Senior DevOps / Platform / SRE Engineer

Anirudh Vaka

Senior DevOps / Platform engineer — production infra on AWS, Azure & Kubernetes at 99.9% uptime for 1000+ customers. Founder of two live AI SaaS products.

Leads a team of 5
Intern → DevOps Lead in < 2 yrs
200+ CI/CD pipelines
ISO 27001:2022

Open to visa sponsorship / relocation · 90-day notice · fully remote-friendly

View Projects Resume Engineering Writeups

I build and operate production infrastructure — and I ship products on top of it. By day, I lead DevOps for an enterprise SaaS platform and operate an on-prem Kubernetes data center I built from bare metal. Outside work, I run two paid SaaS products — PrepAtlas (AI-grounded exam prep) and HumanifyCV (AI text humanization). Currently exploring Senior DevOps / Platform / SRE roles — open to relocation worldwide with visa sponsorship, or fully remote.

production-release.ymlRunning4m 12s

Build42s · multi-arch

SAST1m 08s · Trivy + Grype

IAM12s · OIDC keyless

Deploy1m 34s · ECS rolling

E2Esmoke suite

Uptime

0.0%

on-prem K8s, 2 years

Pipelines

GitHub Actions + Azure DevOps

Faster releases

via containerization

Cloud cost cut

FinOps + right-sizing

Paid SaaS products

PrepAtlas, HumanifyCV

Production DevOps

0+ yrs

since Jan 2023

Selected Projects

Two products I run end-to-end with paying users, the AI platform I built for internal engineering, and the production infrastructure I architect and operate for work.

Product · Live

PrepAtlas

AI-grounded exam prep platform for Indian students

The problem. Indian exam prep platforms surface confident-but-unsourced answers — students can't verify what they're memorising, and hallucinated facts get propagated as truth.

The approach. Retrieval-Augmented Generation grounded in a curated corpus. Every answer cites the source passage(s) it was generated from. Queries are embedded, matched against pgvector in Supabase Postgres, and the top-K passages are passed as context to Claude — answers that can't be grounded are refused rather than hallucinated.

The outcome. 20+ paying users in beta on a $35/month AWS stack. Sub-200KB JS on critical paths. Wrapped as an Android TWA via Bubblewrap so the same Next.js bundle ships native-feel on Play Store.

Student Query

UTF-8 in

Natural-language question entered in the Next.js client. Tokenised, normalised.

embed

Embed

Claude embed

Query embedded into a 1536-dim vector. Cached on the user record for repeat hits.

pgvector

Retrieve

Top-K passages

Cosine-similarity search against the curated corpus stored in Supabase Postgres + pgvector. K = 5.

ground

Claude

grounded prompt

Anthropic Claude prompted with retrieved passages as context and a strict 'refuse if not in context' instruction.

cite

Cited Answer

source-linked

Returned answer links every claim back to the passage it was generated from. Ungrounded claims are blocked.

Vector DBpgvector inside Supabase over Pinecone — one fewer service, RLS on the same Postgres, and quotas covered by the existing free tier.
Mobile shippingBubblewrap TWA over React Native — same Next.js bundle, no duplicate codebase, Play Store install in under a week.
Hosting$35/mo AWS EC2 + nginx + pm2 — predictable cost, no surprise bills, easy to step up to ECS if traffic warrants it.
Performance budgetSub-200KB JS on critical paths — measurable, enforceable, falls straight out of Next.js bundle analysis.

20+ paying users in beta$35/mo hosting cost<200KB critical-path JS

Next.js 15React 19TypeScriptTailwindshadcn/uiSupabase (Postgres + Auth + RLS + Storage)pgvectorAnthropic Claude APIAWS EC2nginxpm2Bubblewrap TWA

Visit prepatlas.in →Engineering deep-dive

Product · Live

HumanifyCV

AI text humanization + resume optimization SaaS with production-grade auth and payments

The problem. Resume-optimisation tools spit out generic AI-flavoured prose and leak credentials through casual OAuth flows. Trust matters: you're handing it your career history.

The approach. Production-grade auth as a feature, not an afterthought. NextAuth v5 with email verification, TOTP 2FA backed by AES-256-GCM-encrypted secrets, and WebAuthn passkeys for passwordless sign-in. Razorpay payments modelled as a discriminated union so refunds, captures, and disputes can't silently miscompile. Anthropic Claude Sonnet runs the actual humanisation.

