# Brandon Donaly (Pakkit) — Resume

> Canonical: https://pakkit.net/resume · Contact: https://pakkit.net/contact · Site: https://pakkit.net/
> Machine-readable mirror of the sanitized public resume.

I work across platform automation, infrastructure, security, networking, and AI-assisted development, with 20+ years of hands-on software, networking, systems, and security experience. Most recently I spent 21 months as a Wireless Engineer III on the AAA/RADIUS authentication platform behind a national carrier's WiFi offload service.

There I converted runbook-driven deployments into 6 versioned Ansible collections, owned a Cassandra operations programme, reverse-engineered undocumented RADIUS accounting logic into a behavioural-parity baseline for a platform rewrite, and built automation and test platforms across infrastructure, release engineering, security, and telecom policy.

Later work included a deployed engineering chat assistant, native application SSO, infrastructure inventory reconciliation, and a Cassandra UDF optimization measured in development benchmarks.

## Headline numbers

_Selected evidence from the completed Charter engagement. Output counts reflect an early-August 2026 snapshot of the project tracker, GitLab, git history, and internal wiki; later work is described in the experience record._

- **21 months** — Contract engagement. Nov 2024 – Aug 2026, start to end of the engagement.
- **5** — Platform areas owned concurrently. Deployment automation, Cassandra, AAA policy, security remediation, and the lab supply chain.
- **180** — Tickets delivered. Shipped and verified across those 5 areas.
- **248** — Merge requests merged. Across 31 repositories; sole author in 21 of them.
- **6** — Versioned Ansible collections. Replacing hand-run runbook deployment. Sole commit author on all 6.
- **29** — Tagged releases. Shipped across those 6 collections.

## What I can do for your team

- **Turn manual, high-risk runbooks into versioned automation.** I turn hand-run deployment procedures into tested, versioned collections with dry-run reports, verification, and rollback paths, and build configuration tooling that keeps environment selection explicit. _Evidence: Charter Communications (Spectrum)._
- **Own database reliability end to end.** Verified backups, rehearsed restores, topology and upgrade planning, and performance work measured against compatibility constraints—including a development UDF benchmark reduced from 12.47 ms to 0.70 ms. _Evidence: Charter Communications (Spectrum); Operational Tooling & Agent Skills._
- **Reverse-engineer and rebuild protocol behaviour with evidence.** When the specification is missing I derive it from logs and packet captures, establish a parity baseline, and rebuild against it with replay tooling so the rewrite can be proven, not argued. _Evidence: Charter Communications (Spectrum)._
- **Build test platforms that retire manual certification work.** Web and CLI platforms, mobile automation, gRPC contracts, and fleet-scale executors that replace repeated manual passes with repeatable evidence. _Evidence: Charter Communications (Spectrum)._
- **Secure fleets, pipelines, and identities.** Endpoint controls, audit-event forwarding, hardening, service identities, and native SSO with group-driven provisioning and tested allow/deny behavior. _Evidence: Charter Communications (Spectrum); Identity Platform Engineering._
- **Design and run networks from the fiber to the RADIUS policy.** Founder-grade network engineering: multi-frequency wireless plant, captive-portal AAA, TR-069 fleet provisioning, hardened core routers, and identity-gated ingress for everything behind them. _Evidence: Duvall WiFi; Wilderness Awareness School; Private Cloud & Homelab Platform Engineering; Charter Communications (Spectrum)._
- **Ship production software across Java, PHP, Python, and TypeScript.** Lead-generation platforms, identity providers, protocol servers, integrations against third-party APIs, and static-site pipelines, each with tests and a delivery path. _Evidence: Pacific Northwest Plumbing; Game Platform, Identity & Reverse Engineering; Website Factory & Edge Delivery; Additional Engineering Projects._
- **Apply AI agents with real governance.** A deployed engineering chat assistant with separate read-only tool gateways and caller/tier isolation, plus constrained MCP APIs, explicit change controls, and evidence tools challenged with negative tests. _Evidence: Charter Communications (Spectrum); AI Integration & Security Engineering; Multi-Agent Engineering System Design; Operational Tooling & Agent Skills._
- **Recover incidents to root cause and prove the fix.** I trace incidents across application, database, storage, and infrastructure boundaries, verify service recovery, and keep unfinished prevention work visible. _Evidence: Private Cloud & Homelab Platform Engineering; Charter Communications (Spectrum)._
- **Operate as a founder, not only an engineer.** Customer discovery, architecture, delivery, field installation, support, billing, and growth analytics, with measured outcomes such as a customer-acquisition cost cut from roughly $150 to $5.10. _Evidence: Duvall WiFi; Pacific Northwest Plumbing._
- **Document and enable so the work survives me.** Certified installation guides, onboarding suites for undocumented languages, mentoring, IDE tooling, and a curated engineering knowledge base published behind a per-note gate. _Evidence: Charter Communications (Spectrum)._

## Experience

### Wireless Engineer III — AAA Development & Platform Automation — Charter Communications (Spectrum)

_Nov 2024 – Aug 2026 · Previous role_

Wireless Engineer III on a national carrier AAA/RADIUS platform supporting subscriber WiFi authentication, roaming, and accounting workflows.

I joined in integration testing and was promoted into development after six months, then expanded into a cross-cutting platform role spanning telecom policy, infrastructure automation, database reliability, release engineering, security, test platforms, lab operations, and technical enablement.

Across 21 months I took on 5 platform areas; the early-August evidence snapshot records 180 completed tickets and 248 merged merge requests across 31 repositories.

**Scope owned concurrently:**
- AAA deployment automation: versioned Ansible collections for deployment, upgrades, policy changes, auditing, and rollback.
- Cassandra platform operations: backup and restore, topology and upgrade planning, UDF performance optimization, and migration analysis.
- AAA policy engineering: behavioural-parity work for a platform rewrite and accounting workflows.
- Security and compliance automation: endpoint controls, audit-event forwarding, native application SSO, and group-based access.
- Developer and lab enablement: VM provisioning, inventory reconciliation, CI/CD, automated testing, a deployed engineering assistant, and evidence tooling.

**Infrastructure automation (Ansible):**
- Converted runbook-driven platform deployment into 6 versioned Ansible collections with 29 tagged releases in 76 days, covering deployment, database operations, system administration, VM preparation, orchestration, and preflight checks.
- Built the team's first collection release pipeline and test strategy, including 403 automated tests and 96 property-based tests in the earlier suite snapshot, parallel pytest execution, automatic versioning, artifact publication, and shared CI templates. Later deployment safeguards were challenged at 16 injected failure points and with 13 deliberate role mutations, checking preservation of a startable previous release.
- Decomposed a monolithic deployment role into separate install, policy, and helper roles so routine policy changes could ship without replacing platform software.
- Added dry-run audit reporting so operators could inspect a proposed change before authorizing execution.
- Built a systemd-enabled Docker test harness so role changes could be validated locally instead of consuming shared lab capacity.
- Replaced a multi-step manual deployment handoff with a single-command, version-pinned, idempotent deployment supporting roughly one-minute policy-only updates, dry-run impact reports, post-deploy verification, offline bundles, and sub-second symlink rollback.

