Konrad Podgórski

Skills and technologies

DevOps, site reliability, software architecture and security, grouped by area.

The same skills by role: DevOps engineer, site reliability engineer, software architect and security advisor.

Architecture

Systems designed to be run and changed by the next team, from legacy rewrites to new platforms.

  • Software architecture
  • Scalability
  • Legacy rewrites
  • Domain-driven design
  • Documentation for handover

Infrastructure as code

Everything in code and changed through review, including what was clicked before, so a broken or compromised environment can be rebuilt from the repository.

  • Terraform
  • Reusable modules
  • Multi-account layouts
  • Landing zones
  • Importing existing infrastructure
  • Terraform refactoring
  • Disaster recovery from code
  • Terraform Cloud (HashiCorp's hosted Terraform runs)
  • Secrets management

CI/CD and testing

Pipelines that test what ships, gate every plan and release in one merge, with guardrails the platform enforces: linting, protected branches and rulesets.

  • GitHub Actions
  • Reusable workflows
  • Gated Terraform plan and apply
  • Gitflow
  • Release candidates
  • Release automation
  • Branch protection
  • Repository rulesets
  • Required status checks
  • Auto-merge
  • Changelogs
  • CodePipeline
  • CodeBuild
  • Unit tests
  • Integration tests

Code quality and security

Linters and security scanners on every change, and no stored keys in CI, so problems show up in review rather than in production.

Linting

  • pre-commit (Runs checks before each commit)
  • ShellCheck (Linter for shell scripts)
  • Ruff (Python linter and formatter)
  • Infrastructure and workflow linters

Security scanning

  • gitleaks (Finds secrets committed to git)
  • Semgrep (Static analysis for risky code patterns)
  • Trivy (Vulnerability scanner for container images and infrastructure code)
  • Checkov (Policy checks for Terraform and other infrastructure code)
  • Dependabot (Opens pull requests that keep dependencies up to date)
  • Dependency auditing

Security

The practices behind the hardening: least privilege, a safe edge, authenticated mail and secrets kept out of git. The tools that carry them out are in the groups around this one.

Access and secrets

  • Least privilege

Edge and storage

  • Security headers
  • Content Security Policy
  • HSTS (HTTP Strict Transport Security: browsers use only https)
  • Origin access control
  • Certificate rotation
  • S3 (Amazon Simple Storage Service) public access blocks
  • Bucket policies
  • VPC (Amazon Virtual Private Cloud) flow logs

Mail authentication

  • SPF (Sender Policy Framework: which servers may send the domain's email)
  • DKIM (DomainKeys Identified Mail: signs outgoing email)
  • DMARC (Domain-based Message Authentication, Reporting and Conformance)

Recovery

  • Off-site backups
  • Restore tests

AWS platform

Multi-account setups, edge and security, and the compute and data services that run on them, with costs kept under control.

Networking and edge

  • CloudFront (Amazon's content delivery network)
  • CloudFront Functions (Small functions that run at the CloudFront edge)
  • Route 53 (Amazon's DNS service)
  • ACM (AWS Certificate Manager)
  • WAF (AWS WAF, the web application firewall)
  • VPC (Amazon Virtual Private Cloud)
  • VPC (Amazon Virtual Private Cloud) endpoints
  • Site-to-site VPN

Accounts and access

  • Organizations (AWS Organizations: many accounts managed as one)
  • OIDC (OpenID Connect) federation
  • IAM (AWS Identity and Access Management)
  • IAM (AWS Identity and Access Management) roles
  • IAM (AWS Identity and Access Management) Identity Center
  • Secrets Manager
  • SSM (AWS Systems Manager) Parameter Store
  • KMS (AWS Key Management Service)
  • Cognito (Amazon Cognito: user sign-up and sign-in)

Compute and containers

  • EC2 (Amazon Elastic Compute Cloud: virtual servers)
  • ECS (Amazon Elastic Container Service)
  • Fargate (AWS Fargate: containers without servers to manage)
  • Lambda (AWS Lambda: functions without servers to manage)
  • API Gateway (Amazon API Gateway)
  • ECR (Amazon Elastic Container Registry)
  • Elastic Beanstalk (AWS service that runs web applications on managed servers)

