Pakkit.net

Resume / Experience

Experience, itemized.

Work history and independent projects, with selected accomplishments grouped by discipline. Explore the systems I built, the scope I owned, and the outcomes I can discuss.

Wireless Engineer III — AAA Development & Platform Automation· Charter Communications (Spectrum)

Nov 2024 – Aug 2026 · Previous role

Wireless Engineer III on a national carrier AAA/RADIUS platform supporting subscriber WiFi authentication, roaming, and accounting workflows.

I joined in integration testing and was promoted into development after six months, then expanded into a cross-cutting platform role spanning telecom policy, infrastructure automation, database reliability, release engineering, security, test platforms, lab operations, and technical enablement.

Across 21 months I took on 5 platform areas; the early-August evidence snapshot records 180 completed tickets and 248 merged merge requests across 31 repositories.

Scope owned concurrently

  • AAA deployment automation: versioned Ansible collections for deployment, upgrades, policy changes, auditing, and rollback.
  • Cassandra platform operations: backup and restore, topology and upgrade planning, UDF performance optimization, and migration analysis.
  • AAA policy engineering: behavioural-parity work for a platform rewrite and accounting workflows.
  • Security and compliance automation: endpoint controls, audit-event forwarding, native application SSO, and group-based access.
  • Developer and lab enablement: VM provisioning, inventory reconciliation, CI/CD, automated testing, a deployed engineering assistant, and evidence tooling.

Infrastructure automation (Ansible)

  • Converted runbook-driven platform deployment into 6 versioned Ansible collections with 29 tagged releases in 76 days, covering deployment, database operations, system administration, VM preparation, orchestration, and preflight checks.
  • Built the team's first collection release pipeline and test strategy, including 403 automated tests and 96 property-based tests in the earlier suite snapshot, parallel pytest execution, automatic versioning, artifact publication, and shared CI templates. Later deployment safeguards were challenged at 16 injected failure points and with 13 deliberate role mutations, checking preservation of a startable previous release.
  • Decomposed a monolithic deployment role into separate install, policy, and helper roles so routine policy changes could ship without replacing platform software.
  • Added dry-run audit reporting so operators could inspect a proposed change before authorizing execution.
  • Built a systemd-enabled Docker test harness so role changes could be validated locally instead of consuming shared lab capacity.
  • Replaced a multi-step manual deployment handoff with a single-command, version-pinned, idempotent deployment supporting roughly one-minute policy-only updates, dry-run impact reports, post-deploy verification, offline bundles, and sub-second symlink rollback.

Database engineering (Cassandra)

  • Owned the Cassandra operations programme and shipped 14 tagged releases in roughly four weeks while the work moved through formal QA certification.
  • Automated backup and restore end to end with scheduling, retention, verification, capacity checks, retries, and alerting, replacing an inconsistent manual process.
  • Removed a data-integrity footgun in backup naming by adding fail-fast validation and then autodiscovery.
  • Implemented mutual-TLS support and service-account-safe certificate discovery for production-equivalent environments.
  • Rehearsed a high-risk multi-node topology change against an isolated replica before executing the live change successfully.
  • Performed encrypted-data migration analysis, load simulation, and operator-workflow simplification, cutting the planned manual input from roughly twelve variables to four.
  • Designed a Cassandra 4.1-to-5.0 rolling-upgrade path for the subscriber-authentication clusters.
  • Optimized a legacy Cassandra decryption UDF, reducing development-benchmark mean latency from 12.47 ms to 0.70 ms and increasing 16-thread throughput from 635 to approximately 13,100 operations per second; scoped equivalence and round-trip compatibility checks to the tested variants.
  • Released a database-automation fix spanning four CQL roles, correcting credential propagation and variable-precedence defects; tested the published package against operator instructions with a CQL stub and repaired five documentation errors while real-cluster recertification remained pending.
  • Diagnosed and closed an availability defect in a subscriber-authentication database where crafted input to its encryption and decryption user-defined functions could bring the cluster down.

CI/CD & release engineering

  • Root-caused recurring release blockers across build images, registry routing, and artifact authentication, then replaced repository-local workarounds with shared templates. Reconciled three policy-bundle packaging paths and added checks against overwriting vendor runtime files, resolving inconsistent branch and merge-request validation.
  • Stood up a self-hosted CI runner for policy validation and built a multi-architecture base image for arm64 and amd64 development workflows.
  • Moved collection publishing onto a shared tag-driven release pipeline with dedicated service credentials and manual approval gates for deployment-sensitive actions.
  • Brought the team's repositories to a green compliance pipeline and added automated documentation publication behind approval gates.
  • Administered a 12+ repository GitLab group, establishing Git Flow, CODEOWNERS, pipeline-gated merges, branch protection, artifact conventions, and reusable templates across the AAA automation portfolio.
  • Migrated a development policy configuration to templated values and encrypted secrets while preserving byte-identical output across all 62 rendered files; credential rotation remained a separate follow-up.

