Salman Ansari | AWS DevOps Engineer

Technical Expertise

Core Skills

☁️

Cloud Computing & Architecture

EC2S3 Route 53CloudFront ALB/NLBAWS BedrockSSM

AWS Core Services90%

🏗️

Infrastructure as Code

TerraformCloudFormation TerragruntAWS Lambda Auto ScalingASG

Terraform / CF88%

🐳

Container Orchestration & GitOps

Amazon EKSEKS v1.35 KarpenterIstio (ambient) Helm 3ArgoCD cert-managerESO IRSA

EKS / GitOps85%

⚙️

CI/CD

Jenkins (JCasC) Shared Library AWS CodeBuild GitHub Actions (OIDC) Gitea ArgoCD

Jenkins / CodeBuild87%

🔐

Cloud Networking & Security

VPCTransit Gateway Direct ConnectOpenVPN IRSASecrets Manager ACMWAF

Networking & Security85%

📊

Observability, DB & FinOps

OpenTelemetryGrafana ClickHouseHeadlamp kube-state-metricsFluent Bit CloudWatchRDS PostgreSQL DocumentDBElastiCache RabbitMQTemporal FinOpsBash / Python

Observability / DB80%

Career Timeline

Work Experience

Software Engineer - DevOps

May 2026 – Present

🏢 Lumiq · Noida

Cloud infrastructure, container platform, and CI/CD delivery for Lumiq's flagship enterprise SaaS product — an AI-powered workflow orchestration platform deployed for tier-1 BFSI clients across Dev, UAT, and Prod.

Architected and managed JCasC-configured Jenkins CI/CD control plane with a custom Shared Library (standardized application-build and Helm chart-build pipelines) for standardized multi-environment client releases.
Engineered private Amazon EKS (v1.35) clusters with Karpenter dynamic provisioning and an Istio ambient-mode service mesh (ztunnel + CNI); private API endpoint, internal ALB over VPN, in-account ECR mirroring, IRSA least-privilege roles, and OpenVPN EC2 gateway.
Built layered Terraform & CloudFormation IaC architecture across Dev, UAT, and Prod environments including VPC Peering, Transit Gateway, DocumentDB, ElastiCache Redis, and RDS.
Delivered 50–60% UAT infrastructure cost reduction via automated off-hours stop/start routines across compute, database and networking layers, plus a Cost Explorer Lambda publishing daily spend reports.
Built a self-hosted OpenTelemetry → ClickHouse → Grafana observability platform across 4 client environments — OTLP + Prometheus receivers dual-exporting to ClickHouse and CloudWatch, kube-state-metrics and kubeletstats collectors for cluster telemetry, and 4 authored Grafana dashboards provisioned via sidecar ConfigMap, with Headlamp K8s UI behind a shared internal ALB (IngressGroup) with ACM TLS.

AWS Cloud Engineer

July 2022 – April 2026

🏢 Tata Consultancy Services (TCS) · Mumbai

Provisioned and governed AWS infrastructure across 9 accounts using AWS Organizations, custom subnet routing, and hybrid connectivity (Site-to-Site VPN, Direct Connect, Transit Gateway).
Built reusable, modular Terraform IaC templates reducing multi-environment delivery timelines from weeks to 1–2 days.
Operationalized Amazon EKS and Amazon ECS microservice container platforms with Auto Scaling Groups to sustain 99.9% High Availability.
Spearheaded AWS FinOps cost optimization driving 30–40% infrastructure spend reduction via rightsizing, idle resource cleanup, and Savings Plans.
Managed Linux RHEL EC2 workloads with custom Python (boto3) and Bash automation; built CloudWatch alarms and metric filters for proactive observability.

B.Tech Graduate (Information Technology)

2018 – 2022

🎓 PVPP College of Engineering, Mumbai · CGPA: 7.4

Bachelor of Technology — completed foundational engineering and computer systems curriculum.
Obtained AWS Certified Cloud Practitioner shortly after graduation in 2022.

Featured Work

Key Projects

🚀

End-to-End SaaS Platform Deployment (Greenfield AWS Account → Production)

Account & network — private-only VPC, NAT egress, Transit Gateway and VPC Peering into the corporate network, Site-to-Site VPN
Compute & data — private EKS with Karpenter, plus DocumentDB, RDS PostgreSQL, ElastiCache Redis and a self-managed RabbitMQ cluster
Delivery — ECR with in-account mirroring, CodeBuild promoting images Dev→UAT, Helm releases driven from a Jenkins control plane
Identity — per-service IRSA roles and External Secrets Operator, with no static credentials anywhere in the estate
Observability — OpenTelemetry to ClickHouse and CloudWatch, with Grafana dashboards per service
Cost & alerting — EventBridge-scheduled off-hours shutdown, a daily Cost Explorer report, and CloudWatch alarms into SNS email
The same layer sequence, applied in a fixed order, brought Dev, UAT and Production online for every new client tenant

TerraformCloudFormation Amazon EKSKarpenter IstioAWS CodeBuild IRSAExternal Secrets Transit GatewayOpenTelemetry

