cloud · platform · aws
Steve Okoth
Cloud & platform engineer — AWS-primary, builds self-hosted infrastructure.
I build and run cloud platforms — quietly reliable, cost-aware, and boring on purpose. Ten years across software engineering, DevOps, and infrastructure. Multi-cloud (AWS, GCP, Azure); the kind of observability and incident-response habits that keep teams asleep at 3am.
currently
Right now.
Cloud Infrastructure Engineer II at Tala — leading platform automation across AWS, GCP, and Azure with Terraform and Ansible. ArgoCD-driven continuous deployment on Kubernetes. Observability program in Datadog and ElasticSearch.
- open to senior platform / SRE / staff cloud conversations · remote-first
- cost-aware autoscaling · OpenTelemetry → Datadog migrations · Backstage IDPs
selected work
Things I've shipped.
Real systems. Real numbers. Each case study follows the same shape: problem, constraints, architecture, result, and what I'd do differently.
A self-hosted, OCI-compliant container registry
Harbor and ECR's feature set — signing, scanning, SSO, audit — self-hosted, no cloud bill. Single-tenant by default; multi-tenant when you need it.
- Go
- gRPC + mTLS
- PostgreSQL
- RabbitMQ
- Helm
- Cosign
- OpenTelemetry
Building Cellulant's Internal Developer Platform
Engineers shouldn't need to know your stack to ship safely. So I built the platform that hides it.
- Backstage
- GitLab CI/CD
- ArgoCD
- Kubernetes
- Terraform
- Ansible
- Prometheus
- Grafana
Cutting Cellulant's cloud spend without slowing the org
The AWS bill wasn't a tooling problem. It was a visibility problem.
- AWS Cost & Usage Reports
- Athena
- Reserved Instances
- Fargate
- VPC Endpoints
- Backstage
Janus — a self-hosted secrets manager
Doppler's ergonomics, Vault's crypto, your server. One Go binary, one Postgres, keys that never leave in plaintext.
- AES-256-GCM
- AWS KMS
- Go
- PostgreSQL
- Shamir SSS
cloud · certifications
Receipts.
Current and historical credentials. Dates are when each cert was earned; expirations are renewed before they lapse.
stack
What I build by default.
Most of my work looks like this — AWS-native, Terraform-managed, observable from the request edge all the way to the slow query. The accent path is the request flow; everything below it supports it.
deploy
GitHub
GitHub Actions
Terraform Cloud
AWS · US-EAST-1
request path
Route 53
CloudFront
ALB
ECS Fargate
APP TIER
data + observability
RDS Aurora
DynamoDB
CloudWatch
Datadog
S3
contact
Reach out.
Hiring for a platform / SRE / cloud role? Send a note via GitHub or LinkedIn. I'll respond with my full CV — email and phone included — attached.