Security & compliance

  • Automated deployment of endpoint security, endpoint management, software inventory, vulnerability management, and MFA controls across a pre-production fleet.
  • Delivered SIEM log-forwarding automation covering platform and operating-system logs across multiple fleet layouts. Automated enriched Linux audit-event forwarding across six development nodes, resolving SELinux and audit-daemon integration failures and using queued TCP delivery for centralized investigation.
  • Remediated tracked vulnerability findings to closure, introduced safer package-manager-native maintenance operations, and delivered a certified upgrade path for legacy Linux hosts.
  • Moved source-control permissions onto directory-backed groups and moved CI pipelines off personal credentials onto dedicated service accounts.
  • Added repository safeguards that keep lab secrets out of policy source control.
  • Automated directory-backed SSO across engineering tools using SAML, OIDC, and OAuth, including group-driven account provisioning and role mapping, tested allow/deny behavior, and preserved local recovery access.
  • Shipped CIS-aligned kernel and SSH daemon hardening as a fleet role, validating each generated daemon configuration with a syntax check before applying it and ordering the drop-in files so the existing access policy stayed authoritative instead of being silently overridden.
  • Removed a destructive failure mode from fleet kernel maintenance by replacing two fragile shell steps with an explicit running-kernel check and an old-installs-only removal, so the automation could no longer delete the kernel the host had actually booted.

Network & protocol engineering (RADIUS / EAP)

  • Reverse-engineered undocumented RADIUS accounting field derivations from policy logs and packet captures, establishing a behavioural-parity baseline for a platform rewrite.
  • Rebuilt individual accounting derivations to verified parity against that baseline and created replay tooling for repeatable protocol validation.
  • Designed and delivered a state-persistence layer for a telecom policy runtime, then removed 16,390 lines of legacy code using execution evidence to prove what was genuinely unused.
  • Diagnosed difficult mutual-TLS and protocol-integration failures across RADIUS-over-TLS and a legacy subscriber-state interface.
  • Sole-engineered a ground-up accounting-policy rewrite in the vendor policy DSL: 181 commits in roughly two and a half months across 15+ modules and 30+ configuration files, with CI/CD, defensive protocol parsing, LDAP failover, RADIUS/RadSec forwarding, and a documented 87-code operational logging registry.
  • Implemented a single-probe write/read/delete smoke harness for every state model, turning multi-minute manual verification into sub-second post-deploy validation in a DSL with no debugger or stack traces.
  • Diagnosed two independent causes of silent RADIUS accounting health-check failures—a runtime compatibility issue and missing protocol attributes—and validated the corrected probe with 12 of 12 successful live responses at approximately 140 ms median latency; load-balancer monitor deployment remained pending.
  • Root-caused a TLS handshake failure blocking OAuth2 token retrieval by isolating the ALPN extension in the ClientHello as the trigger, eliminating DNS resolution, TCP reachability, certificate interception, TLS version negotiation and general HTTPS egress with a positive control for each, then proving with a four-variant differential matrix that the reset followed the extension being present rather than the protocol offered, and restoring token issuance the same day.

Test automation & QA

  • Designed and shipped a Spring-based web platform for 802.1X/EAP supplicant test automation with configuration generation, credential handling, containerized execution, result parsing, dashboards, SIEM query integration, and automated delivery.
  • Architected the platform as eleven Java 23 / Spring Boot modules with nine reusable Maven modules, multi-architecture Docker delivery, and 70 test classes containing more test code than production code, all sole-authored and able to survive 30-way parallel execution.
  • Built an end-to-end AAA testing platform spanning a typed Python library, operator CLIs, Android and iOS Appium automation, Docker, and gRPC; it collapsed repeated manual SIEM queries into a single call across 120+ tests and saved an estimated 6–10 engineer-hours in one certification cycle.
  • Automated 11 previously manual integration tests, reclaiming about 3.7 engineer-hours per full pass, and built a containerized pre-deployment policy validation gate across seven repositories, where policy bundles must boot in the AAA runtime and clear a 13-pattern fatal-error screen before publication.
  • Defined and executed a roughly 30-case release regression suite spanning multiple EAP methods, mobile platforms, roaming scenarios, Passpoint, and negative cases.
  • Designed the shared cross-language contract layer (four gRPC services, eight RPC methods, 13 messages, and eight enums) consumed by Java and Python tools for session control, provisioning-cache operations, SIEM queries, and supplicant configuration.
  • Built the companion portable task-executor agent in Python spanning four CPU architectures, with Kafka result signals, RADIUS/EAPOL probes, REST task discovery, and CI packaging, targeting a roughly 79-host lab fleet across two data centers and four environment tiers.
  • Produced the certification evidence package for a carrier AAA platform release, assembling roughly 90 attachments of policy logs, packet captures, encryption and decryption traces, protocol replay files and device captures across three months.
  • Shipped PowerShell automation for reconfiguring wireless settings on Android test devices three weeks into the engagement, extracting profile selection, device serial handling and address validation into a reusable module across nine merged merge requests.

Virtualization & lab platform

  • Automated VM provisioning from template preparation through cloud-init self-deployment, including dual-stack IPv4/IPv6 addressing and an IPv6-only defect that had been breaking unattended provisioning. Built and verified a Rocky Linux golden template, then provisioned eight database VMs and checked unique machine identities and SSH host keys on every running guest.
  • Built control-node preflight checks that report automation readiness before a run touches infrastructure.
  • Delivered supporting engineering services including reverse proxying, status reporting, monitoring alerts, and team alert integrations.
  • Validated a major ESXi upgrade on live infrastructure and surfaced a lifecycle risk early enough for it to be resolved before an outage.
  • Automated vSphere snapshot restore and environment-aware artifact retrieval, including a SOAP-to-pyVmomi migration, SOCKS5 support, remote DNS, and lab/production artifact-repository fallback so workflows behaved consistently across network segments.
  • Built repeatable IPAM import and drift-audit tooling, reconciled a 233-VM development inventory, and populated a separate integration-test inventory covering 62 VLANs, 144 subnets, and 176 addresses using hypervisor, host, and telemetry evidence.
  • Restored an internal application's login service by tracing failed database session writes to disk exhaustion caused by a cascading Redis and container-logging failure; reclaimed capacity and prepared log-rotation controls.

