Elvis Rafael Gross Cardero

• → Managed multi-account AWS environments supporting mission-critical gaming infrastructure serving millions of end users, maintaining 99.9%+ availability through proactive monitoring and rapid incident response.
• → Automated patch compliance across 200+ Linux and Windows EC2 instances using SSM Patch Manager, reducing patching cycle time by ~40% while maintaining full audit trails.
• → Led zero-downtime EKS cluster version upgrades in production using a Golden AMI strategy — pre-hardened node images, controlled drain/cordon rotations, and post-upgrade validation via CloudWatch Container Insights.
• → Reduced MTTD for production incidents by implementing CloudWatch custom alarms, log-based alerting, and Container Insights dashboards enabling proactive anomaly detection before user impact.
• → Designed and validated DR strategies achieving defined RTO/RPO targets, including quarterly DR testing cycles and runbook documentation ensuring team-independent recovery procedures.
• → Conducted AWS Well-Architected Framework reviews across 2 HRI lenses and 3 workload assessments using the Well-Architected Tool — identifying and remediating 6 critical gaps including lack of backups, missing CloudWatch alarms, overly permissive IAM policies, unencrypted data at rest, no multi-AZ design, and absent tagging strategy. Delivered improvement plans reducing risk exposure across reliability and security pillars.
• → Eliminated manual server-by-server operations by standardizing 5–10 recurring tasks through SSM Automation Documents and Run Command — reducing execution time from hours to minutes across instance fleets.

• → Architected and delivered production-ready GCP solutions for enterprise clients using Cloud Run, Pub/Sub, BigQuery, Cloud Functions, IAM, and Cloud Storage — directly contributing to technical wins across the sales cycle.
• → Reduced time-to-close on technical evaluations by ~30% by building end-to-end PoCs validating serverless and real-time data pipeline architectures.
• → Designed secure IAM frameworks and real-time data pipeline architectures (Pub/Sub + BigQuery) as core components of enterprise proposals.
• → Delivered live technical workshops and architecture demos to C-level and technical stakeholders, translating complex GCP capabilities into clear business value.

• → Monitored cloud infrastructure health using observability and logging platforms, triaging and resolving incidents across compute, networking, and IAM layers.
• → Managed access provisioning and security posture reviews, enforcing least-privilege principles across cloud environments.

Production-Grade Homelab — Hybrid Cloud Environment

Self-hosted bare-metal Kubernetes cluster on physical nodes managed with Proxmox. GitOps delivery via ArgoCD integrated with Jenkins CI/CD pipelines and GitHub self-hosted runners. Configuration management with Ansible + Ansible Vault. Secrets managed via HashiCorp Vault. Observability stack: Prometheus, Grafana, and Loki. Event-driven autoscaling with KEDA. Deployed a Go-based load testing application to evaluate real workload performance across bare-metal nodes and AWS EC2 via secure hybrid tunnel. Security posture managed with Wiz.

fraud-detection-aws-platform — AWS Private EC2 Operations Platform ↗

• → Architected a fraud transaction scoring platform on AWS with a Python worker in private EC2 subnets — no SSH, no bastion, zero inbound exposure; operator access exclusively via SSM Session Manager over VPC Interface Endpoints, with a fully operational SQS → EC2 → DynamoDB pipeline.
• → Authored 11 single-responsibility Terraform modules and implemented OIDC-based GitHub Actions CI/CD with no static credentials — dual-role model (read-only plan / admin apply) scoped to exact OIDC sub claims, with terraform plan posted as a PR comment on every pull request.
• → Built an EC2 Image Builder pipeline producing hardened AL2023 ARM64 Golden AMIs with CIS baseline, CloudWatch Agent, and an ARM64 Python validation gate — malformed AMIs never reach the fleet, with ASG rolling updates on new AMI publish.
• → Integrated GuardDuty (S3 + EC2 malware scanning), AWS Backup (7-day warm / 30-day cold, KMS-encrypted vault), EventBridge routing of HIGH/CRITICAL findings to SNS → Lambda → Slack, and AWS Budgets capped at $100/month.