**Database engineering (Cassandra):**
- Owned the Cassandra operations programme and shipped 14 tagged releases in roughly four weeks while the work moved through formal QA certification.
- Automated backup and restore end to end with scheduling, retention, verification, capacity checks, retries, and alerting, replacing an inconsistent manual process.
- Removed a data-integrity footgun in backup naming by adding fail-fast validation and then autodiscovery.
- Implemented mutual-TLS support and service-account-safe certificate discovery for production-equivalent environments.
- Rehearsed a high-risk multi-node topology change against an isolated replica before executing the live change successfully.
- Performed encrypted-data migration analysis, load simulation, and operator-workflow simplification, cutting the planned manual input from roughly twelve variables to four.
- Designed a Cassandra 4.1-to-5.0 rolling-upgrade path for the subscriber-authentication clusters.
- Optimized a legacy Cassandra decryption UDF, reducing development-benchmark mean latency from 12.47 ms to 0.70 ms and increasing 16-thread throughput from 635 to approximately 13,100 operations per second; scoped equivalence and round-trip compatibility checks to the tested variants.
- Released a database-automation fix spanning four CQL roles, correcting credential propagation and variable-precedence defects; tested the published package against operator instructions with a CQL stub and repaired five documentation errors while real-cluster recertification remained pending.
- Diagnosed and closed an availability defect in a subscriber-authentication database where crafted input to its encryption and decryption user-defined functions could bring the cluster down.

**CI/CD & release engineering:**
- Root-caused recurring release blockers across build images, registry routing, and artifact authentication, then replaced repository-local workarounds with shared templates. Reconciled three policy-bundle packaging paths and added checks against overwriting vendor runtime files, resolving inconsistent branch and merge-request validation.
- Stood up a self-hosted CI runner for policy validation and built a multi-architecture base image for arm64 and amd64 development workflows.
- Moved collection publishing onto a shared tag-driven release pipeline with dedicated service credentials and manual approval gates for deployment-sensitive actions.
- Brought the team's repositories to a green compliance pipeline and added automated documentation publication behind approval gates.
- Administered a 12+ repository GitLab group, establishing Git Flow, CODEOWNERS, pipeline-gated merges, branch protection, artifact conventions, and reusable templates across the AAA automation portfolio.
- Migrated a development policy configuration to templated values and encrypted secrets while preserving byte-identical output across all 62 rendered files; credential rotation remained a separate follow-up.

**Security & compliance:**
- Automated deployment of endpoint security, endpoint management, software inventory, vulnerability management, and MFA controls across a pre-production fleet.
- Delivered SIEM log-forwarding automation covering platform and operating-system logs across multiple fleet layouts. Automated enriched Linux audit-event forwarding across six development nodes, resolving SELinux and audit-daemon integration failures and using queued TCP delivery for centralized investigation.
- Remediated tracked vulnerability findings to closure, introduced safer package-manager-native maintenance operations, and delivered a certified upgrade path for legacy Linux hosts.
- Moved source-control permissions onto directory-backed groups and moved CI pipelines off personal credentials onto dedicated service accounts.
- Added repository safeguards that keep lab secrets out of policy source control.
- Automated directory-backed SSO across engineering tools using SAML, OIDC, and OAuth, including group-driven account provisioning and role mapping, tested allow/deny behavior, and preserved local recovery access.
- Shipped CIS-aligned kernel and SSH daemon hardening as a fleet role, validating each generated daemon configuration with a syntax check before applying it and ordering the drop-in files so the existing access policy stayed authoritative instead of being silently overridden.
- Removed a destructive failure mode from fleet kernel maintenance by replacing two fragile shell steps with an explicit running-kernel check and an old-installs-only removal, so the automation could no longer delete the kernel the host had actually booted.

**Network & protocol engineering (RADIUS / EAP):**
- Reverse-engineered undocumented RADIUS accounting field derivations from policy logs and packet captures, establishing a behavioural-parity baseline for a platform rewrite.
- Rebuilt individual accounting derivations to verified parity against that baseline and created replay tooling for repeatable protocol validation.
- Designed and delivered a state-persistence layer for a telecom policy runtime, then removed 16,390 lines of legacy code using execution evidence to prove what was genuinely unused.
- Diagnosed difficult mutual-TLS and protocol-integration failures across RADIUS-over-TLS and a legacy subscriber-state interface.
- Sole-engineered a ground-up accounting-policy rewrite in the vendor policy DSL: 181 commits in roughly two and a half months across 15+ modules and 30+ configuration files, with CI/CD, defensive protocol parsing, LDAP failover, RADIUS/RadSec forwarding, and a documented 87-code operational logging registry.
- Implemented a single-probe write/read/delete smoke harness for every state model, turning multi-minute manual verification into sub-second post-deploy validation in a DSL with no debugger or stack traces.
- Diagnosed two independent causes of silent RADIUS accounting health-check failures—a runtime compatibility issue and missing protocol attributes—and validated the corrected probe with 12 of 12 successful live responses at approximately 140 ms median latency; load-balancer monitor deployment remained pending.
- Root-caused a TLS handshake failure blocking OAuth2 token retrieval by isolating the ALPN extension in the ClientHello as the trigger, eliminating DNS resolution, TCP reachability, certificate interception, TLS version negotiation and general HTTPS egress with a positive control for each, then proving with a four-variant differential matrix that the reset followed the extension being present rather than the protocol offered, and restoring token issuance the same day.

**Test automation & QA:**
- Designed and shipped a Spring-based web platform for 802.1X/EAP supplicant test automation with configuration generation, credential handling, containerized execution, result parsing, dashboards, SIEM query integration, and automated delivery.
- Architected the platform as eleven Java 23 / Spring Boot modules with nine reusable Maven modules, multi-architecture Docker delivery, and 70 test classes containing more test code than production code, all sole-authored and able to survive 30-way parallel execution.
- Built an end-to-end AAA testing platform spanning a typed Python library, operator CLIs, Android and iOS Appium automation, Docker, and gRPC; it collapsed repeated manual SIEM queries into a single call across 120+ tests and saved an estimated 6–10 engineer-hours in one certification cycle.
- Automated 11 previously manual integration tests, reclaiming about 3.7 engineer-hours per full pass, and built a containerized pre-deployment policy validation gate across seven repositories, where policy bundles must boot in the AAA runtime and clear a 13-pattern fatal-error screen before publication.
- Defined and executed a roughly 30-case release regression suite spanning multiple EAP methods, mobile platforms, roaming scenarios, Passpoint, and negative cases.
- Designed the shared cross-language contract layer (four gRPC services, eight RPC methods, 13 messages, and eight enums) consumed by Java and Python tools for session control, provisioning-cache operations, SIEM queries, and supplicant configuration.
- Built the companion portable task-executor agent in Python spanning four CPU architectures, with Kafka result signals, RADIUS/EAPOL probes, REST task discovery, and CI packaging, targeting a roughly 79-host lab fleet across two data centers and four environment tiers.
- Produced the certification evidence package for a carrier AAA platform release, assembling roughly 90 attachments of policy logs, packet captures, encryption and decryption traces, protocol replay files and device captures across three months.
- Shipped PowerShell automation for reconfiguring wireless settings on Android test devices three weeks into the engagement, extracting profile selection, device serial handling and address validation into a reusable module across nine merged merge requests.

**Virtualization & lab platform:**
- Automated VM provisioning from template preparation through cloud-init self-deployment, including dual-stack IPv4/IPv6 addressing and an IPv6-only defect that had been breaking unattended provisioning. Built and verified a Rocky Linux golden template, then provisioned eight database VMs and checked unique machine identities and SSH host keys on every running guest.
- Built control-node preflight checks that report automation readiness before a run touches infrastructure.
- Delivered supporting engineering services including reverse proxying, status reporting, monitoring alerts, and team alert integrations.
- Validated a major ESXi upgrade on live infrastructure and surfaced a lifecycle risk early enough for it to be resolved before an outage.
- Automated vSphere snapshot restore and environment-aware artifact retrieval, including a SOAP-to-pyVmomi migration, SOCKS5 support, remote DNS, and lab/production artifact-repository fallback so workflows behaved consistently across network segments.
- Built repeatable IPAM import and drift-audit tooling, reconciled a 233-VM development inventory, and populated a separate integration-test inventory covering 62 VLANs, 144 subnets, and 176 addresses using hypervisor, host, and telemetry evidence.
- Restored an internal application's login service by tracing failed database session writes to disk exhaustion caused by a cascading Redis and container-logging failure; reclaimed capacity and prepared log-rotation controls.