Documentation & enablement

  • Authored 69 internal wiki pages over the engagement, including installation guides carried through formal QA certification.
  • Wrote an 11-page developer-onboarding suite for an internal policy language and runtime covering language reference, conventions, repository structure, testing, secrets handling, releases, and troubleshooting.
  • Wrote internal proposals that set direction for collection-based automation, automated deployment, and software lifecycle planning.
  • Operationalized a 935-note engineering knowledge base as team documentation, publishing a curated 229-note subset behind an explicit per-note publication gate.
  • Mentored engineers on Git and tooling and built an IDE plugin for the platform's policy language.
  • Built and deployed a TypeScript Webex assistant for engineering knowledge lookup, with access configured for 12 teammates, separate read-only tool gateways, and conversation isolation by caller and privilege tier; verified lookup and refusal behavior through live messaging.
  • Built reusable AI-workflow tools for engineering evidence retrieval, outbound sanitization, and document consistency, with 193 passing assertions and negative tests; corrected repository-counting errors caused by duplicate counting of repository history and uninitialized submodules.
  • Built and maintained a library of roughly 54 reusable AI agent skills across three engineering workspaces, codifying workflows for infrastructure operations, investigation and evidence gathering, security remediation, documentation, configuration management and telecom policy work, and authored an audit that reconciles all three workspace roots in a single run to flag duplicated skills, dead bundled-file references, one-sided skill boundaries, and colliding trigger phrases that would otherwise make agent dispatch nondeterministic.
  • Carried the platform automation portfolio as its sole maintainer in 21 of the 27 codebases surveyed, spanning configuration management, telecom policy, test platforms and operational tooling with no second commit author.

Infrastructure automation (Ansible) (in progress)

  • Designed deployment-time configuration and secrets tooling that separates reusable policy artifacts from environment values and versioned encrypted secrets; released the deployment component with environment validation, provenance tracking, and compatibility checks while broader rollout remained in progress.

Documentation & enablement (prototype)

  • Prototyped a per-engineer status ledger using two weeks of real work, identified conflicts in hand-maintained reporting, and designed a refreshable contribution model around existing Jira fields; recurring automation and broader adoption remained next steps.

Database engineering (Cassandra) (in progress)

  • Piloted a Kubernetes operator deployment model for a carrier subscriber-authentication database tier and released a dedicated collection for it, with the pilot still open at the end of the evidence window.

Security & compliance (in progress)

  • Scoped an environment-wide security remediation programme into seven tracked work items covering agent staging, operating-system patching, MFA, SIEM forwarding and a follow-up security assessment, delivered the first of them, and kept the rest moving while one item stayed blocked on an approval process outside his control.
  • Ansible
  • Cassandra
  • Nokia AAA / TAL
  • RADIUS / RadSec
  • EAP-AKA / EAP-TTLS
  • 802.1X
  • Passpoint
  • GitLab CI
  • Artifactory
  • Docker
  • Kubernetes
  • Splunk
  • VMware vSphere
  • cloud-init
  • RHEL / Rocky
  • Ubuntu
  • Python
  • Java 23 / Spring Boot
  • Appium
  • gRPC / proto3
  • PowerShell
  • TypeScript
  • Webex
  • MCP
  • Authentik
  • SAML / OIDC
  • phpIPAM
  • SOPS / age

Founder / Principal Engineer· Duvall WiFi

Aug 2022 – Nov 2024 · Previous role

Founded and ran a technology and ISP services company, owning customer discovery through implementation, operations, billing, and support.

Selected accomplishments

  • Founded and ran a technology and ISP services company covering network engineering, software development, hosting, cybersecurity, and managed IT. I owned customer discovery, architecture, implementation, production operations, sales, billing, and support.
  • Built a redundant multi-frequency wireless network capable of serving 160 homes with symmetric gigabit, backed by custom captive-portal and RADIUS software plus virtualized infrastructure, PKI, segmentation, monitoring, VPN connectivity, PBX/CRM integrations, and production Laravel and Spring applications.
  • Built the custom Spring Boot captive-portal and AAA backend implementing the FreeRADIUS REST hook surface for authorization, authentication, interim accounting, post-auth, and proxy phases, plus MikroTik hotspot redirect and prepaid-voucher flows.
  • Implemented defense-in-depth portal authentication with brute-force throttling, GeoIP impossible-travel detection, device fingerprinting, reCAPTCHA, and JWT-based hotspot session tokens.
  • Built and operated a three-host VMware vSphere/vSAN environment with data-center colocation, an air-gapped root CA, zero-trust segmentation, secure administrative workstations, SIEM monitoring, VM templates, and hub-and-spoke VPN connectivity across customer networks.
  • Installed and spliced indoor and outdoor fiber and copper cabling, engineered point-to-point links, performed site surveys, and maintained routers, switches, access points, and RF paths as the company's field engineer.
  • Operated a GenieACS TR-069/CWMP platform managing 58 MikroTik and Yealink devices through 15 presets and 15 provisions, documented its tag-driven idempotent configuration state machine, and identified security, permissions, provisioning, and device-health defects through live read-only analysis.
  • Built a communications single pane of glass integrating the VoIP PBX, CRM, missed calls, voicemail, text, and email, with call flows and customer pop-ups that cut spam and sped up resolution.