The outcome. 30–40 paying users on AWS ECS. Sentry for runtime, AWS SES for transactional email, 31 Jest / Testing Library tests on the auth + payment paths specifically.

Auth Layerproduction-grade

NextAuth v5Email verificationTOTP 2FAAES-256-GCM secretsWebAuthn passkeys

App LayerAWS ECS

Next.js 16React 19TypeScript strictPrisma 7Postgres

Integration Layertyped boundaries

Claude Sonnet 4.6Razorpay (discriminated union)AWS SES (Nodemailer)

Observability & Qualitynever-silent failures

SentryJest + Testing Library31 tests

Payment modelRazorpay events as a TypeScript discriminated union — captured / refunded / disputed can't be confused at the type level.
2FA storageTOTP secrets AES-256-GCM-encrypted at rest with a key from secret manager. Plaintext never touches Postgres.
PasskeysWebAuthn FIDO2 over passwords — phishing-resistant, no shared secret, signs in with the device biometric.
Test priorities31 tests concentrated on the auth + payment paths — most damaging failure modes are the regressions caught here first.

30–40 paying users31 tests on auth + payments0 plaintext secrets at rest

Next.js 16React 19TypeScriptPostgres + Prisma 7NextAuth v5WebAuthn passkeysTOTP 2FAAnthropic Claude Sonnet 4.6RazorpayAWS ECSAWS SESSentryJest + Testing Library

Visit humanifycv.com →

AI Infrastructure · Production

Self-Hosted LLM Platform & AI-in-SDLC Auto-Remediation

Open LLMs on bare metal, a multi-provider AI router, and an auto-remediation pipeline that detects, diagnoses, and ships its own fixes behind a QA gate.

The problem. Sending internal code and logs to a third-party API is a non-starter for some workloads, and paying per-token for high-volume internal tooling doesn't scale. Separately, the slowest part of an incident is rarely the fix itself — it's the human round-trip from "something's wrong" to "here's the diagnosis" to "here's a PR."

The approach. I run open models (DeepSeek, Qwen) self-hosted on the on-prem bare-metal cluster via Ollama — powering an internal chatbot and a Copilot-style coding assistant with grounded RAG over pgvector. A custom AI router sits in front of everything, handling prompt caching, model routing, vision, and abort-signal cancellation across Anthropic Claude, Azure OpenAI, and Azure Speech. On top of that runs an AI-in-SDLC auto-remediation pipeline: an LLM reads the error from logs, diagnoses the root cause, generates a fix, opens a PR, and lets automated QA gate the release.

The outcome. Sensitive workloads never leave the data center, high-volume internal AI runs at zero marginal token cost, and the detect→PR loop measurably reduced MTTR — humans review the fix instead of authoring it from scratch.

Detect

from logs

An LLM watches the log/alert stream and classifies real errors out of the noise — the entry point of the remediation loop.

parse

Diagnose

root cause

Grounded against the codebase + prior incidents via RAG, the model proposes a root-cause hypothesis rather than just restating the symptom.

reason

Generate Fix

code diff

The model produces a concrete patch scoped to the diagnosed cause — a diff, not a suggestion.

open

Open PR

human-in-loop

The fix lands as a pull request with the diagnosis attached, so a human reviews an explained change instead of a raw alert.

gate

QA Gate

automated

Automated QA must pass before the change is eligible to release — the safety valve that makes auto-generated fixes trustworthy.

ship

Release

MTTR ↓

Gated changes release through the normal pipeline. The loop turns incident time from author-from-scratch into review-and-approve.

Model Layeron-prem · bare metal

OllamaDeepSeekQwen$0 marginal token cost

Router Layercustom AI router

Prompt cachingModel routingVisionAbort-signal cancellation

Providersmulti-cloud

Anthropic ClaudeAzure OpenAIAzure Speech

Surfacesgrounded on pgvector RAG

Internal chatbotCopilot-style coding assistantRAG (pgvector)

Self-hosted firstOpen models on-prem via Ollama for anything sensitive or high-volume — data stays in the data center, no per-token bill.
One router, many providersA single AI router abstracts Claude, Azure OpenAI, and Azure Speech — prompt caching, routing, and abort-signal handling live in one place.
Grounded, not guessingRAG over pgvector so assistants answer from the actual codebase and docs instead of hallucinating.
Auto-remediation, gatedLLMs open PRs, but automated QA — not the model — decides what ships. Human reviews an explained diff, not a raw alert.

