Сергій

SERHii KiSHiNETS

SENiOR DEVOPS ENGiNEER

CONTACT
Email: [відкрити контакти](див. вище в блоці «контактна інформація»)
Phone: [відкрити контакти](див. вище в блоці «контактна інформація»)

SUMMARY
20 years in software development: from C++ games and Symbian to Ruby on Rails; DevOps
since 2022. As a Linux user since 2008, I’ve always had a hand in servers and deployment:
Capistrano on a VPS in 2009, Ansible and Monit in 2012.
Today I run the AWS infrastructure of a healthcare communication platform: EKS in two re-
gions, managed entirely with Terraform and Helmfile, and GitLab CI pipelines with the security
checks SOC2 requires for patient data. Since 2023 I’ve handled it alone, work that previously
took a team of two DevOps engineers.
I work on infrastructure the way a developer does: when a standard tool falls short, I read
its source and, if needed, build my own tools. I accept technical debt as long as it stays under
control. Copy-paste works for a while, but copies hide their differences; a shared template
exposes them, so changes become faster, clearer and safer.
I use AI daily. Gemini got me on track with DevOps: requirements, tooling and approaches.
As my knowledge grew, I switched to Claude Code as an agent, mostly for code: digging into
Ruby, Node and Python projects, where it’s a huge help. It’s like pair programming with a
partner who can quickly check a theory or build a proof of concept. Configuration as code
often doesn’t explain itself, so I write down the reasoning behind every non-obvious decision in
Terraform, Dockerfiles and CI, for the next person or AI that touches it.

SKiLLS
Cloud AWS: EKS, ECR, RDS/Aurora, IAM, WAF, CloudFront, S3, SSM
Kubernetes EKS, Karpenter, HPA, VPA, Helmfile/Helm, multiarch x64/ARM64
IaC, CI/CD Terraform, GitLab CI, BuildKit, Docker multi-stage, Docker Compose
Networking AWS VPC, peering, security groups, ACL, NLB, Tailscale (WireGuard)
DevSecOps OIDC, RBAC, SAST, IaC SAST, Secret Detection, SOC2, HIPAA
Monitoring Prometheus, Grafana, New Relic, CloudWatch
Programming Ruby, JavaScript, Python, Bash; Linux
Databases PostgreSQL, MySQL, MongoDB, Redis/Valkey
AI Claude Code (agentic), Gemini

EXPERiENCE
DevOps Engineer, DEWAIS · LITSLINK team · healthcare project
05/2022–present
INFRASTRUCTURE AND RELiABiLiTY
• Since 2023, solely responsible for the AWS infrastructure of a healthcare platform under
HIPAA and SOC2: EKS clusters for dev, prod and a prod DR region, Terraform, Helmfile,
GitLab CI. Took over from a two-person DevOps team.
• Led a phased production migration from legacy Rackspace hosting to AWS. Started by
moving files to S3 and running the new code as a Docker Compose canary, shifting customers
over until it carried most of production. Finished by moving MySQL, MongoDB and Redis
to EKS with minimal downtime (live Redis replication via RIOT), consolidating subdomains,
reworking ingress and stabilising the platform afterwards.
• Built a disaster-recovery region with data replication, CloudFront failover, Aurora Global
Database, runbooks and DR drills.
• Kept the stack on supported versions: EKS from 1.29 to 1.37, add-ons and Terraform
modules, plus harder migrations such as Karpenter 0.37 to 1.0 with its CRD changes. Built
STIG-hardened AL2023 AMIs (stig-build-linux) with EC2 Image Builder.
• Configured Karpenter, VPA and HPA, and right-sized requests and limits from actual usage
(Prometheus data) to reduce cost. Set QoS classes and PDBs so that critical pods are
Guaranteed and evictions hit only pods that are safe to restart.
• Built multi-arch clusters and CI (x86-64 and ARM64) to cut cost and improve performance:
multi-arch images, services moved to ARM64 where possible, x86-64 kept for the rest.
• Optimised cost and performance across AWS services (CloudWatch, RDS backups, NLB,
S3 and more) and Kubernetes, including CI runner pods sized from Prometheus metrics;
migrated Redis to Valkey.
• Upgraded Aurora MySQL and PostgreSQL in place where possible and with blue/green
deployments otherwise; moved RabbitMQ to 4.2.

INFRASTRUCTURE AS CODE AND AUTOMATiON
• Automated manual steps with Terraform: resources, users, databases and grants for MySQL,
PostgreSQL, Redis, RabbitMQ, DocumentDB and more, with secrets generated and stored
in AWS SSM. New test environments come up quickly, and production is guaranteed to
match dev.
• Brought resources created by hand or by other teams’ prototypes under Terraform, and ran
several infrastructure changes in parallel with targeted terraform apply -target.
• Rewrote GitLab CI to remove copy-paste and dead code: rules-based templates, shared jobs,
the same conventions for every service. Extracted shared Helmfile config and templated test
environments.