Selected accomplishments (analysis)

  • Performed an owner-authorized, zero-impact attack-surface assessment across a roughly 12-service production presence using DNS and certificate-transparency reconnaissance, endpoint and auth-flow review, CORS and header testing, and vantage verification; delivered ranked remediation and disproved two initial split-horizon false positives before reporting.
  • Founder
  • Wireless ISP
  • FreeRADIUS
  • Spring
  • Laravel
  • VMware vSphere / vSAN
  • PKI
  • Zero-trust segmentation
  • SIEM

Case study →

Technology & Growth Consultant· Pacific Northwest Plumbing

Jun 2023 – Nov 2024 · Previous role

Delivered technology and growth consulting for a trades business across software, analytics, customer acquisition, and support.

Selected accomplishments

  • Technology and growth consulting for a trades business. I brought customer acquisition cost down from roughly $150 to $5.10 and shifted 83.67% of inbound calls onto unpaid channels, working across the website, analytics, advertising, reviews, and conversion paths.
  • Delivery included a Laravel 10 production website, conversion tracking, advertising workflows, helpdesk support, and custom IP-camera security integrations.
  • Built the lead-generation application in Laravel 10 with Nova administration, reCAPTCHA v3 score-based filtering, Google and Microsoft paid-click attribution, and dual-channel lead alerting, then replatformed it to static Astro once the dynamic attack surface was no longer justified.

Selected accomplishments (analysis)

  • Analysed roughly 2,000 jobs, 1,350 customer records, 1,990 invoices, and 570 estimates to produce a constraint-based growth plan, KPI scorecard, CRM clean-up programme, retention strategy, acquisition playbook, and a buyer-ready data-room structure.
  • Laravel
  • Analytics & conversion tracking
  • Advertising workflows
  • Helpdesk
  • IP-camera integrations

Network & Systems Consultant· Wilderness Awareness School

Nov 2022 – Nov 2024 · Previous role

Delivered network and systems consulting for a multi-property school in challenging rural terrain.

Selected accomplishments

  • Designed, quoted, installed, and operated a resilient enterprise network across three forested properties using roughly 700 meters of aerial and buried cabling plus point-to-point wireless links. The design avoided the cost of an additional internet circuit and improved outage resilience.
  • Ongoing support covered routers, switches, access points, point-to-point wireless links, structured cabling, monitoring, and day-to-day technical support for staff.
  • Enterprise networking
  • Point-to-point wireless
  • Structured cabling
  • Monitoring
  • End-user support

Technical Consultant· Beyond Grey Skies, LLC

Mar 2016 – Jun 2021 · Earlier chapter

Provided enterprise network, server, and technical operations consulting.

Selected accomplishments

  • Supported enterprise networks, data-center fabric, Linux and Windows servers, intrusion monitoring, and emergency technical operations, working across pfSense, VyOS, MikroTik RouterOS, and Cisco IOS.
  • pfSense
  • VyOS
  • MikroTik RouterOS
  • Cisco IOS
  • Intrusion monitoring
  • Data-center fabric

Beyond employment

Independent projects

Self-directed builds with documented outcomes. They sit alongside, not inside, the work history above.

Identity Platform Engineering· Independent project

2026 · Independent project

Deployed a self-hosted identity platform with reproducible infrastructure and group-based application access.

Selected accomplishments

  • Deployed an Authentik identity platform using Ansible, Docker Compose, declarative Blueprints, and Terraform-managed Cloudflare Access, with OIDC group claims for application authorization.
  • Verified signed identity tokens, allow/deny behavior, group-removal revocation, deactivated-user denial, and configuration reapplication through 20 infrastructure checks and a ten-check identity suite.
  • Validated idempotent deployment and unattended reboot recovery, and preserved existing access policies during additive application migration.
  • Imported the existing edge-access applications into Terraform without recreating them, preserved fallback login paths, and caught destructive nulling of previously unmanaged fields in plan review before it reached production.
  • Operate the platform as a product: invitation flows, a documented two-change procedure for putting an application behind OIDC or SAML login, service tokens for machine callers, and a maintained trap list so protected applications work the first time.
  • Authentik
  • OIDC
  • Ansible
  • Terraform
  • Docker
  • Cloudflare Access

AI Integration & Security Engineering· Independent project

2026 · Independent project

Built an authenticated MCP gateway connecting AI tooling to a private CRM, with live reads and controlled write paths.

Selected accomplishments

  • Built a Cloudflare Worker MCP gateway with OAuth 2.1 and per-client capability tokens, authenticated origin access, and a constrained API to a private CRM.
  • Implemented review-first ingestion controls, dry-run/commit binding, rate caps, auditing, and independent kill switches; live read access is verified and write execution remains disabled.
  • Documented 198 passing service tests and drilled kill switches at the edge, reverse proxy, and application layers, with observed shutdown times of approximately 7, 10, and 19 seconds respectively.
  • Built a self-hosted CRM and deterministic follow-up engine that converts raw job listings into researched, callable leads with scripts, evidence, reminders, business-hours scheduling, call outcomes, and recovery packets.
  • Implemented the engine as a dependency-free Python state machine with idempotent ingestion, duplicate protection, signed-webhook verification, replay safety, time-zone/DST/holiday scheduling, and least-privilege HMAC API access, shipping 101 unit tests and 85 of 85 live acceptance checks.
  • Proved recoverability through checksummed daily and weekly backups, a disposable restore that booted a fresh application container with intact records, cross-host migration by restore, and a full VM reboot after which six services returned healthy without intervention.
  • MCP
  • OAuth 2.1
  • Cloudflare Workers
  • Python
  • nginx
  • Threat modeling

Secure Compute & Network Automation· Independent project

2026 · Independent project

Built and deployed a credential broker and routing automation for ephemeral rented GPU compute.