**Documentation & enablement:**
- Authored 69 internal wiki pages over the engagement, including installation guides carried through formal QA certification.
- Wrote an 11-page developer-onboarding suite for an internal policy language and runtime covering language reference, conventions, repository structure, testing, secrets handling, releases, and troubleshooting.
- Wrote internal proposals that set direction for collection-based automation, automated deployment, and software lifecycle planning.
- Operationalized a 935-note engineering knowledge base as team documentation, publishing a curated 229-note subset behind an explicit per-note publication gate.
- Mentored engineers on Git and tooling and built an IDE plugin for the platform's policy language.
- Built and deployed a TypeScript Webex assistant for engineering knowledge lookup, with access configured for 12 teammates, separate read-only tool gateways, and conversation isolation by caller and privilege tier; verified lookup and refusal behavior through live messaging.
- Built reusable AI-workflow tools for engineering evidence retrieval, outbound sanitization, and document consistency, with 193 passing assertions and negative tests; corrected repository-counting errors caused by duplicate counting of repository history and uninitialized submodules.
- Built and maintained a library of roughly 54 reusable AI agent skills across three engineering workspaces, codifying workflows for infrastructure operations, investigation and evidence gathering, security remediation, documentation, configuration management and telecom policy work, and authored an audit that reconciles all three workspace roots in a single run to flag duplicated skills, dead bundled-file references, one-sided skill boundaries, and colliding trigger phrases that would otherwise make agent dispatch nondeterministic.
- Carried the platform automation portfolio as its sole maintainer in 21 of the 27 codebases surveyed, spanning configuration management, telecom policy, test platforms and operational tooling with no second commit author.

**Infrastructure automation (Ansible) (in progress):**
- Designed deployment-time configuration and secrets tooling that separates reusable policy artifacts from environment values and versioned encrypted secrets; released the deployment component with environment validation, provenance tracking, and compatibility checks while broader rollout remained in progress.

**Documentation & enablement (prototype):**
- Prototyped a per-engineer status ledger using two weeks of real work, identified conflicts in hand-maintained reporting, and designed a refreshable contribution model around existing Jira fields; recurring automation and broader adoption remained next steps.

**Database engineering (Cassandra) (in progress):**
- Piloted a Kubernetes operator deployment model for a carrier subscriber-authentication database tier and released a dedicated collection for it, with the pilot still open at the end of the evidence window.

**Security & compliance (in progress):**
- Scoped an environment-wide security remediation programme into seven tracked work items covering agent staging, operating-system patching, MFA, SIEM forwarding and a follow-up security assessment, delivered the first of them, and kept the rest moving while one item stayed blocked on an approval process outside his control.

Stack: Ansible · Cassandra · Nokia AAA / TAL · RADIUS / RadSec · EAP-AKA / EAP-TTLS · 802.1X · Passpoint · GitLab CI · Artifactory · Docker · Kubernetes · Splunk · VMware vSphere · cloud-init · RHEL / Rocky · Ubuntu · Python · Java 23 / Spring Boot · Appium · gRPC / proto3 · PowerShell · TypeScript · Webex · MCP · Authentik · SAML / OIDC · phpIPAM · SOPS / age

### Founder / Principal Engineer — Duvall WiFi

_Aug 2022 – Nov 2024 · Previous role_

Founded and ran a technology and ISP services company, owning customer discovery through implementation, operations, billing, and support.

**Selected accomplishments:**
- Founded and ran a technology and ISP services company covering network engineering, software development, hosting, cybersecurity, and managed IT. I owned customer discovery, architecture, implementation, production operations, sales, billing, and support.
- Built a redundant multi-frequency wireless network capable of serving 160 homes with symmetric gigabit, backed by custom captive-portal and RADIUS software plus virtualized infrastructure, PKI, segmentation, monitoring, VPN connectivity, PBX/CRM integrations, and production Laravel and Spring applications.
- Built the custom Spring Boot captive-portal and AAA backend implementing the FreeRADIUS REST hook surface for authorization, authentication, interim accounting, post-auth, and proxy phases, plus MikroTik hotspot redirect and prepaid-voucher flows.
- Implemented defense-in-depth portal authentication with brute-force throttling, GeoIP impossible-travel detection, device fingerprinting, reCAPTCHA, and JWT-based hotspot session tokens.
- Built and operated a three-host VMware vSphere/vSAN environment with data-center colocation, an air-gapped root CA, zero-trust segmentation, secure administrative workstations, SIEM monitoring, VM templates, and hub-and-spoke VPN connectivity across customer networks.
- Installed and spliced indoor and outdoor fiber and copper cabling, engineered point-to-point links, performed site surveys, and maintained routers, switches, access points, and RF paths as the company's field engineer.
- Operated a GenieACS TR-069/CWMP platform managing 58 MikroTik and Yealink devices through 15 presets and 15 provisions, documented its tag-driven idempotent configuration state machine, and identified security, permissions, provisioning, and device-health defects through live read-only analysis.
- Built a communications single pane of glass integrating the VoIP PBX, CRM, missed calls, voicemail, text, and email, with call flows and customer pop-ups that cut spam and sped up resolution.

**Selected accomplishments (analysis):**
- Performed an owner-authorized, zero-impact attack-surface assessment across a roughly 12-service production presence using DNS and certificate-transparency reconnaissance, endpoint and auth-flow review, CORS and header testing, and vantage verification; delivered ranked remediation and disproved two initial split-horizon false positives before reporting.

Stack: Founder · Wireless ISP · FreeRADIUS · Spring · Laravel · VMware vSphere / vSAN · PKI · Zero-trust segmentation · SIEM

- Case study: https://pakkit.net/projects/duvall-wifi

### Technology & Growth Consultant — Pacific Northwest Plumbing

_Jun 2023 – Nov 2024 · Previous role_

Delivered technology and growth consulting for a trades business across software, analytics, customer acquisition, and support.

**Selected accomplishments:**
- Technology and growth consulting for a trades business. I brought customer acquisition cost down from roughly $150 to $5.10 and shifted 83.67% of inbound calls onto unpaid channels, working across the website, analytics, advertising, reviews, and conversion paths.
- Delivery included a Laravel 10 production website, conversion tracking, advertising workflows, helpdesk support, and custom IP-camera security integrations.
- Built the lead-generation application in Laravel 10 with Nova administration, reCAPTCHA v3 score-based filtering, Google and Microsoft paid-click attribution, and dual-channel lead alerting, then replatformed it to static Astro once the dynamic attack surface was no longer justified.

**Selected accomplishments (analysis):**
- Analysed roughly 2,000 jobs, 1,350 customer records, 1,990 invoices, and 570 estimates to produce a constraint-based growth plan, KPI scorecard, CRM clean-up programme, retention strategy, acquisition playbook, and a buyer-ready data-room structure.

Stack: Laravel · Analytics & conversion tracking · Advertising workflows · Helpdesk · IP-camera integrations

### Network & Systems Consultant — Wilderness Awareness School

_Nov 2022 – Nov 2024 · Previous role_

Delivered network and systems consulting for a multi-property school in challenging rural terrain.

**Selected accomplishments:**
- Designed, quoted, installed, and operated a resilient enterprise network across three forested properties using roughly 700 meters of aerial and buried cabling plus point-to-point wireless links. The design avoided the cost of an additional internet circuit and improved outage resilience.
- Ongoing support covered routers, switches, access points, point-to-point wireless links, structured cabling, monitoring, and day-to-day technical support for staff.