BUiLDS AND TESTS
• Shrank the Rails image from 4 GB to 850 MB by writing a separate Node.js/Puppeteer
service for PDF generation and serving static files and assets from S3 and CloudFront.
• Optimised deploy time across projects with caching, faster bundling (rolldown for Vue), and
by skipping work whose results haven’t changed: build outputs are fingerprinted and fetched
back instead of rebuilt. Rails deploys went from 40 minutes to 10.
• Moved CI from the unsupported docker-machine to the GitLab Kubernetes runner with
rootless BuildKit, which also made multi-arch builds and right-sized CI jobs possible.
• Set up BuildKit and GitLab CI caching for every project, with multi-stage Dockerfiles
throughout.

• Made test runs practical again. RSpec took 14 hours, so developers had stopped running
it: added parallel_tests with process balancing and change-based selection with Crystalball,
bringing it under an hour. Vue tests on Jest were capped by memory at 4 CPUs on 32 GB
nodes; vitest uses far less memory, which let them scale to 16 CPUs and run four times
faster, finishing in about half an hour.
• Built artifact storage and retrieval across pipelines for incremental runs, first for the Vue
type check, then for RSpec.
• Set up GitLab test and coverage reports so developers and AI tools see results right in the
merge request and coverage is tracked across projects.

DEVSECOPS
• Replaced static keys with GitLab OIDC and least-privilege IAM. Set up RBAC, a private
EKS endpoint, non-root containers, FIPS TLS on load balancers, TLS to every data store,
pgaudit and AWS WAF rules.
• Added GitLab SAST, IaC SAST, Secret Detection and dependency audits (bundler, yarn,
mix, pip) to CI.
• Ran SOC2 vulnerability remediation with Vanta. Patched Mirth Connect, which had no
official fix, by decompiling, patching and rebuilding its fat JAR. Updated Node dependencies,
moved Python services to uv for controlled updates, backported Debian Trixie packages to
Bookworm ahead of stable, and rebuilt BuildKit with updated dependencies.
• Hardened the web layer: enforced CSP, tightened CORS, secured cookies, added HSTS, and
fixed external pentest findings.

TEAM
• Interviewed DevOps candidates, onboarded new engineers and performed knowledge trans-
fer.

APPLiCATiON PLATFORM
• Upgraded stacks and dependencies across Ruby, Python, Node and Java projects, including
Rails 6.0 to 7.2 and Ruby 2.6 to 3.4 with every gem in a large legacy codebase (Trilogy and
Zeitwerk included).
• Implemented a MySQL read replica with automatic fallback: reads go to the replica and are
retried on the writer if they fail. It is transparent to application code.
• Identified a Puma memory leak and contained it with jemalloc and periodic worker restarts.
• Ran a Citrix client in Docker (X11, VNC) for RPA automation on the cluster and for local
development. Traced its failure on the cluster to /dev/shm and found a working setup.
• Provided developer environments: Dockerfiles and Docker Compose for the services, and
AWS WorkSpaces so new developers had a working desktop on day one.
• Built an isolated environment for an AI agent (Claude Code) using Docker, Podman and
Kata Containers.
• Maintained a strongSwan sidecar for IPsec tunnels to customers of an integration service:
builds, deployment and fixes.

04/2021–02/2022 Senior Ruby on Rails Developer, DEWAIS · SpaceIQ project
Designed and built GraphQL APIs backed by complex SQL queries; refac-
tored SQL and application code, wrote specs, fixed bugs.
11/2020–03/2021 Senior Ruby on Rails Developer, DEWAIS · Lingu AS project
Built REST APIs for the front-end team, business logic and new features.
03/2018–09/2020 Own product
Worked on my own product in Ruby and JavaScript.
07/2015–02/2018 Tech Lead, Ruby on Rails, Svitla Systems
Led the team that took over a cash-flow analysis application and cleared all
known defects within six months. Ported and refactored CRMA (Certifi-
cation Risk Management Assurance) from MSSQL and VB to PostgreSQL
and Rails, with regression tests that compared results against the legacy
system, including calculations that existed only in Excel. Took on the most
complex parts myself to keep quality high. Deployed on Heroku.
11/2012–06/2015 Self-education and experiments
Unix and C, HTML5 and JavaScript.
08/2011–09/2012 Senior Ruby on Rails Developer, Brightgrove Ltd.
Agile team on Rails, PostgreSQL, Haml, SCSS and jQuery. Full test cov-
erage let us change direction and redesign freely, and the product found its
customers. Worked across back end and front end; automated hosting and
deployment with Ansible and set up process monitoring with Monit.
03/2010–07/2011 Ruby on Rails Developer, UGE GmbH
Map-based search for places such as cafés and hotels, later with social fea-
tures. Distributed multilingual team, Scrum; Rails, PostgreSQL.
04/2009–03/2010 Ruby on Rails Developer, LudicDream
Inherited a cloud print CMS, cleared its technical debt module by module
and added new features. Rails, MySQL; deployed to a VPS with Capistrano.
2005–2009 Early experience
Freelance: web apps in Rails, Django and PHP; desktop apps in C++ and
Python for Linux and macOS.
QArea: PHP e-commerce; C++ for Windows and Symbian S60.
AlfaKlass: C++ game logic and UI for a turn-based strategy game.

EDUCATiON
09/2001–02/2007 National Aerospace University “Kharkiv Aviation Institute”.
Specialist degree (5 years, MSc equivalent), Computerised Control Systems
and Automation.

LANGUAGES
Ukrainian Native
English Fluent