Selected accomplishments

  • Built a broker issuing short-lived, single-use Tailscale enrollment keys while keeping privileged OAuth credentials off rented hardware, with independent JWT validation for administrative access.
  • Automated deterministic virtual-address allocation, constrained gateway routing, and cleanup of expired nodes; verified the full join, permitted-access, blocked-port, and teardown path using a disposable container.
  • Validated the implementation with 34 unit tests and 20 gateway ruleset assertions, including fail-closed behavior when configuration is absent.
  • Operated a vLLM coding endpoint compatible with the OpenAI Chat Completions, OpenAI Responses, and Anthropic Messages APIs, including native streamed tool calls, so coding agents such as Claude Code, Codex CLI, Cline, and OpenCode work without a translation proxy, with the rented-host trust boundary documented.
  • Tailscale
  • Cloudflare Workers
  • TypeScript
  • nftables
  • OIDC
  • GPU infrastructure

Observability as Code· Independent project

2026 · Independent project

Terraform-managed monitoring and security analytics for a private homelab, with monitors, log pipelines, and dashboards defined as reviewable code.

Selected accomplishments

  • Managed a Datadog observability stack as code: 53 monitors (30 log, 21 metric, two query), four syslog pipelines totalling 46 processors, four log-derived metrics, an indexed log store, and a 17-widget security dashboard.
  • Designed a reusable Terraform monitor module with 16 typed, validated inputs, enforced tags, count-gated optional resources, provider locking, and credentials kept out of band.
  • Datadog
  • Terraform / OpenTofu
  • Log pipelines
  • Security analytics
  • Monitoring as code

Private Cloud & Homelab Platform Engineering· Independent project

Ongoing · Ongoing

Operates a three-host VMware environment as a production-grade lab: provisioning automation, isolation analysis, recovery engineering, and network-edge hardening.

Selected accomplishments

  • Operate a three-host vSphere/vCenter environment inventorying 149 VMs (86 running), 469 allocated vCPUs, roughly 686 GiB of allocated RAM, eight datastores, and 45 networks across Linux, Windows, RHEL, Debian, FreeBSD, and network-appliance workloads.
  • Built repeatable VM provisioning and golden-template workflows spanning cloud-init guestinfo, clone customization, LVM growth, Docker bootstrap, network and IP validation, sysprep, smoke tests, and reusable Ansible and CLI automation.
  • Recovered a vCenter outage caused by a full log partition and an expired machine SSL certificate: preserved the valid VMCA root, re-issued only the leaf certificate, restored services with no VM data loss, corrected syslog host attribution, and raised an exhausted file-descriptor limit from 1,024 to 65,536.
  • Audited the management and service exposure of a colocated RouterOS core router, validated ordered default-deny containment, and executed a no-reboot reduction of SNMP, bandwidth-test, captive-portal, and obsolete RADIUS exposure while preserving recovery access.
  • Built reusable Windows performance and security triage tooling covering hardware, storage health, patching, Defender, firewall, logons, public connections, persistence surfaces, signatures, remote tools, and high-refresh gaming bottlenecks.
  • Designed the standard internet ingress for self-hosted services: a Cloudflare edge with WAF and identity-gated Access in front of a core router that admits only Cloudflare's ranges, terminating at an nginx origin with per-hostname Origin CA certificates and authenticated origin pulls across roughly 55 virtual hosts.

Selected accomplishments (analysis)

  • Performed read-only isolation and hypervisor-risk analysis across the workload, management, vMotion, and vSAN planes, validating layer-2 protections and blocked routing while identifying patch-level exposure to guest-to-host escape vulnerabilities and a high-blast-radius shared-storage design.
  • Ran a phased vulnerability audit across an 86-host fleet: port sweep, service and version inventory, advisory-based CVE assessment with false positives rejected on evidence, and a gentler profile plus post-scan health verification for fragile hosts.
  • Root-caused vSAN write latency to two stacked causes, an in-flight resync landing on one host's consumer-grade cache SSD and a chronic hardware-compatibility mismatch, then benchmarked the cluster against a Ceph deployment to separate fixable latency from latency that is acceptable by design.
  • VMware vSphere
  • vSAN
  • cloud-init
  • Ansible
  • MikroTik RouterOS
  • Recovery engineering

Multi-Agent Engineering System Design· Independent project

2026 · Independent project

A governed crew of thirteen AI engineering agents with least-privilege scopes, policy gates, and honest documentation of what the harness can and cannot enforce.

Selected accomplishments

  • Designed and maintain a 13-agent engineering crew on a multi-agent harness, with a canonical YAML roster, agent definitions, architecture decision records, least-privilege command and tool scopes, must-allow/must-deny tests, deterministic policy gates, and resource-guard analysis.
  • Documented a governance limitation where global permissive settings could bypass agent-level command scopes, separating static scope validation from actual runtime enforcement rather than overstating isolation.

Selected accomplishments (analysis)

  • Reverse-engineered the harness's provider architecture across provider factories, backend capability sets, spawn paths, model mapping, environment injection, and tool delivery to design credible extension paths for additional model providers, including self-hosted inference.
  • AI agents
  • Agent governance
  • Kiro
  • Policy gates
  • Architecture decision records

Website Factory & Edge Delivery· Independent project

2026 · Independent project

A reusable pipeline that turns sparse profile inputs into container-validated Astro sites with previews, custom domains, and edge APIs on Cloudflare.

