Cloud & Infrastructure Engineer
Provisioning, deployment, and the platforms underneath both.
- Pipelines and orchestrationWhy a pipeline step has to be idempotent before it can be safely retried, what a DAG actually buys you over a cron job, and the backfill that silently double-counts because a task wasn't designed to run twice.
- SnowflakeStorage and compute billed separately and what that actually buys you, warehouse sizing as a credits-per-hour multiplier, and the idle-warehouse cost that silently doubles a bill nobody looks at closely.
- PostgreSQL in productionWhat EXPLAIN actually says once you know where the loops divide, why VACUUM is not optional, and how a table can be 500,000 rows and still choose to scan every one of them — correctly.
- CosmosDB and partition keysWhy the best-distributing partition key is often the wrong one, how RU/s gets divided among partitions you don't control, and the migration you can't avoid once a key choice turns out wrong.
- NoSQL data modellingModel by access pattern, not by entity — why a NoSQL schema starts from the queries you'll run rather than the things you're storing, and what breaks when a new query arrives that the model didn't anticipate.
- Vector databases comparedPinecone, Qdrant, and Weaviate implement the same ANN algorithms pgvector does — what actually differs is operations, filtering, and how each one degrades at the corpus size pgvector stops being comfortable.
- File formats and object storageRow-oriented versus column-oriented storage, why Parquet reads 10x less data for an analytical query than CSV, and what Delta and Iceberg add on top that a folder of Parquet files can't do alone.
- Cloud fundamentals — regions, IAM, and the shared responsibility modelThe vocabulary every cloud provider assumes you already have: regions and availability zones as a blast-radius decision, IAM as default-deny, and the shared responsibility line that determines who gets paged for a breach.
- AWS — the services that show up in most stacksEC2, S3, RDS, Lambda and IAM roles as the five services almost every AWS architecture is built from, and the mental model — instance vs managed service vs event-driven function — that generalizes to any provider.
- Azure — resource groups, Entra ID, and Cloud Run's closest cousinWhat's genuinely different about Azure once you already know AWS — resource groups as a real management unit rather than a tagging convention, and Entra ID's tenant-first identity model.
- GCP — projects, IAM inheritance, and Cloud RunWhat's genuinely different about GCP once you already know AWS and Azure — the project hierarchy IAM inherits down through, and Cloud Run's per-request billing as a distinct point between Lambda and a always-on container.
- Terraform — plan, state, and when an edit becomes a replacementReal terraform plan output showing the distinction that matters more than any HCL syntax — update in place versus destroy-and-recreate — plus state as the thing that makes any of this safe to run twice.
- Containers — layers, caching, and what isolation actually meansA container is a process, not a VM — namespaces and cgroups instead of a hypervisor, and image layers as a cache Docker computes from, which is why Dockerfile instruction order is a real performance decision.
- Kubernetes — requests, limits, and why OOMKilled isn't about limits aloneRequests decide where a pod is scheduled; limits decide when it's killed — two different numbers, easy to set identically, and the gap between them is where most production Kubernetes incidents live.
- CI/CD — the pipeline as the only path to productionWhy caching only helps when it's actually restored, what a deployment strategy trades off (blue-green vs rolling vs canary), and the discipline that makes a pipeline trustworthy — nothing reaches production except through it.
- Observability — logs, metrics, traces, and what each can't tell youThree signal types that answer different questions, why none of them substitutes for the others, and SLOs as the mechanism that turns "is it slow" into a number someone can page on.
- Cloud cost — where the bill actually comes fromEgress, idle capacity, and commitment discounts as the three levers that move a cloud bill the most, with real 2026 pricing tiers worked through as arithmetic rather than asserted as a rule of thumb.
- Cloud security — where incidents actually come fromAlmost no real cloud security incident is the provider's infrastructure failing — it's a misconfiguration on the customer's side of the shared responsibility line: a public bucket, an over-broad role, a leaked long-lived credential.
- Vector searchApproximate nearest neighbour search — what HNSW actually trades away, why recall is a dial rather than a property, and the memory cliff that turns a fast index into a slow one.
- LLMOpsRunning LLM features in production — what to log when output is non-deterministic, where the cost actually goes, and how to ship a model upgrade without breaking things silently.
- GuardrailsPrompt injection has no clean fix, and understanding why tells you where the real controls go — output validation, capability limits, and authorisation that never trusts the model.
- GPU serving — memory, batching, and the throughput you're leaving on the tableGPU memory and GPU utilisation are different numbers measuring different things, continuous batching is why vLLM serves several times the traffic of a naive loop, and CUDA OOM is almost never "just add more VRAM."
- LLM gateway — routing, fallback, and cost attribution across providersA gateway is the one place that knows every provider's health, every tenant's spend, and which request should fail over to what — pulling routing logic out of application code before the second provider makes it unavoidable.
- Gateway & Load BalancingHow each load-balancing algorithm actually behaves once backends stop being identical, and the health-check condition that decides when a sick instance gets taken out of rotation.
- Event-Driven ArchitectureWhat a service gives up when a synchronous call becomes an event it fires and forgets — and the specific things you have to build back to recover the traceability that call had for free.
- Resilience PatternsWhy a retry without a budget makes an overloaded dependency worse, and the bound — timeout, retry budget, circuit breaker — that turns a retry back into a fix instead of an amplifier.
- Multi-TenancyThe isolation guarantee at each layer of a shared system, why the data layer is a correctness and trust problem before it's a cost one, and what one noisy tenant does to everyone sharing the system with them.
- The incident method — why fixing is step sevenDetect, isolate, mitigate, investigate, fix, prevent — the order production incidents actually get resolved in, and why jumping straight to a fix is the single most common mistake under pressure.
- Reading the symptoms — CPU, latency, and what each combination rules outLow CPU and high latency means waiting, not working — measured from a real service genuinely faulted six different ways, not asserted. The single fact this whole section is built around.
- Linux production debugging — top, free, ss, dmesg, and what they actually meanReal captured Linux command output from a genuinely loaded container — what every column in top means, why free's "used" number lies by omission, and the kernel's own record of an OOM kill in dmesg.
- Kubernetes production debugging — pod states, real and brokenImagePullBackOff, CrashLoopBackOff, Pending, OOMKilled — captured from four genuinely broken pods on a real kind cluster, with the exact kubectl describe events that explain each one.
- Distributed tracing — spans, context propagation, and where the time actually wentA trace is a tree of spans reconstructing one request across every service it touched. Drag one span's duration and watch why optimising the wrong one is arithmetically irrelevant.
- Cascading failures — how one slow dependency becomes a total outageA downstream 429 turned into a 5x amplification, captured for real — bulkheads, backpressure, and load shedding as the three mechanisms that stop one failure from becoming every failure.
- Capacity estimation — the back-of-the-envelope math that catches a bad plan earlyQPS, storage, bandwidth, and Little's Law worked as real arithmetic, not asserted — the estimate that tells you a plan won't work before you've built anything.
- AI incident catalogue — the failure modes unique to LLM systemsPrompt growth silently turning into a latency and cost regression, a retry loop between two agents that never terminates, a retrieval pipeline that went quiet — the incident shapes that don't show up in a normal backend's playbook.