customer environments across production AI workloads
- Colombo, Sri Lanka
- Senior Cloud DevOps Engineer @ H2O.ai
- MSc, Distinction
Esham Aaqib
Senior Cloud DevOps Engineer for production AI.
Senior Cloud DevOps Engineer at H2O.ai, co-leading infrastructure for a multi-tenant AWS and Kubernetes platform that runs production Predictive, GenAI, and Agentic AI workloads for 100+ enterprise environments across commercial and GovCloud regions. MSc in Cyber Security and Forensics with Distinction.
cloud cost reduction while maintaining production SLAs
of dev and staging EC2 spend moved to Spot within three months, up from zero
years across DevOps, Linux administration, and platform engineering
Platform systems
Infrastructure stack, mapped like a control plane.
Built around the work that matters most in production: scalable AI platforms, secure service-to-service traffic, repeatable infrastructure, GPU serving, and cost-aware operations.
Showing all 12 platform achievements.
Multi-tenant AWS Managed Cloud
Co-lead infrastructure for H2O Managed Cloud: 100+ dedicated customer accounts and EKS clusters running Predictive, GenAI, and Agentic AI workloads across commercial and GovCloud, shipped on a monthly release train.
AWSEKS100+ environments
SSO access management
Launched an SSO-based access service for AWS accounts and EKS clusters with group-based permissions, least-privilege cross-account IAM, and transactional rollback, building on earlier time-bound, audited Support access.
IAM Identity CenterOktaAudit trail
FinOps at fleet scale
Cut platform AWS spend by about 30% through rightsizing, then drove a Spot program that took dev and staging EC2 from 0% to about 65% Spot in three months, alongside Karpenter consolidation tuning and a guarded CAST.AI pilot.
SpotKarpenterCost Explorer
Idle-resource reclaimer
Built a Go service that finds and reclaims idle workloads and orphaned storage with live AWS pricing and a savings dashboard; it flagged about 70 TiB of unattached EBS (about USD 5,000/month) in the first two environments analyzed.
GoEBS~$5k/mo found
Go infrastructure CLI
Built a Go CLI that runs Terraform across the landing zone in parallel waves, diagnoses environment faults, diffs releases, and validates config for commercial and GovCloud, replacing the old GitHub Actions workflows.
GoTerraformGovCloud
Amazon Bedrock catalog
Re-architected the Bedrock integration as a data-driven catalog of 44 models with data-residency enforcement, verified token pricing, and zero data retention at the org root, served through Bedrock Runtime with cross-region routing.
Bedrock44 modelsData residency
Istio Ambient & Gateway API
Led the migration of every production cluster from Linkerd to Istio Ambient while it was still in beta, replaced Emissary with Envoy Gateway, and later added per-namespace waypoints and per-component egress policies.
Istio AmbientEnvoy GatewayEgress policy
Landing zone & GovCloud
Moved Control Tower, Organizations, SCPs, and IAM Identity Center from CloudFormation to Terraform, grew the network to 8+ regions on Transit Gateway, and built the FedRAMP GovCloud landing zone with FIPS tooling.
TerraformTransit GatewayFedRAMP
Kyverno policy enforcement
Replaced Pod Security Policies with Kyverno admission policies, taking them from Audit to Enforce, and hardened securityContext and seccomp settings across about 30 product workloads.
KyvernoPod SecuritySeccomp
GenAI stack & GPU inference
Containerized h2oGPT, h2oGPTe, and LLM Studio on Kubernetes with Helm; ran vLLM and TGI on Karpenter GPU pools (A10G, A100, L4, L40S) and routed Bedrock and SaaS LLMs through LiteLLM.
vLLMLiteLLMGPU node pools
Bottlerocket GPU enablement
Built a custom Bottlerocket AMI with NVIDIA Fabric Manager for AWS p4d instances before official support existed, then maintained the solution for over a year.
BottlerocketNVIDIAp4d
Automated QA agent
Built a Python and Playwright agent that runs end-to-end product tests, diagnoses failures with a budget-capped LLM, and files GitHub issues, paired with an in-cluster Go health checker that probes each LLM.
PlaywrightLLM triageGo
Operator stack
Tools I reach for in production.
The full toolchain behind the platform work: clouds, orchestration, mesh, identity, observability, and AI/ML serving. Hover any pill for a quick read on where it shows up day to day.