Selected accomplishments

  • Built a reusable one-shot website factory that turns profile and context sources into container-validated Astro sites, with structured intake, derived themes, generated brand assets, per-PR preview deployments, a promotion path to production, and post-deploy verification.
  • Delivered multi-page sites for independent creators from sparse link-page and social inputs, implementing content-safety rules, no-index previews, custom domains, repeatable asset generation, and polling-based certificate and build verification.
  • Built a caching Cloudflare Worker API for live photo galleries with a route allowlist, upstream and browser compatibility controls, edge caching, static-build isolation, and navigation-lifecycle handling, integrating third-party feeds without exposing a general-purpose proxy.
  • Built pakkit.net as a strict-TypeScript Astro 6 knowledge and portfolio platform with a data-driven service taxonomy, MDX content collections, machine-readable RSS and llms.txt routes, a canonical career bank behind the résumé section, and more than 130 published technical articles.
  • Integrated a performer's Astro booking site with their hosted CRM: build-time fetch of upcoming shows with a default-deny public filter, a small proxy that creates contacts and events through the authenticated API after live testing disproved the assumed public form endpoint, UTM lead-attribution passthrough, and a testimonials feed, verified end to end in production.
  • Rebased the site factory onto a multi-template architecture, separating a shared asset overlay from per-template application layers behind an explicit overlay contract, guarding token substitution against binary files, and migrating roughly twelve dependent generator skills and their documentation in step, re-validated in a container at three different site-name lengths.
  • Astro
  • TypeScript
  • Cloudflare Workers
  • Docker
  • GitHub Actions
  • Brand systems

Multi-Vault Documentation Hub· Independent project

2026 · In progress

A private publishing platform where each Obsidian vault gets isolated builds, search, hostname, and identity policy behind layered authorization.

Selected accomplishments (in progress)

  • Architecting a private multi-notebook publishing platform where each vault has isolated source credentials, builds, search index, image, service, hostname, and identity-group policy.

Selected accomplishments

  • Designed layered authorization through Cloudflare Access plus an origin-side gateway that validates JWT signature, issuer, expiry, and exact per-application audience, preventing cross-vault search, graph, attachment, cache, or metadata leakage.
  • Provisioned and hardened a dedicated Ubuntu documentation VM through the hypervisor console and cloud-init: independently verified host keys, removed inherited administrative access, locked unused accounts, applied explicit SSH policy, patched and reboot-tested the host, and left only SSH listening on routable interfaces.
  • Built a synthetic fixture vault with nine Markdown documents, 31 validated wikilinks and embeds, seven deliberately publishable notes, negative content fixtures, and complete heading-anchor checks to support authorization and isolation testing without exposing personal content.

Selected accomplishments (analysis)

  • Completed the planning and non-live remediation cycle, correcting a zero-match firewall rule, an impossible reverse-proxy and Compose topology, and an unsafe state-backend assumption before any public or identity-system change.
  • Obsidian
  • Quartz
  • Authentik
  • Cloudflare Access
  • JWT
  • Terraform
  • Ubuntu

Operational Tooling & Agent Skills· Independent work

2026 · Ongoing

A library of dependency-free command-line tools for the infrastructure I run, each paired with an agent skill that documents triggers, credential handling, and failure modes so AI assistants operate the estate safely.

Selected accomplishments

  • Built dependency-free, standard-library Python CLIs for the systems I operate: a TR-069 ACS client, a RouterOS API client with vSphere lab snapshot and revert, a WireGuard peer minter with IPAM address allocation and X25519 implemented in-tree, a Home Assistant REST and WebSocket client, a field-service CRM analytics client, and a game-cache script decompiler.
  • Paired every tool with an agent skill that states when to use it, which credentials it reads and never prints, the privilege level to confirm before writing, and the trap list that makes it work first time, so AI assistants can run the estate under explicit per-change approval.
  • Established a proof-based change discipline for database-backed upgrades: exact baseline counts, streaming the compressed dump back through a tuple parser to prove the rows are in it, and a post-change row-level diff that classifies every difference as schema migration, live activity, or actual loss.
  • Shipped a verifier for published services that proves DNS is proxied, the edge gate answers, and, the step everyone skips, that the origin refuses a connection without Cloudflare's client certificate.
  • Automated the VM lifecycle end to end: golden-template sealing with preflight snapshot, modernization, guestinfo readiness checks and identity wipe; cloud-init guestinfo deployments that prove the guest came up; and unattended multi-hop Ubuntu LTS upgrades over SSH with hypervisor snapshots as the rollback plan.

Selected accomplishments (in progress)

  • Consolidated a 12-repository Ansible estate (roughly 4,400 lines of real automation spanning an Atlassian stack, Active Directory and certificate-services labs, LEMP and Laravel hosting, security hardening, and certificate distribution) into namespaced collections, de-duplicating roles and repairing playbooks that no longer ran.
  • Python
  • Agent skills
  • RouterOS
  • TR-069
  • WireGuard
  • Backup verification
  • Cloudflare

Device & Systems Integration· Independent project

2023 · Earlier project

Made devices and business systems speak protocols they did not natively share: an infrared gateway driven over TCP, a USB scanner published straight into a home-automation platform's own MQTT discovery contract, and CRM contacts rendered as the directory format SIP handsets fetch.

Selected accomplishments

  • Built a Home Assistant custom component for infrared device control that registers its own service and writes vendor control frames to a networked gateway over TCP, with a per-call device override so one integration drives more than one gateway.
  • Bridged a USB serial tag scanner into a home-automation platform by implementing its MQTT discovery and scan contract directly instead of installing an add-on: a service that selects the device by USB descriptor, publishes its own discovery configuration on connect, republishes each scan as a structured event, and re-establishes the broker session before every publish, paired with udev rules that rebuild the container against the current device node whenever the scanner is plugged in or removed.