Stack: Enterprise networking · Point-to-point wireless · Structured cabling · Monitoring · End-user support

### Technical Consultant — Beyond Grey Skies, LLC

_Mar 2016 – Jun 2021 · Earlier chapter_

Provided enterprise network, server, and technical operations consulting.

**Selected accomplishments:**
- Supported enterprise networks, data-center fabric, Linux and Windows servers, intrusion monitoring, and emergency technical operations, working across pfSense, VyOS, MikroTik RouterOS, and Cisco IOS.

Stack: pfSense · VyOS · MikroTik RouterOS · Cisco IOS · Intrusion monitoring · Data-center fabric

## Independent projects

### Identity Platform Engineering — Independent project

_2026 · Independent project_

Deployed a self-hosted identity platform with reproducible infrastructure and group-based application access.

**Selected accomplishments:**
- Deployed an Authentik identity platform using Ansible, Docker Compose, declarative Blueprints, and Terraform-managed Cloudflare Access, with OIDC group claims for application authorization.
- Verified signed identity tokens, allow/deny behavior, group-removal revocation, deactivated-user denial, and configuration reapplication through 20 infrastructure checks and a ten-check identity suite.
- Validated idempotent deployment and unattended reboot recovery, and preserved existing access policies during additive application migration.
- Imported the existing edge-access applications into Terraform without recreating them, preserved fallback login paths, and caught destructive nulling of previously unmanaged fields in plan review before it reached production.
- Operate the platform as a product: invitation flows, a documented two-change procedure for putting an application behind OIDC or SAML login, service tokens for machine callers, and a maintained trap list so protected applications work the first time.

Stack: Authentik · OIDC · Ansible · Terraform · Docker · Cloudflare Access

### AI Integration & Security Engineering — Independent project

_2026 · Independent project_

Built an authenticated MCP gateway connecting AI tooling to a private CRM, with live reads and controlled write paths.

**Selected accomplishments:**
- Built a Cloudflare Worker MCP gateway with OAuth 2.1 and per-client capability tokens, authenticated origin access, and a constrained API to a private CRM.
- Implemented review-first ingestion controls, dry-run/commit binding, rate caps, auditing, and independent kill switches; live read access is verified and write execution remains disabled.
- Documented 198 passing service tests and drilled kill switches at the edge, reverse proxy, and application layers, with observed shutdown times of approximately 7, 10, and 19 seconds respectively.
- Built a self-hosted CRM and deterministic follow-up engine that converts raw job listings into researched, callable leads with scripts, evidence, reminders, business-hours scheduling, call outcomes, and recovery packets.
- Implemented the engine as a dependency-free Python state machine with idempotent ingestion, duplicate protection, signed-webhook verification, replay safety, time-zone/DST/holiday scheduling, and least-privilege HMAC API access, shipping 101 unit tests and 85 of 85 live acceptance checks.
- Proved recoverability through checksummed daily and weekly backups, a disposable restore that booted a fresh application container with intact records, cross-host migration by restore, and a full VM reboot after which six services returned healthy without intervention.

Stack: MCP · OAuth 2.1 · Cloudflare Workers · Python · nginx · Threat modeling

### Secure Compute & Network Automation — Independent project

_2026 · Independent project_

Built and deployed a credential broker and routing automation for ephemeral rented GPU compute.

**Selected accomplishments:**
- Built a broker issuing short-lived, single-use Tailscale enrollment keys while keeping privileged OAuth credentials off rented hardware, with independent JWT validation for administrative access.
- Automated deterministic virtual-address allocation, constrained gateway routing, and cleanup of expired nodes; verified the full join, permitted-access, blocked-port, and teardown path using a disposable container.
- Validated the implementation with 34 unit tests and 20 gateway ruleset assertions, including fail-closed behavior when configuration is absent.
- Operated a vLLM coding endpoint compatible with the OpenAI Chat Completions, OpenAI Responses, and Anthropic Messages APIs, including native streamed tool calls, so coding agents such as Claude Code, Codex CLI, Cline, and OpenCode work without a translation proxy, with the rented-host trust boundary documented.

Stack: Tailscale · Cloudflare Workers · TypeScript · nftables · OIDC · GPU infrastructure

### Observability as Code — Independent project

_2026 · Independent project_

Terraform-managed monitoring and security analytics for a private homelab, with monitors, log pipelines, and dashboards defined as reviewable code.

**Selected accomplishments:**
- Managed a Datadog observability stack as code: 53 monitors (30 log, 21 metric, two query), four syslog pipelines totalling 46 processors, four log-derived metrics, an indexed log store, and a 17-widget security dashboard.
- Designed a reusable Terraform monitor module with 16 typed, validated inputs, enforced tags, count-gated optional resources, provider locking, and credentials kept out of band.

Stack: Datadog · Terraform / OpenTofu · Log pipelines · Security analytics · Monitoring as code

### Private Cloud & Homelab Platform Engineering — Independent project

_Ongoing · Ongoing_

Operates a three-host VMware environment as a production-grade lab: provisioning automation, isolation analysis, recovery engineering, and network-edge hardening.

**Selected accomplishments:**
- Operate a three-host vSphere/vCenter environment inventorying 149 VMs (86 running), 469 allocated vCPUs, roughly 686 GiB of allocated RAM, eight datastores, and 45 networks across Linux, Windows, RHEL, Debian, FreeBSD, and network-appliance workloads.
- Built repeatable VM provisioning and golden-template workflows spanning cloud-init guestinfo, clone customization, LVM growth, Docker bootstrap, network and IP validation, sysprep, smoke tests, and reusable Ansible and CLI automation.
- Recovered a vCenter outage caused by a full log partition and an expired machine SSL certificate: preserved the valid VMCA root, re-issued only the leaf certificate, restored services with no VM data loss, corrected syslog host attribution, and raised an exhausted file-descriptor limit from 1,024 to 65,536.
- Audited the management and service exposure of a colocated RouterOS core router, validated ordered default-deny containment, and executed a no-reboot reduction of SNMP, bandwidth-test, captive-portal, and obsolete RADIUS exposure while preserving recovery access.
- Built reusable Windows performance and security triage tooling covering hardware, storage health, patching, Defender, firewall, logons, public connections, persistence surfaces, signatures, remote tools, and high-refresh gaming bottlenecks.
- Designed the standard internet ingress for self-hosted services: a Cloudflare edge with WAF and identity-gated Access in front of a core router that admits only Cloudflare's ranges, terminating at an nginx origin with per-hostname Origin CA certificates and authenticated origin pulls across roughly 55 virtual hosts.

**Selected accomplishments (analysis):**
- Performed read-only isolation and hypervisor-risk analysis across the workload, management, vMotion, and vSAN planes, validating layer-2 protections and blocked routing while identifying patch-level exposure to guest-to-host escape vulnerabilities and a high-blast-radius shared-storage design.
- Ran a phased vulnerability audit across an 86-host fleet: port sweep, service and version inventory, advisory-based CVE assessment with false positives rejected on evidence, and a gentler profile plus post-scan health verification for fragile hosts.
- Root-caused vSAN write latency to two stacked causes, an in-flight resync landing on one host's consumer-grade cache SSD and a chronic hardware-compatibility mismatch, then benchmarked the cluster against a Ceph deployment to separate fixable latency from latency that is acceptable by design.

Stack: VMware vSphere · vSAN · cloud-init · Ansible · MikroTik RouterOS · Recovery engineering

### Multi-Agent Engineering System Design — Independent project

_2026 · Independent project_

A governed crew of thirteen AI engineering agents with least-privilege scopes, policy gates, and honest documentation of what the harness can and cannot enforce.