Data and storage

  • S3 (Amazon Simple Storage Service)
  • RDS (Amazon Relational Database Service)
  • Aurora (Amazon Aurora: managed MySQL and PostgreSQL compatible database)
  • DynamoDB (Amazon's key-value database)
  • ElastiCache (Managed Redis on AWS)
  • OpenSearch (Amazon OpenSearch Service: managed search, forked from Elasticsearch)
  • AWS Backup

Messaging and events

  • SQS (Amazon Simple Queue Service)
  • SNS (Amazon Simple Notification Service)
  • SES (Amazon Simple Email Service)

Cost management

  • Cost control
  • AWS Budgets
  • Cost optimization

Reliability and observability

Monitors, SLOs and alerts kept in code, applications kept running in production, and every change planned with a way back.

  • CloudWatch (AWS monitoring, logs and alarms)
  • Monitoring as code
  • SLO (Service level objective)s
  • Log pipelines
  • Incident triage
  • Change management
  • Rollback plans
  • Datadog (Monitoring and logging service)

Web performance

Slow pages measured in the lab and against real-user data, then made faster at the CDN and in the browser.

Measurement

  • Web performance audits
  • Core Web Vitals (Google's page experience measures: LCP for loading, INP for responsiveness, CLS for layout shifts)
  • Lighthouse (Google's lab test for performance, accessibility and SEO)
  • Chrome UX Report (CrUX: page speed as real Chrome users saw it)

CDN and loading

  • CDN (Content delivery network) caching
  • Compression
  • Critical CSS (The styles the first screen needs, sent inline so the page paints sooner)

Containers and web servers

Local stacks that match production, the clusters they run on and the servers in front of them.

  • Docker
  • Docker Compose
  • GitHub Container Registry
  • Docker Hub
  • ECS (Amazon Elastic Container Service)
  • Kubernetes
  • Nginx
  • Traefik (Reverse proxy for containers)

AI engineering

Coding agents on infrastructure work, the MCP servers they use, and secure audit access to the cloud for them.

Coding agents

  • Claude Code (Anthropic's coding agent)
  • OpenAI Codex (OpenAI's coding agent)
  • GitHub Copilot
  • Agent skills
  • AI code review in CI (A model reviews every pull request in CI)

MCP and agent access

  • MCP (Model Context Protocol: how coding agents reach tools and data) servers
  • FastMCP (Python framework for MCP servers)
  • Secure audit access for agents

Models and vision

  • Claude API
  • Gemini API
  • YOLOv8 (Object detection model)
  • OpenCV (Computer vision library)
  • Tesseract OCR (Open-source text recognition from images)

Scripting for CI/CD and automation

Bash and Python for pipelines, automation and tooling, with Node.js, TypeScript and PHP where an application needs them.

  • Bash
  • Python
  • Node.js
  • TypeScript
  • PHP

Backend

The frameworks and libraries behind the applications.

  • Flask (Python web framework)
  • SQLAlchemy (Python database toolkit)
  • Alembic (Database migrations for SQLAlchemy)
  • Celery (Python task queue)
  • Gunicorn (Python web server for applications)
  • FastAPI (Python framework for APIs)
  • Symfony
  • Doctrine (Database layer for PHP)

Data

The databases, caches and search engines behind the applications.

  • MySQL
  • Redis
  • PostgreSQL
  • Elasticsearch
  • MongoDB

Integrations

The outside systems a platform talks to.

  • Building APIs
  • OAuth with scoped permissions
  • Webhooks
  • ERP (Enterprise resource planning: the system that holds stock, orders and finance) integration
  • E-commerce platforms
  • Marketplace integrations
  • Shipping carrier APIs

Ways of working

How I work with the people who build the applications.

  • Scrum
  • Kanban
  • Supporting development teams
  • Working directly with product owners

Shaded pills mark what I work with now.