Selected accomplishments (prototype)

  • Prototyped a Java service that rendered CRM contacts as the vendor-native XML directory the deployed SIP handsets fetch, so the handset directory tracked the CRM instead of being maintained by hand, structured as a multi-module project separating the CRM client, the directory renderer, and the web tier.
  • Home Assistant
  • MQTT
  • Java
  • Spring Boot
  • udev
  • Docker
  • EspoCRM

Product Architecture & Engineering· Independent product work

Independent, after-hours · Current

Independent, after-hours product architecture exploring scheduled bandwidth orchestration and telecom workflow automation, currently under the working name NexusPort.

Selected accomplishments (prototype)

  • Independent product work exploring scheduled bandwidth orchestration and telecom workflow automation, currently under the working name NexusPort. It takes a class of network change that tends to be manual, repetitive, and timing-sensitive, and gives it a structured product surface with real guardrails: intent separated from execution, validation before anything touches a live service, and an operator approval gate in the loop.
  • The architecture is original, built after hours from public documentation, standard software libraries, and authorized API integrations where applicable. Final product naming and business structure are still being decided.
  • The product model covers one-time, paired, recurring, and bulk bandwidth changes across enterprise ports, with customer/reseller separation, execution history, pricing estimates, onboarding, per-port billing, consolidated invoices, and white-label delivery; the implementation is Laravel with Dockerized delivery, staging operations, carrier-sandbox troubleshooting, and operator runbooks.
  • Product architecture
  • Laravel
  • Network automation
  • API integration
  • Workflow design

NexusPort overview → Project case study →

Infrastructure Configuration & Containment· Independent project

2020 – 2023 · Earlier project

Put infrastructure state under review and made it fail closed: a Windows domain's policy definitions version-controlled with pinned vendor provenance, and a containerized daemon confined to a supervised tunnel by a default-deny egress policy.

Selected accomplishments

  • Put a version-controlled central store behind a Windows domain's Group Policy: 213 administrative templates with a complete English presentation set and five further language packs for the third-party templates, each vendor import landing as its own commit pinned to a named upstream version, so policy-definition changes became reviewable and revertible instead of being hand-copied into the domain share.
  • Contained a containerized network daemon behind a default-deny egress policy so it could only reach the internet through a supervised VPN tunnel: outbound traffic dropped by default with narrow exceptions for the tunnel, DNS and the VPN endpoint, a management interface reachable from the local network but explicitly dropped on the tunnel side, and process supervision that restarts the tunnel without restarting the daemon.
  • Group Policy
  • Active Directory
  • Docker
  • OpenVPN
  • Firewall policy

Embedded, Mobile & Signal Engineering· Independent project

2021 – 2023 · Earlier project

Built instrumented hardware, Android applications, and signal-processing tooling to measure what no off-the-shelf product reported: solar and battery behaviour, water flow and level, charging-cable temperature, vehicle handling, and an undocumented serial protocol.

Embedded & IoT

  • Built and deployed nine networked ESP8266 devices in C++, each reporting into a self-hosted MQTT broker or SNMP poller so the readings landed in the same monitoring stack as the rest of the network rather than in a vendor cloud application.
  • Instrumented an off-grid solar installation with three-channel high-side current and voltage sensing, applying per-channel shunt calibration offsets and deriving panel wattage and PoE draw so battery behaviour could be trended over time instead of guessed at.
  • Built a charging-cable thermal monitor that reads the handle's NTC thermistors through an external analog-to-digital converter, linearizing against a measured reference voltage and divider resistance, with a local display and an asynchronous web server for remote reads.
  • Built sensing and actuation devices around the constraint each measurement actually had: a load-cell scale on a 24-bit converter with a remote tare command delivered over MQTT, interrupt-driven flow-pulse counting with switched 12-volt outputs, a time-of-flight liquid-level sensor averaging 25 ranging samples per reading to reject surface noise, and relay actuators that emulate a momentary button press rather than rewiring the appliance.
  • Built a twelve-channel speaker selector and receiver with digital-potentiometer volume control, driving an increment/decrement potentiometer over GPIO while tracking absolute position in firmware so the web interface could set a level directly rather than only step it.

Mobile

  • Built a driving-feedback Android application that samples the accelerometer, applies a low-pass filter and a user-configurable moving-average window, and reports longitudinal, lateral and vertical g-force with peak-hold and calibration against the vehicle's resting orientation, mapped to published safety-score thresholds.
  • Instrumented that application with real-user monitoring and crash reporting wired into lifecycle and interaction callbacks so field behaviour was measurable rather than inferred, and put it on a hosted CI pipeline that builds the package on every push.
  • Built an Android diagnostic that surfaces live LTE serving-cell identity and channel information through the platform telephony APIs, giving a client-side view of the radio link rather than relying on the operator's own reporting.

Signal processing & reverse engineering

  • Built a desktop signal-processing tool with live plotting: multi-tone generation, Hamming-windowed FFT with window correction, power-spectral-density and channel-power computation, peak-to-average power ratio, and BPSK spreading for direct-sequence experiments.
  • Reverse-engineered the undocumented serial output of a consumer radar detector, deriving its frequency scaling constant empirically and decoding packed little-endian multi-byte fields into the main and secondary target frequencies.
  • ESP8266
  • Embedded C++
  • MQTT
  • SNMP
  • Android
  • Python
  • DSP
  • Reverse engineering

Game Platform, Identity & Reverse Engineering· Independent project

2015 – 2018 · Earlier project

A three-tier multiplayer game platform built as a two-person project with a software-company-grade toolchain: an original authentication tier, an OAuth2 identity provider, service discovery, and CI/CD delivery.