**Selected accomplishments:**
- Designed and maintain a 13-agent engineering crew on a multi-agent harness, with a canonical YAML roster, agent definitions, architecture decision records, least-privilege command and tool scopes, must-allow/must-deny tests, deterministic policy gates, and resource-guard analysis.
- Documented a governance limitation where global permissive settings could bypass agent-level command scopes, separating static scope validation from actual runtime enforcement rather than overstating isolation.

**Selected accomplishments (analysis):**
- Reverse-engineered the harness's provider architecture across provider factories, backend capability sets, spawn paths, model mapping, environment injection, and tool delivery to design credible extension paths for additional model providers, including self-hosted inference.

Stack: AI agents · Agent governance · Kiro · Policy gates · Architecture decision records

### Website Factory & Edge Delivery — Independent project

_2026 · Independent project_

A reusable pipeline that turns sparse profile inputs into container-validated Astro sites with previews, custom domains, and edge APIs on Cloudflare.

**Selected accomplishments:**
- Built a reusable one-shot website factory that turns profile and context sources into container-validated Astro sites, with structured intake, derived themes, generated brand assets, per-PR preview deployments, a promotion path to production, and post-deploy verification.
- Delivered multi-page sites for independent creators from sparse link-page and social inputs, implementing content-safety rules, no-index previews, custom domains, repeatable asset generation, and polling-based certificate and build verification.
- Built a caching Cloudflare Worker API for live photo galleries with a route allowlist, upstream and browser compatibility controls, edge caching, static-build isolation, and navigation-lifecycle handling, integrating third-party feeds without exposing a general-purpose proxy.
- Built pakkit.net as a strict-TypeScript Astro 6 knowledge and portfolio platform with a data-driven service taxonomy, MDX content collections, machine-readable RSS and llms.txt routes, a canonical career bank behind the résumé section, and more than 130 published technical articles.
- Integrated a performer's Astro booking site with their hosted CRM: build-time fetch of upcoming shows with a default-deny public filter, a small proxy that creates contacts and events through the authenticated API after live testing disproved the assumed public form endpoint, UTM lead-attribution passthrough, and a testimonials feed, verified end to end in production.
- Rebased the site factory onto a multi-template architecture, separating a shared asset overlay from per-template application layers behind an explicit overlay contract, guarding token substitution against binary files, and migrating roughly twelve dependent generator skills and their documentation in step, re-validated in a container at three different site-name lengths.

Stack: Astro · TypeScript · Cloudflare Workers · Docker · GitHub Actions · Brand systems

### Multi-Vault Documentation Hub — Independent project

_2026 · In progress_

A private publishing platform where each Obsidian vault gets isolated builds, search, hostname, and identity policy behind layered authorization.

**Selected accomplishments (in progress):**
- Architecting a private multi-notebook publishing platform where each vault has isolated source credentials, builds, search index, image, service, hostname, and identity-group policy.

**Selected accomplishments:**
- Designed layered authorization through Cloudflare Access plus an origin-side gateway that validates JWT signature, issuer, expiry, and exact per-application audience, preventing cross-vault search, graph, attachment, cache, or metadata leakage.
- Provisioned and hardened a dedicated Ubuntu documentation VM through the hypervisor console and cloud-init: independently verified host keys, removed inherited administrative access, locked unused accounts, applied explicit SSH policy, patched and reboot-tested the host, and left only SSH listening on routable interfaces.
- Built a synthetic fixture vault with nine Markdown documents, 31 validated wikilinks and embeds, seven deliberately publishable notes, negative content fixtures, and complete heading-anchor checks to support authorization and isolation testing without exposing personal content.

**Selected accomplishments (analysis):**
- Completed the planning and non-live remediation cycle, correcting a zero-match firewall rule, an impossible reverse-proxy and Compose topology, and an unsafe state-backend assumption before any public or identity-system change.

Stack: Obsidian · Quartz · Authentik · Cloudflare Access · JWT · Terraform · Ubuntu

### Operational Tooling & Agent Skills — Independent work

_2026 · Ongoing_

A library of dependency-free command-line tools for the infrastructure I run, each paired with an agent skill that documents triggers, credential handling, and failure modes so AI assistants operate the estate safely.

**Selected accomplishments:**
- Built dependency-free, standard-library Python CLIs for the systems I operate: a TR-069 ACS client, a RouterOS API client with vSphere lab snapshot and revert, a WireGuard peer minter with IPAM address allocation and X25519 implemented in-tree, a Home Assistant REST and WebSocket client, a field-service CRM analytics client, and a game-cache script decompiler.
- Paired every tool with an agent skill that states when to use it, which credentials it reads and never prints, the privilege level to confirm before writing, and the trap list that makes it work first time, so AI assistants can run the estate under explicit per-change approval.
- Established a proof-based change discipline for database-backed upgrades: exact baseline counts, streaming the compressed dump back through a tuple parser to prove the rows are in it, and a post-change row-level diff that classifies every difference as schema migration, live activity, or actual loss.
- Shipped a verifier for published services that proves DNS is proxied, the edge gate answers, and, the step everyone skips, that the origin refuses a connection without Cloudflare's client certificate.
- Automated the VM lifecycle end to end: golden-template sealing with preflight snapshot, modernization, guestinfo readiness checks and identity wipe; cloud-init guestinfo deployments that prove the guest came up; and unattended multi-hop Ubuntu LTS upgrades over SSH with hypervisor snapshots as the rollback plan.

**Selected accomplishments (in progress):**
- Consolidated a 12-repository Ansible estate (roughly 4,400 lines of real automation spanning an Atlassian stack, Active Directory and certificate-services labs, LEMP and Laravel hosting, security hardening, and certificate distribution) into namespaced collections, de-duplicating roles and repairing playbooks that no longer ran.

Stack: Python · Agent skills · RouterOS · TR-069 · WireGuard · Backup verification · Cloudflare

### Device & Systems Integration — Independent project

_2023 · Earlier project_

Made devices and business systems speak protocols they did not natively share: an infrared gateway driven over TCP, a USB scanner published straight into a home-automation platform's own MQTT discovery contract, and CRM contacts rendered as the directory format SIP handsets fetch.

**Selected accomplishments:**
- Built a Home Assistant custom component for infrared device control that registers its own service and writes vendor control frames to a networked gateway over TCP, with a per-call device override so one integration drives more than one gateway.
- Bridged a USB serial tag scanner into a home-automation platform by implementing its MQTT discovery and scan contract directly instead of installing an add-on: a service that selects the device by USB descriptor, publishes its own discovery configuration on connect, republishes each scan as a structured event, and re-establishes the broker session before every publish, paired with udev rules that rebuild the container against the current device node whenever the scanner is plugged in or removed.

**Selected accomplishments (prototype):**
- Prototyped a Java service that rendered CRM contacts as the vendor-native XML directory the deployed SIP handsets fetch, so the handset directory tracked the CRM instead of being maintained by hand, structured as a multi-module project separating the CRM client, the directory renderer, and the web tier.

Stack: Home Assistant · MQTT · Java · Spring Boot · udev · Docker · EspoCRM

### Product Architecture & Engineering — Independent product work

_Independent, after-hours · Current_

Independent, after-hours product architecture exploring scheduled bandwidth orchestration and telecom workflow automation, currently under the working name NexusPort.

**Selected accomplishments (prototype):**
- Independent product work exploring scheduled bandwidth orchestration and telecom workflow automation, currently under the working name NexusPort. It takes a class of network change that tends to be manual, repetitive, and timing-sensitive, and gives it a structured product surface with real guardrails: intent separated from execution, validation before anything touches a live service, and an operator approval gate in the loop.
- The architecture is original, built after hours from public documentation, standard software libraries, and authorized API integrations where applicable. Final product naming and business structure are still being decided.
- The product model covers one-time, paired, recurring, and bulk bandwidth changes across enterprise ports, with customer/reseller separation, execution history, pricing estimates, onboarding, per-port billing, consolidated invoices, and white-label delivery; the implementation is Laravel with Dockerized delivery, staging operations, carrier-sandbox troubleshooting, and operator runbooks.