⚡

Multi-Tenant CI/CD Control Plane & Private EKS Runtime

Jenkins control plane — JCasC-managed, with a reusable Groovy Shared Library and branch-per-client release governance so one tenant's pipeline changes can never reach another
Build orchestration — Jenkins-to-CodeBuild trigger pattern with Lockable Resources for concurrent-build safety and scheduled nightly builds
Chart pipelines — SemVer-validated Helm packaging with OCI artifact push to ECR, umbrella charts per product suite
Private runtime — EKS nodes in private subnets with a private API endpoint and an Istio ambient service mesh; ingress via an internal ALB reachable only over VPN
Edge protection — where public access is required, an internet-facing ALB fronted by AWS WAFv2 with IP allowlisting, managed rule groups and rate limiting
Telemetry UI — self-hosted Grafana and Headlamp behind one shared internal ALB, replacing a licensed vendor UI and its MongoDB dependency

Jenkins (JCasC)Shared Library AWS CodeBuildHelm 3 (OCI) Amazon EKSIstio (ambient) GrafanaOpenVPN

🏗️

Production Multi-Tier Serverless & Containerised Infrastructure

Provisioned production-grade AWS infrastructure using Terraform across a single account with three distinct traffic flows
Flow 1 — static content served globally via CloudFront backed by S3
Flow 2 — dynamic API traffic routed through CloudFront to API Gateway, NLB, and ECS Fargate with RDS PostgreSQL as the transactional backend; Fargate Spot used for non-production to reduce compute costs
Flow 3 — async event-driven processing via API Gateway publishing to SQS, with Lambda consumers writing results to DynamoDB, fully decoupling async workloads from the synchronous API layer

CloudFrontS3 API GatewayNLB ECS FargateRDS PostgreSQL SQSLambda DynamoDBTerraform

💰

AWS Cost Optimization & FinOps Automation

Configured S3 lifecycle policies to automatically transition and expire objects across storage tiers
Migrated all non-production EKS workloads to Spot Instances, reducing compute costs while maintaining availability
Built a Python cleanup script triggered via EventBridge to automatically remove orphaned EBS volumes and stale snapshots on a schedule
Replaced 3–4 manually managed EC2 instances behind an ALB with an Auto Scaling Group, improving resilience and eliminating manual overhead
Used AWS Compute Optimizer to identify and implement rightsizing recommendations across EC2 instances
Exported Cost Explorer recommendations, mapped against existing workloads, modelled estimated savings, presented to client, and facilitated purchase of Savings Plans and Reserved Instances

S3 LifecycleSpot Instances EventBridgePython ASGCompute Optimizer Savings PlansReserved Instances

Architecture 01 — Multi-Tenant SaaS Platform (Production)

Platform Architecture

Per-Tenant AWS Account — Private EKS SaaS Deployment

Every tenant environment is built from the same ordered Terraform layers, applied into its own AWS account. Application nodes and data services sit in private subnets; the cluster API endpoint is private, and human access arrives only over VPN. Public exposure, where a tenant requires it, is terminated at a WAF-protected ALB.

ACCESS

Corporate Network

On-prem estate

Transit Gateway

+ VPC Peering

OpenVPN / Bastion

Engineer access · SSM

Internal ALB

ACM TLS · VPN-only

PUBLIC EDGE

Internet

Tenant users

AWS WAFv2

IP allowlist · rate limit

Internet-facing ALB

Public subnet

RUNTIME

Private EKS

Private API endpoint

Karpenter

Dynamic capacity

Istio Ambient

ztunnel + CNI

IRSA + ESO

Secrets Manager sync

DATA

DocumentDB

Primary store

RDS PostgreSQL

Temporal engine

ElastiCache

Redis cache

RabbitMQ

StatefulSet · gp3

S3 + KMS

Encrypted objects

DELIVERY

Jenkins (JCasC)

Shared Library

AWS CodeBuild

In-VPC · EKS access

Amazon ECR

OCI charts + images

Helm Release

Per tenant / env

TELEMETRY

OTel Collector

OTLP + Prometheus

ClickHouse

Columnar · TTL

Grafana

Dashboards + Headlamp

CloudWatch

Logs · Flow Logs

SNS

Alarm email

Private-subnet workloads · VPC Flow Logs to CloudWatch · SOC 2 resource tagging

Off-hours EventBridge shutdown across database, compute and gateway layers

Architecture 02 — Serverless & Containerised Multi-Tier

Reference Architecture

Production Multi-Tier Serverless & Containerised Infrastructure

ENTRY POINT

CloudFront

CDN + Edge

STATIC

S3

Static Assets

SYNC API

API Gateway

REST

NLB

Network LB

ECS Fargate

Prod / Spot

RDS

PostgreSQL · Multi-AZ

ASYNC

API Gateway

REST

SQS

Queue

Lambda

Consumer

DynamoDB

NoSQL · Results

Flow 1 — Static (CF → S3)

Flow 2 — Sync API (CF → APIGW → NLB → ECS Fargate → RDS PostgreSQL)

Flow 3 — Async (CF → APIGW → SQS → Lambda → DynamoDB)

Credentials

AWS Certifications

🏅

AWS Certified Solutions Architect – Associate

Amazon Web Services · SAA-C03

2024

☁️

AWS Certified Cloud Practitioner

Amazon Web Services · CLF-C02

2022

Get In Touch

Let's Connect

Open to New Roles

I'm actively looking for AWS Cloud / DevOps Engineering opportunities. Whether it's full-time, contract, or consulting — feel free to reach out.

✉️

Email salmanansari9869@gmail.com

📱

Phone +91 7977 086 834

🔗

LinkedIn linkedin.com/in/its-salman-ansari

Currently open to opportunities

Mumbai, India

Open to remote roles worldwide and relocation opportunities.

Send Email ⬇ Download Resume

SalmanAnsari