Francisco Herrera

• Architect and manage the core cloud-native infrastructure for the company's AI Agent Platform, authoring modular Helm charts (platform-core, control-plane) automatically published to a private Helm repository via GitHub Actions pipelines.
• Engineered declarative GitOps delivery pipelines using ArgoCD, establishing self-healing, automated pruning, and sync waves for deploying core microservices (broker, context-service, secure code sandbox) to Kubernetes (AKS) with zero configuration drift.
• Designed and deployed a multi-cloud OpenTelemetry (OTel) Collector gateway pattern, routing OTLP traces, metrics, and logs from workloads to Azure Monitor and Google Cloud (Cloud Monitoring/Logging) simultaneously.
• Scaled hosting and deployment infrastructure for the Model Context Protocol (MCP) Gateway service, enabling autonomous AI agents (leveraging Anthropic specs and Azure OpenAI models) to securely access vector search, RAG, and document processing tools.
• Executed a comprehensive FinOps Datadog audit encompassing an inventory of 737 hosts, successfully identifying and implementing significant annual cost savings.
• Hardened Kubernetes security posture by provisioning custom CA certificate authorities via cert-manager and mkcert, setting up secure ACR image pull secrets, and integrating automated registry vulnerability scanning.

graph TD
  subgraph AKS ["Kubernetes AKS Cluster (AI Platform)"]
    Workload["App Microservices (Broker, Sandbox, Context)"]
    McpGateway["MCP Gateway Service (Node/TS)"]
    OtelCol["OpenTelemetry Collector Gateway"]
    Workload -->|OTLP/HTTP traces, metrics, logs| OtelCol
    Workload -->|SSE / REST| McpGateway
  end
  subgraph CoreServices ["AI Core Services"]
    EntitySvc["Entity Service (Graph DB)"]
    ContextSvc["Context Service (gRPC / RAG)"]
    CodeSandbox["Code Sandbox (Secure Runtime)"]
    McpGateway -->|gRPC / Vector Search| ContextSvc
    McpGateway -->|Graph API| EntitySvc
    McpGateway -->|REST API| CodeSandbox
  end
  subgraph CloudObservability ["Multi-Cloud Telemetry"]
    AzureMon["Azure Monitor Application Insights"]
    GcpLogging["Google Cloud Monitoring & Trace"]
    OtelCol -->|AzureMonitor Exporter| AzureMon
    OtelCol -->|GoogleCloud Exporter| GcpLogging
  end
  subgraph GitOps ["GitOps & CI/CD Control Plane"]
    ArgoCD["ArgoCD Controller"]
    GitRepo["GitHub Repo (Platform Infra)"]
    ACR["Azure Container Registry (ACR)"]
    ArgoCD -->|Pulls Charts & Configs| GitRepo
    ArgoCD -->|Syncs Deployments| AKS
    AKS -->|Pulls Secure Images| ACR
  end
                  

Related Project

Embedded as a senior infrastructure engineer at a software consultancy rather than a single product team — staffed across multiple concurrent client engagements. The projects below reflect that breadth, spanning advertising/ad-tech, a large data modernization initiative, and multi-client infrastructure advisory work.

graph TD
  User["Ad Client User"] -->|Sends Request| ALB["AWS Application Load Balancer"]
  subgraph ECSCluster ["AWS ECS Fargate Cluster"]
    PHPEngine["PHP Ad Web Engine"]
    JavaEngine["Java Payment Service"]
    PyRecs["Python Recommendation API"]
    ALB -->|Routes Web Traffic| PHPEngine
    ALB -->|Routes Payment API| JavaEngine
    PHPEngine -->|Queries Scores| PyRecs
  end
  subgraph AI ["AI Personalization"]
    Bedrock["AWS Bedrock API"]
    PyRecs -->|Live Request Context| Bedrock
  end
  subgraph DataLake ["Analytics Data Lake"]
    S3Raw["AWS S3 (Raw JSON Event Logs)"]
    Glue["AWS Glue ETL Job"]
    Snowflake["Snowflake Data Warehouse"]
    Airflow["Apache Airflow"]
    PHPEngine -->|Streams Raw Events| S3Raw
    Airflow -->|Triggers Execution| Glue
    Glue -->|Extracts & Loads| S3Raw
    Glue -->|Populates Tables| Snowflake
  end
                      

graph TD
  ThirdParty["3rd-Party Geolocation API"] --> Kinesis["AWS Kinesis Data Streams"]
  Sources["Additional Upstream Sources"] --> Kinesis
  Kinesis --> MWAA["Airflow (Amazon MWAA)"]
  subgraph ETL ["Cleansing & ETL"]
    Glue["AWS Glue Jobs"]
    MWAA -->|Orchestrates| Glue
  end
  Glue -->|Dedupe / Backfill Missing Fields| RDS["RDS PostgreSQL (Geospatial)"]
  Glue -->|Load Conformed Records| Snowflake["Snowflake Data Warehouse"]
  subgraph Ops ["Security & Observability"]
    TA["AWS Trusted Advisor"]
    DD["Datadog"]
  end
  RDS -.->|Metrics & Logs| DD
  Glue -.->|Metrics & Logs| DD
  TA -.->|Best-Practice Checks| RDS
                      