Stack: Product architecture · Laravel · Network automation · API integration · Workflow design

- NexusPort overview: https://pakkit.net/nexusport
- Project case study: https://pakkit.net/projects/nexusport

### Infrastructure Configuration & Containment — Independent project

_2020 – 2023 · Earlier project_

Put infrastructure state under review and made it fail closed: a Windows domain's policy definitions version-controlled with pinned vendor provenance, and a containerized daemon confined to a supervised tunnel by a default-deny egress policy.

**Selected accomplishments:**
- Put a version-controlled central store behind a Windows domain's Group Policy: 213 administrative templates with a complete English presentation set and five further language packs for the third-party templates, each vendor import landing as its own commit pinned to a named upstream version, so policy-definition changes became reviewable and revertible instead of being hand-copied into the domain share.
- Contained a containerized network daemon behind a default-deny egress policy so it could only reach the internet through a supervised VPN tunnel: outbound traffic dropped by default with narrow exceptions for the tunnel, DNS and the VPN endpoint, a management interface reachable from the local network but explicitly dropped on the tunnel side, and process supervision that restarts the tunnel without restarting the daemon.

Stack: Group Policy · Active Directory · Docker · OpenVPN · Firewall policy

### Embedded, Mobile & Signal Engineering — Independent project

_2021 – 2023 · Earlier project_

Built instrumented hardware, Android applications, and signal-processing tooling to measure what no off-the-shelf product reported: solar and battery behaviour, water flow and level, charging-cable temperature, vehicle handling, and an undocumented serial protocol.

**Embedded & IoT:**
- Built and deployed nine networked ESP8266 devices in C++, each reporting into a self-hosted MQTT broker or SNMP poller so the readings landed in the same monitoring stack as the rest of the network rather than in a vendor cloud application.
- Instrumented an off-grid solar installation with three-channel high-side current and voltage sensing, applying per-channel shunt calibration offsets and deriving panel wattage and PoE draw so battery behaviour could be trended over time instead of guessed at.
- Built a charging-cable thermal monitor that reads the handle's NTC thermistors through an external analog-to-digital converter, linearizing against a measured reference voltage and divider resistance, with a local display and an asynchronous web server for remote reads.
- Built sensing and actuation devices around the constraint each measurement actually had: a load-cell scale on a 24-bit converter with a remote tare command delivered over MQTT, interrupt-driven flow-pulse counting with switched 12-volt outputs, a time-of-flight liquid-level sensor averaging 25 ranging samples per reading to reject surface noise, and relay actuators that emulate a momentary button press rather than rewiring the appliance.
- Built a twelve-channel speaker selector and receiver with digital-potentiometer volume control, driving an increment/decrement potentiometer over GPIO while tracking absolute position in firmware so the web interface could set a level directly rather than only step it.

**Mobile:**
- Built a driving-feedback Android application that samples the accelerometer, applies a low-pass filter and a user-configurable moving-average window, and reports longitudinal, lateral and vertical g-force with peak-hold and calibration against the vehicle's resting orientation, mapped to published safety-score thresholds.
- Instrumented that application with real-user monitoring and crash reporting wired into lifecycle and interaction callbacks so field behaviour was measurable rather than inferred, and put it on a hosted CI pipeline that builds the package on every push.
- Built an Android diagnostic that surfaces live LTE serving-cell identity and channel information through the platform telephony APIs, giving a client-side view of the radio link rather than relying on the operator's own reporting.

**Signal processing & reverse engineering:**
- Built a desktop signal-processing tool with live plotting: multi-tone generation, Hamming-windowed FFT with window correction, power-spectral-density and channel-power computation, peak-to-average power ratio, and BPSK spreading for direct-sequence experiments.
- Reverse-engineered the undocumented serial output of a consumer radar detector, deriving its frequency scaling constant empirically and decoding packed little-endian multi-byte fields into the main and secondary target frequencies.

Stack: ESP8266 · Embedded C++ · MQTT · SNMP · Android · Python · DSP · Reverse engineering

### Game Platform, Identity & Reverse Engineering — Independent project

_2015 – 2018 · Earlier project_

A three-tier multiplayer game platform built as a two-person project with a software-company-grade toolchain: an original authentication tier, an OAuth2 identity provider, service discovery, and CI/CD delivery.

**Selected accomplishments:**
- Built an original 23,000-line Java lobby and authentication tier for a three-tier game platform: Netty protocol handling, RSA/XTEA/ISAAC session flow, pluggable MySQL and REST authentication, typed failure mapping, world discovery and handoff, social systems, and RabbitMQ cross-service messaging.
- Extended a large open-source game-server base with roughly 18,000 to 35,000 lines of defensible original change across 127 new files, including Netty/TLS administration, AMQP integration, a 15-region grid content system, developer editors, and operational hooks, while preserving honest attribution of the base code.
- Replaced hard-coded client hosts with DNS SRV service discovery and liveness probing, added environment-selectable launch modes and private-CA TLS, and built Maven shaded-JAR delivery through Bamboo CI and a CDN.
- Built a Laravel OAuth2 identity provider with a first-party/third-party partner trust model over Passport, domain and scope policy, email activation, RSA wrappers, browser tests, and a Java authentication library consumed by game services and Atlassian integration work.
- Operated a software-company-grade toolchain for a two-person project: self-hosted Bitbucket Server, Jira smart commits, Bamboo CI/CD, private Nexus artifacts, Confluence, chat-ops, RabbitMQ, DNS service discovery, and shared Maven parent POMs.
- Enforced consent policy inside the OAuth2 authorization endpoint rather than trusting registered clients: a partner trust model that reserved session-wide and full-account-control scopes for first-party clients, per-partner scope filtering that rejected an out-of-policy request outright instead of silently narrowing it, and consent-free re-authorization limited to first-party clients holding an explicit passthrough grant.

**Selected accomplishments (analysis):**
- Audited the historical platform for credential hygiene, unsafe XStream deserialization, weak TLS, authorization-control defects, cryptographic migration gaps, and inherited chat and login tripwires, documenting reachability and authorship without claiming vendored engine or client code as original.
- Diagnosed a cross-language credential-format collision (bcrypt variant prefixes and a home-rolled PBKDF2 spread across PHP and Java) that had silently locked new accounts out of one client, and designed a multi-format credential-migration layer over a multi-module Spring Boot 2 project on then-new Java 10.

Stack: Java · Netty · RabbitMQ · MySQL · Laravel · OAuth2 · Maven · Bamboo

### Additional Engineering Projects — Independent work

_2002 – present · Ongoing_

Independent learning, prototypes, production utilities, and authorized research spanning two decades of hands-on engineering.

**Selected accomplishments:**
- Built a Laravel 11 cloud-VoIP application using OAuth2 authorization code with PKCE, encrypted queued token refresh with overlap protection, call-detail and recording APIs, phone-number and SMS features, Docker, and dual-registry GitHub Actions publishing.
- Developed an Atlassian Crowd directory integration, a Spring Boot vSphere VM-provisioning application, an NTLM/Active Directory single sign-on integration for Nginx, and a Laravel RabbitMQ queue driver.
- Built a bounded Spring Boot data-extraction web application with authentication, reCAPTCHA, and CSV export from a reusable multi-module Maven/Tomcat scaffold shared across Java projects.