$0 marginal token cost on self-hosted3 → 1 providers behind one routerMTTR ↓ via detect → PR loop

OllamaDeepSeekQwenpgvectorAnthropic ClaudeAzure OpenAIAzure SpeechRAGGitHub Actions

Client engagement · Ongoing

AICPA & CIMA Enterprise Platform

Multi-region AWS deployment + label-driven GitOps for a London-based enterprise SaaS client.

The problem. Sequential branch model, manual cherry-picking between release and main, manual SNOW change tickets, ECS deploys done by hand. Release errors were frequent and slow to attribute.

The approach. Replaced the sequential model with a label-driven GitOps topology. Labels on PRs drive the pipeline — adding fbe spawns a full-stack ephemeral environment (ECS + RDS + S3 + SQS + SNS) provisioned via Terraform; adding staging deploys to ECS staging; merging to main auto-opens a ServiceNow Change Request, authenticates to AWS via OIDC keyless, deploys, and closes the CR.

The outcome. ~70% reduction in release errors. PR setup time from days to minutes. Scheduled Friday-night cleanup auto-destroys all FBEs to save weekend spend.

Feature Branch

PR to release

Developers create feature branches and open PRs to the release branch for review and CI checks.

label: fbe

FBE Spawn

ECS + RDS + S3 + SQS

Full-Stack Feature Branch Environment provisioned per PR via Terraform. Friday-night cleanup auto-destroys all FBEs to save weekend costs.

auto PR

Release → Main

label: staging

Auto-generated PR from release to main. Staging label triggers ECS staging deployment for final validation.

merge

Production Deploy

SNOW CR + OIDC + ECS

ServiceNow Change Request auto-created, OIDC keyless auth to AWS, ECS prod deployment, E2E validation, CR auto-closed.

ServiceNow ITSM

CR lifecycle automated end-to-end via REST

Teams ChatOps

Deploy + incident notifications

Trivy + Grype

Shift-left container CVE scanning

Trigger modelPR labels — fbe, staging, prod — over branch-per-environment. No drift between branches, label removal cleans up.
AWS authOIDC keyless from GitHub Actions to AWS — no long-lived access keys to rotate, no leaked-secret blast radius.
Region strategyMulti-region with Route 53 latency routing + active-active failover. Verified failover via game day.
Change managementServiceNow CR opened + closed by the pipeline — no manual ticket toil, deploy + CR are atomic.

~70% release errors reduceddays → minutes PR env setup200+ CI/CD pipelines

GitHub ActionsAWS ECSAWS RDSLernaTerraformServiceNowOIDCTrivy / GrypeRoute 53

Bare-metal infra · Production

TimeChamp On-Prem Infrastructure

Production Kubernetes data center built from bare metal at CtrlS Hyderabad. Two years at 99.9% uptime.

The problem. TimeChamp's existing platform was a Windows monolith on IIS, deployed by hand, with no observability and unpredictable cloud spend. Customer growth was capped by release velocity and on-call burden.

The approach. Architected and built a full on-prem Kubernetes data center from bare metal — racked Dell PowerEdge servers at CtrlS Hyderabad, designed VLAN segmentation, configured FortiGate 200F + IPSec VPN with dual-ISP failover. Migrated the monolith to Docker + Kubernetes (~15 nodes, 100+ containers on Hyper-V). Deployed Prometheus + Grafana + Loki for observability, 200+ Azure DevOps pipelines for CI/CD, Cloudflare WAF + CDN at the edge.

The outcome. 99.9% uptime over two years. Release cycle cut ~60% with zero-downtime deployments. $0 cloud spend for on-prem workloads — only burst traffic goes to AWS / Azure.

Physical LayerCtrlS Hyderabad

Dell PowerEdge serversFortiGate 200FIPSec VPN + dual-ISPCisco VLAN segmentation

Orchestration Layer~15 nodes · 100+ containers

KubernetesHyper-VDockerHelm

Observability Layermetrics · logs · alerts

PrometheusGrafanaLoki

CI/CD + Edgeautomation · security

Azure DevOps · 200+ pipelinesCloudflare WAF + CDNDR Validator (C# + AWS S3)

On-prem over cloud-nativeDatacenter colo at CtrlS — predictable cost at scale, full network + storage control, regulatory comfort for customer data.
Hyper-V under K8sHyper-V for the hypervisor — leverages the team's existing Microsoft expertise and licensing while K8s does the orchestration.
Network HAFortiGate 200F + IPSec VPN + dual-ISP failover — verified by pulling the live ISP cable. Zero customer impact.
DR ValidatorCustom tool in C# / .NET — restores every MS SQL backup to a throwaway instance daily, alerts on silent corruption.