Selected accomplishments

  • Built an original 23,000-line Java lobby and authentication tier for a three-tier game platform: Netty protocol handling, RSA/XTEA/ISAAC session flow, pluggable MySQL and REST authentication, typed failure mapping, world discovery and handoff, social systems, and RabbitMQ cross-service messaging.
  • Extended a large open-source game-server base with roughly 18,000 to 35,000 lines of defensible original change across 127 new files, including Netty/TLS administration, AMQP integration, a 15-region grid content system, developer editors, and operational hooks, while preserving honest attribution of the base code.
  • Replaced hard-coded client hosts with DNS SRV service discovery and liveness probing, added environment-selectable launch modes and private-CA TLS, and built Maven shaded-JAR delivery through Bamboo CI and a CDN.
  • Built a Laravel OAuth2 identity provider with a first-party/third-party partner trust model over Passport, domain and scope policy, email activation, RSA wrappers, browser tests, and a Java authentication library consumed by game services and Atlassian integration work.
  • Operated a software-company-grade toolchain for a two-person project: self-hosted Bitbucket Server, Jira smart commits, Bamboo CI/CD, private Nexus artifacts, Confluence, chat-ops, RabbitMQ, DNS service discovery, and shared Maven parent POMs.
  • Enforced consent policy inside the OAuth2 authorization endpoint rather than trusting registered clients: a partner trust model that reserved session-wide and full-account-control scopes for first-party clients, per-partner scope filtering that rejected an out-of-policy request outright instead of silently narrowing it, and consent-free re-authorization limited to first-party clients holding an explicit passthrough grant.

Selected accomplishments (analysis)

  • Audited the historical platform for credential hygiene, unsafe XStream deserialization, weak TLS, authorization-control defects, cryptographic migration gaps, and inherited chat and login tripwires, documenting reachability and authorship without claiming vendored engine or client code as original.
  • Diagnosed a cross-language credential-format collision (bcrypt variant prefixes and a home-rolled PBKDF2 spread across PHP and Java) that had silently locked new accounts out of one client, and designed a multi-format credential-migration layer over a multi-module Spring Boot 2 project on then-new Java 10.
  • Java
  • Netty
  • RabbitMQ
  • MySQL
  • Laravel
  • OAuth2
  • Maven
  • Bamboo

Additional Engineering Projects· Independent work

2002 – present · Ongoing

Independent learning, prototypes, production utilities, and authorized research spanning two decades of hands-on engineering.

Selected accomplishments

  • Built a Laravel 11 cloud-VoIP application using OAuth2 authorization code with PKCE, encrypted queued token refresh with overlap protection, call-detail and recording APIs, phone-number and SMS features, Docker, and dual-registry GitHub Actions publishing.
  • Developed an Atlassian Crowd directory integration, a Spring Boot vSphere VM-provisioning application, an NTLM/Active Directory single sign-on integration for Nginx, and a Laravel RabbitMQ queue driver.
  • Built a bounded Spring Boot data-extraction web application with authentication, reCAPTCHA, and CSV export from a reusable multi-module Maven/Tomcat scaffold shared across Java projects.

Selected accomplishments (analysis)

  • Reverse-engineered a compromised game client cache by comparing 6,248 scripts across original and modified releases, isolated a 5,027-instruction obfuscated chat-handler prologue, reconstructed its runtime-built strings and substitution cipher, traced a sentinel-gated command channel capable of clipboard exfiltration, and documented a reproducible network-isolated analysis workflow.
  • Designed a complete hardware, imaging, maintenance, and all-MikroTik 10GbE/LanCache plan for a ten-PC competitive gaming venue, balancing performance, thermals, long daily duty cycles, replacement inventory, and fleet uniformity (planning scope only).

Selected accomplishments (prototype)

  • Built the web application for a game-item marketplace: third-party identity joined to platform user records, inventory and profile reads against the vendor's Web API, an HTTP command channel dispatching send and receive trade offers to a pool of distributed trading daemons with per-item status reconciliation, card-payment checkout, an AMQP queue driver for the framework, and chat-ops alerting, built by two people on a licensed commercial application base.

Earlier engineering work

  • Published and maintained a Laravel/Sentinel package for LDAP and Active Directory authentication in 2015, released as an installable Composer package.
  • Maintained a Laravel integration package wrapping the Jira REST API in 2015, built on established upstream Jira and Laravel libraries rather than a from-scratch client.
  • Operated an integrated team development workflow across Jira Core/Software/Service Desk, Confluence, Bitbucket Server, and Bamboo CI in 2016–2017, and reviewed other developers' code with specific guidance on decomposing oversized command handlers and removing duplicated code paths.

Earlier engineering work (analysis)

  • Designed and publicly shared normalized relational schemas for item constraints and character attributes in 2016, covering foreign-key relationships, typed constraint identifiers, composite-key tradeoffs, and an idempotent upsert pattern.
  • Laravel
  • Spring Boot
  • RabbitMQ
  • Reverse engineering
  • MikroTik

Go deeper

The rest of the record

Recruiter brief

A concise introduction, selected evidence, and résumés organized by role focus.

Skills

The public skills inventory, category by category, with named technologies kept where they demonstrate useful experience without exposing sensitive environment details.

Plain-text resume

A machine-readable mirror of the sanitized public resume for ATS parsers, AI agents, and anyone who prefers grep to scrolling.

Contact

Hiring, or have a project in mind?

I'm looking for a senior individual-contributor role with architectural ownership, and I take on independent project work. Tell me what you're building.

Get in touch Project & consulting paths How I work