**Selected accomplishments (analysis):**
- Reverse-engineered a compromised game client cache by comparing 6,248 scripts across original and modified releases, isolated a 5,027-instruction obfuscated chat-handler prologue, reconstructed its runtime-built strings and substitution cipher, traced a sentinel-gated command channel capable of clipboard exfiltration, and documented a reproducible network-isolated analysis workflow.
- Designed a complete hardware, imaging, maintenance, and all-MikroTik 10GbE/LanCache plan for a ten-PC competitive gaming venue, balancing performance, thermals, long daily duty cycles, replacement inventory, and fleet uniformity (planning scope only).

**Selected accomplishments (prototype):**
- Built the web application for a game-item marketplace: third-party identity joined to platform user records, inventory and profile reads against the vendor's Web API, an HTTP command channel dispatching send and receive trade offers to a pool of distributed trading daemons with per-item status reconciliation, card-payment checkout, an AMQP queue driver for the framework, and chat-ops alerting, built by two people on a licensed commercial application base.

**Earlier engineering work:**
- Published and maintained a Laravel/Sentinel package for LDAP and Active Directory authentication in 2015, released as an installable Composer package.
- Maintained a Laravel integration package wrapping the Jira REST API in 2015, built on established upstream Jira and Laravel libraries rather than a from-scratch client.
- Operated an integrated team development workflow across Jira Core/Software/Service Desk, Confluence, Bitbucket Server, and Bamboo CI in 2016–2017, and reviewed other developers' code with specific guidance on decomposing oversized command handlers and removing duplicated code paths.

**Earlier engineering work (analysis):**
- Designed and publicly shared normalized relational schemas for item constraints and character attributes in 2016, covering foreign-key relationships, typed constraint identifiers, composite-key tradeoffs, and an idempotent upsert pattern.

Stack: Laravel · Spring Boot · RabbitMQ · Reverse engineering · MikroTik

## Security research

I identified multiple previously undisclosed critical vulnerabilities rated CVSS 9.8, including SQL injection and unauthenticated remote code execution.

Each finding was confirmed through controlled proof-of-concept testing and accompanied by technical evidence and remediation guidance for coordinated disclosure.

**Disclosure boundary:** Coordinated disclosure is still open. The vendor, product, product category, application type, affected environment, employer or customer context, and implementation details are intentionally withheld.

### Earlier and authorized research

- **Own-vehicle embedded research.** Reverse-engineered the media control unit of my own Tesla to obtain root access, then studied the embedded environment and application behaviour from the inside. Authorized by ownership.
- **Learning-platform authorization flaw.** Found and disclosed an authorization vulnerability in an online learning platform that exposed administrative access. Reported to the operator; the platform is not named here.
- **Compromised game-cache implant.** Compared 6,248 client scripts across original and modified releases to isolate an obfuscated chat-handler prologue, reconstruct its runtime-built strings and substitution cipher, and trace a command channel capable of clipboard exfiltration, with a reproducible network-isolated analysis workflow.
- **Owner-authorized attack-surface assessment.** Zero-impact external assessment of a multi-service production presence I operate: passive reconnaissance, non-intrusive testing, ranked remediation, and two initial findings disproved by re-testing from public vantage points.
- **Fleet vulnerability audit.** Phased audit of an 86-host lab fleet with version-based CVE assessment, evidence-based false-positive rejection, and a gentler profile with post-scan health checks for fragile hosts.
- **Hypervisor isolation analysis.** Read-only analysis of a three-host virtualization cluster across workload, management, vMotion, and storage planes, validating layer-2 protections and identifying patch-level exposure to guest-to-host escape classes.

- Windows kernel-driver static-analysis case study: https://pakkit.net/projects/windows-kernel-driver-static-analysis