99.9% uptime · 2 years100+ containers · 15+ nodes$0 cloud spend for on-prem workloads

KubernetesDockerHyper-VFortiGateCiscoPrometheusGrafanaLokiAzure DevOpsCloudflareC# / .NET

FinOps · Cost Engineering

Cloud Cost Engineering

Treating the cloud bill as an SLO. Non-prod that pays rent only when someone's using it, plus the boring commitment work that compounds.

The headline lever. All non-prod AWS scales to zero every Friday at midnight and auto-restores Monday at 6 AM — roughly 54 idle hours a week that used to bill for nothing. It's scheduled automation, so it never depends on someone remembering to shut things down before the weekend.

Monrunning

Tuerunning

Wedrunning

Thurunning

Frirunning

Sat0 replicas

Sun0 replicas

Fri 00:00 → Mon 06:00 · scale-to-zero window

Commitment coverageReserved Instances + Savings Plans on the steady-state baseline so predictable load isn't paying on-demand rates.
RightsizingInstances matched to real utilization, not the size someone picked once and never revisited.
Biweekly reviewsA recurring AWS cost-optimization review — cost is a metric with an owner and a cadence, not a quarterly surprise.
Ephemeral cleanupFriday-night teardown of PR environments so "ephemeral" actually means ephemeral.

~54 hrs/wk idle spend eliminated~25% monthly cloud cost cutAICPA & CIMA AWS savings delivered

AWSReserved InstancesSavings PlansScale-to-zero automationRightsizing

Tech Stack

Technologies I use daily to build, ship, and operate production infrastructure and side products.

Cloud (AWS & Azure)

AWS (ECS, RDS, Lambda, S3, Route 53, IAM, multi-region)
Azure (AKS, VMs / VMSS, Blob Storage, Functions)
Entra ID + Key Vault
Azure OpenAI + Azure Speech
On-prem (Hyper-V, bare-metal Kubernetes)
GCP (fundamentals)

Containers & Orchestration

Kubernetes (production, on-prem + cloud)
Docker
Helm
ArgoCD
Horizontal Pod Autoscaling
Ingress

IaC

Terraform
AWS CDK
Ansible

CI/CD & GitOps

GitHub Actions
GitLab CI
Jenkins
Azure DevOps
ArgoCD
OPA (policy-as-code)

AI Infrastructure

Ollama (self-hosted LLMs)
DeepSeek / Qwen
RAG on pgvector
Anthropic Claude API
AI-in-SDLC auto-remediation

Web & Caching

Nginx
Redis
AWS API Gateway
CloudFront

Networking & Security

Linux
Cisco switches
FortiGate (firewall, VPN, SD-WAN)
VLAN segmentation
Cloudflare WAF
OIDC / IAM
TLS
Trivy / Grype

Databases

PostgreSQL
Supabase
MS SQL Server
MySQL
AWS RDS

Observability

Prometheus
Grafana
CloudWatch
Sentry
Loki
OpenSearch
ELK

Languages

TypeScript
Python
C# (.NET)
Bash
PowerShell
SQL

Engineering Writeups

Longer-form posts on the technical decisions behind my products and infrastructure work. Useful pre-reading for an interview.

● Live

Architecture evolution — three lessons from migrating live systems

IIS→Kubernetes, TeamCity→Azure DevOps, and sequential-branch to label-driven GitOps. What broke, what didn't, and what I'd undo — migrating under live traffic.

anirudhvaka.dev/writeups

● Live

PrepAtlas engineering deep-dive

Grounded RAG with citations, pgvector over Pinecone, TWA over React Native, sub-200KB performance budget, and a $35/mo hosting story.

prepatlas.in/engineering

○ Planned

Building a production on-prem K8s data center from bare metal

Racking Dell PowerEdge at CtrlS Hyderabad, VLAN segmentation, FortiGate failover, choosing Hyper-V under Kubernetes, and what 99.9% uptime for two years actually cost.

anirudhvaka.dev

Let's build together

Open to Senior DevOps / Platform / SRE roles — relocation worldwide with visa sponsorship, or fully remote. Let's talk.

Open to visa sponsorship / relocation · 90-day notice · fully remote-friendly

anirudh.dev shell — type 'help' to list commands.

Get in touch Connect on LinkedIn