Cloud
AWS
AWS GovCloud
Azure
GCP
AWS Cost Explorer
FinOps
Kubernetes & Mesh
Kubernetes
Helm
Karpenter
Istio
Envoy Gateway
KEDA
Velero
Bottlerocket
IaC & CI/CD
Terraform
OpenTofu
CloudFormation
GitHub Actions
Jenkins
GitOps
OIDC federation
AI / ML Infra
vLLM
HuggingFace TGI
LiteLLM
Amazon Bedrock
NVIDIA GPU
Networking
Transit Gateway
Network Firewall
PrivateLink
Site-to-Site VPN
Twingate
Tailscale
WireGuard
Observability
Grafana
Coralogix
Prometheus
CloudWatch
Identity & Security
Kyverno
SCP / RCP
Okta
Auth0
Keycloak
SOC 2
FedRAMP
Upwind
Languages & Tools
Go
Python
Bash
Groovy
SQL
Playwright
Claude Code
Linux
Experience log
From Linux systems to production AI platforms.
Senior Cloud DevOps Engineer / H2O.ai
Co-lead infrastructure engineering for H2O Managed Cloud, a multi-tenant AWS platform of 100+ dedicated customer accounts and EKS clusters, and run the monthly release train.
- Launched an SSO-based access service for AWS accounts and EKS clusters, replacing a legacy credential-issuing system.
- Drove the cost program: dev and staging EC2 went from 0% to about 65% Spot in three months, with Karpenter consolidation tuning.
- Built a Go idle-resource reclaimer that found about 70 TiB of unattached EBS (about USD 5,000/month) in its first two environments.
- Built a Go CLI that runs Terraform across the landing zone in parallel waves for commercial and GovCloud.
- Built a Playwright QA agent with LLM failure triage and an in-cluster Go health checker with per-model LLM probes.
- Re-architected Amazon Bedrock as a 44-model catalog with data-residency enforcement and zero data retention.
- Hardened network boundaries with per-namespace Istio waypoints and per-component egress policies.
DevOps Engineer / H2O.ai
Owned and operated the multi-tenant AWS Managed Cloud platform for Predictive, GenAI, and Agentic AI workloads across 100+ customer environments.
- Reduced platform AWS spend by about 30% through rightsizing and utilization monitoring while preserving SLAs.
- Led the Linkerd to Istio Ambient migration for all production clusters during beta, and replaced Emissary with Envoy Gateway.
- Moved AWS governance (Control Tower, Organizations, SCPs, IAM Identity Center) from CloudFormation to Terraform.
- Expanded the landing zone to 8+ regions on Transit Gateway and built the FedRAMP GovCloud landing zone.
- Replaced Pod Security Policies with Kyverno and hardened about 30 product workloads.
- Ran vLLM and TGI on Karpenter GPU pools and built a custom Bottlerocket AMI for p4d multi-GPU workloads.
- Built time-bound, auditable production access for Support engineers.
- Delivered customer connectivity over Site-to-Site VPN, PrivateLink, and Twingate across AWS, Azure, and GCP.
- Ran the monthly release process and built Claude-powered GitHub Actions for automated PR review.
DevOps Engineer Intern / H2O.ai
Deployed regional WireGuard relays and led the Tailscale migration, cutting VPN-related IT tickets by 90%, and supported SOC 2 readiness.
Linux Systems Administration & DevOps Training Program / WSO2
Completed intensive DevOps and Linux systems training, including geo-distributed GCP infrastructure with Terraform.
Academic track
Where the theory comes from.
An MSc with Distinction, with dissertation research on cloud-native security automation built around the same Istio and Kubernetes work I run in production.
MSc, Cyber Security and Forensics
University of Westminster · United Kingdom
Dissertation on AI-driven Istio service mesh security automation, applying reinforcement and supervised learning to detect and mitigate threats in Kubernetes environments.
IstioKubernetesRL / SLCloud-native security
BSc in IT, Computer Systems and Network Engineering
Sri Lanka Institute of Information Technology · GPA 3.29
Foundations across systems, networking, and distributed infrastructure, including the LoraLeaf LoRaWAN smart-irrigation capstone.
NetworksSystemsIoTLoRaWAN
Project deck
Research, field systems, and DevOps products.
AI-Driven Istio Security Automation
Designed and evaluated an AI-driven approach for Istio service mesh that uses reinforcement and supervised learning to automatically detect and mitigate Kubernetes security threats.
LoraLeaf
Modular smart irrigation system using LoRaWAN and Arduino, collecting soil sensor data and predicting irrigation decisions for low-power agriculture deployments.
OpsVortex
All-in-one DevOps platform concept centered on operational workflows, infrastructure visibility, and deployment control surfaces.
Open channel
Got an EKS, Istio, or GenAI infra problem?
The fastest way to reach me is LinkedIn. Happy to trade notes on EKS, Istio Ambient, AI inference, and cloud-native infrastructure.