## Skills

- **Configuration management & IaC** — Versioned Ansible collections, deployment-time configuration and encrypted secrets, explicit environment validation, dry-run reports, and tested rollback safeguards.
  Ansible · Ansible Collections · Jinja2 · ansible-lint · Dry-run / check mode · Terraform / OpenTofu · SOPS / age · Active Directory Group Policy (ADMX)
- **Databases — Cassandra** — Cassandra backup and restore, topology and upgrade planning, operator certification fixes, and measured development UDF optimization with compatibility testing.
  Apache Cassandra 4.1 / 5.0 · CQL / cqlsh · nodetool · Medusa backup/restore · User-defined functions · Multi-datacenter topology · Rolling upgrades · Primary-key design · Performance benchmarking
- **Telecom / AAA protocols** — Carrier-grade subscriber authentication, with correctness validated across authentication, roaming, and accounting workflows.
  RADIUS · RadSec (RADIUS over TLS) · EAP-AKA · EAP-TTLS · 802.1X / EAPOL · Passpoint / Hotspot 2.0 · eapol_test / radclient / radsniff · Nokia AAA · Accounting & mediation · MVNO roaming · FreeRADIUS · Diameter · EAP-TLS / PEAP · Nokia SR OS / WAG · Ruckus WSG
- **CI/CD & artifact supply chain** — Versioned releases, shared packaging rules, artifact provenance, and deployment-time configuration tooling with explicit compatibility and rollout gates.
  GitLab CI · Self-hosted runners · Pipeline templates · Tag-driven releases · JFrog Artifactory · Multi-arch builds (arm64/amd64) · Artifact provenance · GitHub Actions · Bitbucket Server / Bamboo · Nexus · Immutable artifacts & offline bundles · SOPS / age
- **Containers & orchestration** — Containerized test harnesses, plus hands-on Kubernetes and operator-based orchestration work.
  Docker · Docker Compose · systemd-in-container harnesses · Kubernetes · Container registries & proxying
- **Security & compliance** — Critical vulnerability research through coordinated disclosure, plus endpoint-control automation, hardening, CVE remediation, secrets hygiene, and PKI troubleshooting.
  Vulnerability research · Responsible disclosure · EDR / endpoint security · Endpoint management · Vulnerability management · MFA · CIS benchmarks · sshd & sysctl hardening · CVE remediation · Mutual TLS / X.509 · Application security & secure code review · Malware analysis · PKI / CA operations · Zero trust · Supply-chain controls · HMAC · Attack-surface analysis · TLS handshake analysis (ALPN) · Threat modeling
- **Observability** — SIEM log-forwarding automation and enriched Linux audit-event delivery, including queued TCP transport and fixes for SELinux and audit-daemon integration.
  Splunk · Splunk Universal Forwarder · SPL · Zabbix · Status pages · Datadog · Wazuh · Graylog · ELK · Sentry · OpenTelemetry · Structured logging & log pipelines · auditd · rsyslog · SELinux troubleshooting · Grafana
- **Virtualization & provisioning** — Golden-template preparation and disposable-clone validation, cloud-init addressing, eight-node VM provisioning with unique guest identities, and infrastructure inventory reconciliation.
  VMware vSphere / vCenter · ESXi upgrades · VM templating · cloud-init · netplan / NetworkManager · IPv4/IPv6 dual-stack · VMware vSAN · vCenter / DRS / VCSA · Distributed switches & port groups · Guest customization / sysprep · Snapshot & restore · phpIPAM / inventory reconciliation
- **Linux operations** — Four distributions in daily production-adjacent use, including an end-of-life migration carried through formal certification.
  RHEL · Rocky Linux · CentOS (EOL migration) · Ubuntu · systemd units & timers · dnf / grubby · Kernel tuning · udev & serial device integration
- **Languages & runtimes** — Automation in Python and Bash, a Spring test platform in Java, device tooling in PowerShell, and product work in TypeScript and PHP.
  Python · Bash · PowerShell · Java 23 / Spring Boot · Maven · TypeScript · PHP / Laravel · SQL / CQL · gRPC / proto3 · SOAP / XML · Vendor policy DSLs · C# · JavaScript · HCL · YAML / XML / HTML-CSS
- **Web & product engineering** — This site (Astro 6, strict TypeScript, static output) and an independent product exploration in the telecom workflow space.
  Astro · Tailwind CSS · API design · SEO & structured data · Accessibility
- **AI-assisted engineering** — A deployed engineering chat assistant with tested read-only gateways, evidence-retrieval and sanitization tools, and maintained agent workflows grounded in documented work.
  AI agent workflows · Agent skills & steering docs · Slice-based development · Docs-as-code · vLLM · OpenAI-compatible APIs (Chat Completions / Responses) · Anthropic Messages API · Coding agents (Claude Code / Codex CLI / Cline / OpenCode) · Tool-use governance & approval gates · Prompt-injection controls · Webex bot integrations · AI application security
- **Engineering practices** — The habits the record demonstrates: reverse engineering, parity testing, root-cause analysis, and documentation that survives certification.
  Reverse engineering · Behavioural-parity testing · Root-cause analysis · Property-based testing · Regression test design · Appium (Android / iOS) · LDAP / AD integration · Release engineering
- **Identity & secure integrations** — Native SAML, OIDC, and OAuth integrations, directory-backed account provisioning, role mapping and allow/deny tests, plus independent identity and MCP gateway engineering.
  Authentik · OIDC / OAuth 2.x · Cloudflare Access / Workers · Terraform / OpenTofu · Tailscale · nftables · MCP · JWT / JWKS validation · SAML 2.0 / JIT provisioning · Grafana · Portainer · Multi-tenant isolation
- **Network systems** — Wireless and enterprise networking, dual-stack inventory reconciliation, IPAM drift audits, RADIUS health-check diagnosis, and infrastructure from routing to physical installation.
  MikroTik RouterOS · pfSense · VyOS · Cisco IOS · GenieACS / TR-069 · FreeRADIUS · UniFi · VPN design / WireGuard · VoIP / PBX · RF & site surveys · Point-to-point wireless · DNS SRV service discovery · Firewall policy · phpIPAM / inventory reconciliation · OpenVPN
- **Messaging & integration** — Event and protocol plumbing across game services, test fleets, and home automation: AMQP, Kafka result signals, Netty protocol handling, gRPC contracts, and custom integrations.
  RabbitMQ · Kafka · Netty · gRPC / proto3 · Home Assistant · MQTT
- **Knowledge systems** — Certified runbooks and onboarding, evidence and document-consistency tooling, and a status-ledger prototype that reconciles engineering work with reported progress.
  Obsidian / Quartz · Docs-as-code · Agent skills & steering docs · Jira / Confluence · Architecture decision records · MOPs & runbooks · Onboarding systems · MDX content collections
- **Java / JVM** — Spring Boot services and test platforms, Netty protocol work, multi-module Maven builds, and WAR deployments dating back a decade.
  Java 23 / Spring Boot · Spring Security · Spring Data JPA / Hibernate · Maven · Tomcat / WAR deployment · Netty · Log4j2 · JUnit · gRPC / proto3 · Appium (Android / iOS)
- **PHP / web frameworks** — Laravel 5 through 11 in production: identity providers, lead-generation apps, VoIP integrations, and an Astro replatform when a dynamic surface was no longer justified.
  PHP / Laravel · Laravel Nova · Laravel Passport / Sanctum / Socialite · Eloquent / Blade · Astro · Tailwind CSS · Attribution & conversion tracking
- **Physical & field engineering** — The part of the network you can touch: fiber and copper installation and splicing, structured cabling, racks, hardware upgrades, and colocation, done as the ISP's own field engineer.
  Fiber & copper installation / splicing · Structured cabling · Racks & equipment installation · Server & workstation hardware · Data-center colocation
- **Databases & data stores** — Relational, document, and cache stores behind production applications, plus directory services; Cassandra has its own category.
  PostgreSQL · MariaDB / MySQL · MongoDB · Redis · Zookeeper · LDAP / AD integration
- **Quality & testing** — Property-based and mutation tests, failure injection that checks previous-release startability, protocol parity, and performance benchmarks scoped to their test environment.
  JUnit · pytest · Vitest · Property-based testing · Appium (Android / iOS) · Selenium · Regression test design · Fault injection · Restore drills · Mutation testing · Performance benchmarking
- **Cloud & edge** — Cloudflare Workers, Access, Tunnel, Origin CA and authenticated origin pulls, Pages builds, Tailscale userspace networking, and rented GPU compute behind a broker.
  Cloudflare Access / Workers · Cloudflare Tunnel · Cloudflare Origin CA / authenticated origin pulls · Cloudflare KV / Pages · Tailscale · Ephemeral GPU compute (vast.ai)
- **Recovery & operations** — Cross-system incident diagnosis, verified restores, deployment failure testing, and recovery checks that distinguish a restored service from pending prevention work.
  Incident response & postmortems · Backup verification · Restore drills · Certificate recovery · Change gates & dry-run reports · Rollback engineering · Health checks · Root-cause analysis
- **Business systems** — The systems a founder and consultant actually runs: CRM, ticketing, source hosting and CI, artifact repositories, help desk, quoting and invoicing, advertising and analytics.
  EspoCRM · Jira / Confluence · Bitbucket Server / Bamboo · GitLab administration · JFrog Artifactory · Nexus · Help desk / ITSM · Quoting, invoicing & procurement · Advertising & analytics · Stripe payments
- **Architecture & product** — Platform and product architecture: multi-module monoliths that stay honest, API-first and event-driven designs, explicit service contracts, and products built from customer discovery onward.
  Platform engineering · Distributed systems · Multi-module monoliths · API design · Event-driven systems · Service contracts · Product engineering
- **Embedded & IoT** — Nine networked microcontroller devices in C++, each built to measure something real — current, weight, distance, flow, temperature — and report it into an existing monitoring stack.
  Embedded C++ / Arduino · ESP8266 · I²C / SPI · ADC & sensor calibration · Interrupt-driven I/O · SNMP
- **Mobile & signal processing** — Android sensor and telephony applications with real-user monitoring and CI, plus digital signal-processing tooling and reverse-engineered serial protocols.
  Android SDK · Sensor filtering & smoothing · Real-user monitoring · Azure Pipelines · NumPy / SciPy · FFT & spectral analysis · Digital modulation · PyQt5 / pyqtgraph

## Working method

- **Root-cause analysis on release blockers.** Release-blocking CI failures were traced to their actual causes and fixed at the shared infrastructure or template layer instead of being repeatedly retried.
- **QA findings treated as product defects.** Certification findings against backup tooling became validation, autodiscovery, and safer runtime behavior shipped as follow-up releases. The documentation stayed accurate because the product changed.
- **Rehearsal and failure injection.** A database topology change was rehearsed against an isolated replica; deployment tests deliberately injected failures and checked that the previous release remained startable.
- **Removing operator footguns.** Hard-coded defaults became autodiscovery, repetitive operator input was reduced, and fragile maintenance steps were replaced with safer native operations.
- **Documentation as a deliverable.** An 11-page onboarding suite for an undocumented policy language, installation guides that passed formal certification, and CI-published operator documentation kept knowledge aligned with releases.
- **Testing real integration boundaries.** Live chat and SSO tests exposed permission, identity-resolution, and session-isolation defects that isolated tests had missed.

## Certifications

- CompTIA A+ (2024)
- CompTIA Network+ (2024)
- CompTIA Security+ (2024)
- CompTIA Server+ (2024)
- Microsoft MTA: Mobility and Device Fundamentals (2017)

## More
- Recruiter brief: https://pakkit.net/resume/recruiters
- Structured resume: https://pakkit.net/resume.json
- Experience detail: https://pakkit.net/resume/experience
- Skills: https://pakkit.net/resume/skills
- Security research: https://pakkit.net/security-research
- Projects & case studies: https://pakkit.net/projects
- Services & consulting: https://pakkit.net/services
- Contact: https://pakkit.net/contact