graph TD
  Client["Client On-Premises Servers"] -->|AWS Direct Connect| Kinesis["AWS Kinesis Data Streams"]
  subgraph ServerlessProcessing ["Serverless Stream Processing"]
    Lambda["AWS Lambda (Parser & Enricher)"]
    Firehose["AWS Kinesis Data Firehose"]
    Kinesis -->|Triggers Execution| Lambda
    Lambda -->|Forwards Clean Events| Firehose
  end
  subgraph TargetStorage ["Staging & Data Lakes"]
    RDS["AWS RDS PostgreSQL"]
    S3Lake["AWS S3 Data Lake (Parquet)"]
    Lambda -->|Writes Metadata| RDS
    Firehose -->|Batches & Compresses| S3Lake
  end
  subgraph Observability ["Telemetry & Data Quality"]
    Prometheus["Prometheus Server"]
    Grafana["Grafana Dashboards"]
    GE["Great Expectations (Schema Validation)"]
    Lambda -->|Exposes Metrics| Prometheus
    Prometheus --> Grafana
    S3Lake -->|Triggers Quality Check| GE
  end
                      

• Directed a multi-account AWS migration for the platform, standing up separate production and QA/staging AWS accounts and using Terraform for infrastructure-as-code provisioning across both.
• Built and maintained HashiCorp Packer golden AMIs deployed across up to 40 EC2 instances running .NET applications behind Auto Scaling Groups (ASG).
• Decomposed the legacy .NET monolith into containerized microservices and migrated the platform onto Kubernetes (EKS), improving deployment independence and horizontal scalability.
• Migrated core databases from the Ireland datacenter to AWS RDS via AWS Direct Connect and AWS Database Migration Service (DMS), and maintained an Amazon Redshift cluster for downstream analytics.
• Built and maintained CI/CD pipelines in GoCD, enforcing semantic versioning on releases and aligning deployment cadence with Agile sprint planning.
• Stood up dedicated QA environments with automated Selenium test suites to validate releases before production rollout.
• Implemented Dynatrace observability across the new AWS estate for full-stack application performance monitoring.
• Executed the final cutover: migrated all DNS records and fully decommissioned the legacy Ireland datacenter once the AWS environment reached parity, achieving zero downtime for end-users.

graph TD
  subgraph LegacyDC ["Legacy Ireland On-Premises Datacenter"]
    Monolith[".NET Monolith App Servers"]
    OldDB["Primary SQL Server (Source)"]
    Monolith --> OldDB
  end
  OldDB -->|AWS Direct Connect| DMS["AWS DMS (Database Migration Service)"]
  DMS --> RDS["AWS RDS SQL Server (Target)"]
  subgraph ProdAccount ["AWS Account: Production"]
    ASG["Auto Scaling Group (~40 .NET EC2 Instances)"]
    EKS["EKS Cluster (Microservices, decomposed from Monolith)"]
    Redshift["Amazon Redshift (Analytics DW)"]
    ASG --> RDS
    EKS --> RDS
    RDS --> Redshift
  end
  subgraph QAAccount ["AWS Account: QA / Staging"]
    Selenium["QA Environments (Selenium Test Suites)"]
  end
  subgraph CICDPipeline ["CI/CD - GoCD"]
    Packer["HashiCorp Packer (Golden AMIs)"]
    Terraform["Terraform (Multi-Account IaC)"]
    GoCD["GoCD Pipelines (Semantic Versioning)"]
    Packer --> GoCD
    Terraform --> GoCD
    GoCD -->|Deploys| ASG
    GoCD -->|Deploys| EKS
    GoCD -->|Deploys| Selenium
  end
  subgraph ObsStack ["Observability"]
    Dynatrace["Dynatrace APM"]
  end
  ASG --> Dynatrace
  EKS --> Dynatrace
  Route53["AWS Route 53 DNS"] -->|Full DNS Cutover| ASG
  Monolith -.->|Decommissioned Post-Cutover| Route53
                  

Related Project

• Delivered proactive technical support, systematic maintenance, and advanced troubleshooting for Windows Server environments and overarching enterprise IT infrastructure across multiple organizational entities.
• Implemented, audited, and monitored automated backup strategies, maintaining 99.9% availability for key systems and ensuring operational business continuity via rapid incident triage and resolution.

graph TD
  subgraph ProductionOffice ["Primary Office Site"]
    DC1["Active Directory Domain Controller"]
    FS1["File & Data Server"]
    Syslog["Syslog Server / Alert Portals"]
    DC1 --> Syslog
    FS1 --> Syslog
  end
  subgraph BackupCenter ["Veeam Backup Infrastructure"]
    Veeam["Veeam Backup & Replication Suite"]
    NasLocal["Local NAS Node (Daily Backups)"]
    FS1 -->|VSS Snapshot Sync| Veeam
    DC1 -->|System State Backup| Veeam
    Veeam -->|Writes Daily Archives| NasLocal
  end
  subgraph OffsiteDR ["Offsite Recovery Location"]
    NasOffsite["Offsite NAS Storage (Weekly Replica)"]
    Glacier["Cloud Archival Storage (Cold Backup)"]
    NasLocal -->|WAN Replication Sync| NasOffsite
    NasLocal -->|Glacier Copy Job| Glacier
  end