancher projects and namespace-level Kubernetes RBAC, put two-factor SSH access on the nodes, segmented the network with Cilium, and wired the full telemetry and security stack — Wazuh SIEM, ELK, Icinga, Percona PMM, Grafana. Owned the asset and risk registry and the wider Microsoft estate: domain controllers, certificate authority, NPS/RADIUS, DNS, GPO — plus the MikroTik and Cisco ASA network.
New production clusters delivered on Hetzner from the same image that runs on-prem, capacity freed on the existing hardware, and access control documented well enough to hand an auditor a real answer instead of a shrug. No unplanned downtime through the migration.
A SaaS platform that scans trading charts, detects patterns and fires alerts in near real time. It ran as a monolith with manual deployments, and a single failing component could take down the whole service — usually precisely when the market got interesting and traffic spiked.
Split the monolith into a few focused microservices — data ingestion, pattern detection, alerting — and ran them on a highly available Kubernetes setup with auto-healing and independent scaling of the scan workers. Automated infrastructure with Ansible and delivery with GitHub Actions, and connected the company network over a WireGuard mesh with strict ACLs.
The platform held through peak market-volume spikes without user-visible outages, and scan workers now scale on their own instead of dragging the rest of the system with them.
I do not sell pre-made packages or bill by the hour. Every platform has its own failure mode. We diagnose the bottleneck first, define the technical deliverables, and agree on how we work together based on what the system needs.
For teams where every cluster has become an unmanaged snowflake and platform component upgrades break application workloads.
For infrastructure where hypervisors are pinned at maximum capacity and moving to public cloud would inflate operating costs.
For platforms facing enterprise security scrutiny, client audits, or regulatory compliance deadlines.
For engineering organizations whose delivery pipelines take tens of minutes and whose build infrastructure creates deployment anxiety.
Available through EU B2B invoicing (reverse-charge with valid VAT ID), independent contractor agreements, or direct employment / fractional platform leadership. The commercial structure adapts to your procurement requirements.
We execute a mutual non-disclosure agreement before I inspect a single repository, configuration file, or network topology. Access is strictly via your VPN/bastion with temporary, least-privilege credentials.
Three architectures I have put into production, drawn as they actually work: where state comes from, how it reaches the clusters, and what enforces the boundaries. Pick one and watch the path.
Prod (N-2), Test (N-1), and Dev (Latest) environments allowing engineering teams to test 2 releases ahead.
Five years of large-scale 5G CI/CD pipelines at Ericsson Nikola Tesla, followed by production platform, SRE and systems administration roles across Kubernetes fleets and hybrid enterprise infrastructure. Currently System Administrator at Bind Technologies.
Full CV (PDF)Own the infrastructure behind the messaging platform: the Microsoft estate (domain controllers, certificate authority, NPS/RADIUS, DNS, GPO), an on-prem Hyper-V estate of hundreds of VMs standardised through an Ansible golden image, RKE2 clusters managed in Rancher, and network policy on MikroTik and Cisco ASA. Built the observability and security stack (Wazuh SIEM, ELK, Icinga, Percona PMM, Grafana) and manage the asset and risk registry for ISO 27001 compliance.
Developed and maintained a multi-cluster Kubernetes platform and its shared services. Led the migration to a GitOps workflow, managed CI/CD execution agents (GitHub runners, Azure DevOps agents), platform networking (DNS, firewall, CNI) and the standardised observability stack on Grafana, Loki and Thanos.
Built the highly available Kubernetes infrastructure, broke the monolith into scalable microservices, automated infrastructure with Ansible and application delivery with GitHub Actions, and designed the company network on WireGuard with ACLs.
Single DevOps engineer for a portfolio of custom applications: production and development environments on a self-hosted Kubernetes cluster, deployment and CI/CD automation with Gitea, distributed PostgreSQL on Kubernetes, containerisation of applications, observability, and VPN/networking setup.
Built and maintained complex multi-stage software integration pipelines for 5G products, including deep Jenkins work — shared libraries in Groovy, scripting in Bash and Python — inside an Agile/Scrum team, alongside Linux management and mentoring.
Programmed and configured Siemens systems in TIA Portal, designed HMI interfaces in WinCC, produced electrical schematics and documentation in AutoCAD, coordinated technical requirements with clients, and worked abroad on installation projects for an oil refinery.
Modelled control panels and internal components in SolidWorks, produced project documentation, and assembled, wired and tested industrial automation cabinets.
Four steps, in this order. The first one is free and honest — if the problem is not worth fixing yet, or is not mine to fix, I will tell you that on the call.
You describe the system, I ask the questions that usually hurt: what happens during a platform upgrade, who holds the SSH keys, when was the last restore test, what is the actual failure mode. No slide deck, no sales engineer in the room.
What I found, what I would change, what it costs and what you receive at the end. Fixed deliverables rather than open-ended hours, so you can decide with a number in front of you.
I work in your repositories and your clusters, with your access model, alongside your engineers. Changes go through the same review and change process your team uses — no parallel shadow infrastructure, no credentials I keep afterwards.
Repositories, golden images, runbooks and the audit evidence, plus a walkthrough with the people who will maintain it. The goal is that you do not need me next quarter — a retainer is optional, not the business model.
Versioned infrastructure that can be rebuilt from scratch, an upgrade path that has been tested two cycles ahead, access control that produces evidence, and a documented answer to “what happens if this breaks?”
No AI-washing, no promised 10× velocity, no reselling a cloud or observability subscription, and no invented uptime numbers. If I cannot measure it, it does not go on your slides or on this site.
Confidentiality, access, scope, billing, what happens afterwards. If something is still unclear after this, ask it on the call — I would rather answer it directly than have you guess.
A mutual NDA is signed before I look at a single configuration file, repository or network diagram. Access is granted through your own VPN or bastion, with temporary least-privilege credentials and two-factor authentication — never a permanent shared key. Whatever I touch, your change process reviews first.
It starts with a short technical review: you describe the system, I ask the uncomfortable questions, and we find where it actually breaks. From there I write down what I would change and what you receive. Only then do we decide how to work together — a defined piece of work, a few days a week alongside your team, or ongoing platform ownership.
Neither is the starting point. I do not sell pre-made packages or bill by the hour. Every system fails in its own way, so the scope comes out of the review, not out of a brochure. What I do commit to is concrete deliverables — repositories, golden images, runbooks, evidence — that your team keeps and can run without me.
I can work through EU B2B invoicing with a valid VAT ID (reverse charge for EU business clients), independent contractor agreements, or direct employment / fractional leadership. The commercial structure is adapted to your procurement — I am not going to lose a project over an invoicing format.
Every piece of work ends with documentation, runbooks and a walkthrough for the people who will maintain it. The goal is that you do not need me next quarter. If you want periodic reviews or an escalation path after delivery, we can agree on that separately.
Primarily remote across the EU, working in CET business hours, with asynchronous communication and agreed check-in points. Travel to your site is possible for kick-off workshops, migration cutovers or incidents where being in the room genuinely helps.
That is the usual setup. I work inside your repositories and your clusters, using your branch protection, review rules and change process — not a parallel shadow environment. Part of the job is leaving your engineers able to run and extend what was built, so pairing and handover are built into the work rather than added at the end.
Bring the real state of the platform: how many clusters, who holds the root keys, what the last upgrade actually cost you. If it is a problem worth fixing, I will tell you how I would approach it — and if it is not, I will tell you that too.
Picks a slot directly in my calendar — no back-and-forth. Prefer email? Write to dorianmausa@gmail.com or copy the address above.