PLAYER 1 AIANA SHADY LEVEL PLATFORM ENG HIGH SCORE $180K/YR

I run production. Then I teach agents to run it with me.

Platform engineer across AWS, Kubernetes and Terraform — five years turning fragile, manual infrastructure into boring, self-serve platforms. Lately I build the agentic workflows on top of it: Claude Code, custom skills, MCP servers — with the review discipline to run them in production without flinching.

Play the stack ▸ Read the case studies
$180K/yr
saved cutting 30 EKS environments to IPv6-primary — zero rollbacks
30
production EKS environments migrated off CloudFormation to Terraform
70–80%
less manual triage once the team's MCP layer shipped
<2 min
pending-pod wait after a load spike, down from ~20–30 min
~60%
cut in alert noise, with the real incident rate unchanged
the stack

It plays itself. Take over whenever you like.

Six pellets, six things I've actually shipped. The ghosts are real incidents — catch one and it'll tell you how it got resolved.

STACK 0/6 INCIDENTS 0
ATTRACT MODE
Attract mode — clearing the stack on its own. Click in to take the controls.
Click the board, then ↑↓←→ or WASD — swipe on mobile demo running
experience

Two companies. Five years. One thread.

Fundamentals first — then the agentic layer built on top of them.

Mar 2024 — Present

Platform Engineer

Samsara
  • Stood up the team's MCP layer with blast-radius isolation — read-only diagnostic servers split from mutating operations gated behind plan review and PR approval — cutting routine copy-paste triage ~70–80%.
  • Core engineer on a 6-person platform team serving 50+ developers; migrated 30 EKS environments off CloudFormation onto custom Terraform modules and cut over to IPv6-primary nodes, saving $180K+/yr.
  • Built guardrails for an AI-powered incident-response agent — autonomous diagnosis and Slack alerting, with human approval enforced at the IAM level for anything touching production.
  • Onboarded a backend service to an IPv6-only-egress EKS cluster; a custom test client isolated a 3–5s latency tax on a card-authorization dependency and brought it to ~150–250ms.
  • Built a Claude Code diagnostic skill on the team's EFK stack to parse noisy logs and flag recurring failure patterns — cut OOMKill troubleshooting by ~20–25 minutes.
May 2021 — Feb 2024

DevOps Engineer

Ramp
  • Built the observability stack from scratch — Prometheus, Grafana, Alertmanager — and defined the company's first production SLO: 99.5% success over a rolling 28-day window with multi-window burn-rate alerting.
  • Migrated production EKS from Cluster Autoscaler to Karpenter, wiring provisioning to real pending-pod pressure — load-spike scheduling latency from 20–30 minutes to under 2, and steady-state compute cost down 15–25%.
  • Stood up cross-region disaster recovery for production Aurora PostgreSQL with Terraform and AWS Backup — a 30–45 minute RTO validated through quarterly restore drills with automated integrity checks.
  • Owned AWS and Kubernetes alerting — grouping, inhibition and evaluation-window tuning cut alert noise ~60% and false positives from ~25% to under 5%, with no change to real detection.
  • Shipped a parallel AMI/EC2 deployment path beside the containerized one — proved EKS took ~2–3x less operational effort, and set the container-first strategy on that evidence.
case studies

Three worth the full read.

The problem, what I built, and the number that proves it.

SAMSARA · 2025

The team's MCP layer — safe hands on the platform

Across five product AWS accounts, triage meant a human pulling kubectl or a Grafana panel and pasting it into Slack. I built a read-only data server and a cluster-hosted mutating server, each behind its own enforced auth boundary, so Claude Code can query the platform directly.

Before
Manual kubectl / Grafana copy-paste for every triage question, in every account.
After
70–80% of routine triage never leaves the agent — 4 of 6 engineers, daily.
Two auth boundariesBearer token at the edge, scoped Kubernetes RBAC and IRSA underneath — proven with a denied out-of-scope action, not just documented.
Bounded blast radiusResource limits and namespace quotas cap what the mutating server can create in the first place.
An honest number4 of 6, not "everyone" — the other two are newer and still reach for raw kubectl.
SAMSARA · 2024–2025

EKS: CloudFormation to Terraform, IPv6-primary

The platform's clusters were CloudFormation-managed — not composable, and paying full NAT gateway and public IPv4 fees in every environment. I wrote custom Terraform VPC and EKS modules from scratch and cut 30 environments over to IPv6-primary private nodes.

Before
CloudFormation clusters, full NAT + public IPv4 fees, across 30 environments.
After
Terraform parity, IPv6-primary private nodes, ~$180K/yr saved, zero rollbacks.
Caught before prodA hardcoded IPv4 allowlist that would have broken on IPv6-only nodes — found in staged validation, fixed to hostname-based DNS.
OIDC-driven CIGitHub Actions applies through a bootstrapped IAM role. No long-lived AWS keys anywhere.
Full scope10 product teams × dev/staging/prod, supporting roughly 50 developers.
RAMP · 2023

Cluster Autoscaler to Karpenter

With statically-sized node groups, a load spike meant someone noticing the backlog, picking an instance type, and waiting out a manual resize. I moved the environment to Karpenter, provisioning nodes directly off real pending-pod pressure.

Before
~20–30 minutes of manual node-group resizing during a load spike.
After
Under 2 minutes, no page — plus ~15–25% lower steady-state compute spend.
A real spike, measuredA ~40–50 pod deploy that would have meant ~20–25 min of resizing cleared in under 2, tracked on a pending-duration dashboard.
Cost, not just speedConsolidation, bin-packing and a tuned spot mix cut steady-state node count ~20–30%.
Bounded honestly2 minutes is the ceiling on a cold instance type — the floor is EC2 launch plus kubelet, not Karpenter's decision.
also shipped

The rest of the fleet.

Shorter stories, same standard — real, measured, and honest about what hasn't been proven yet.

SAMSARA

EFK stack + Claude Code diagnostics

A skill that scans noisy logs for known-shape failures and proposes a hypothesis — caught a memory-leak/OOMKill pattern in under a minute, saving ~20–25 min on a live incident. Daily use by 4 of 6 engineers.

SAMSARA

Incident-response agent, autonomy boundary

Diagnoses and posts to Slack unprompted; opening a PR is the human checkpoint. Live mutation is blocked at the IAM level — proven by deliberately trying to break it across production accounts.

SAMSARA

IPv6-only egress latency fix

An independent test client isolated a 3–5 second latency tax on a card-authorization dependency and brought it down to ~150–250ms before it shipped broadly.

RAMP

Cross-region RDS disaster recovery

Terraform-defined AWS Backup with cross-region copy for the business-critical Postgres/Aurora fleet — validated by a real quarterly restore drill. ~30–45 min RTO, ~24h RPO.

RAMP

First SLO + observability stack

Prometheus, Grafana and Alertmanager from scratch, and the platform's first SLO: 99.5% over a rolling 28-day window with multi-window burn-rate alerting.

RAMP

Alerting & on-call ownership

Grouping, inhibition and retuned evaluation windows cut Slack alert volume ~60% and false positives from ~25% to under 5% — without the real incident rate moving.

about
Aiana Shady

Fundamentals, plus the layer on top.

I'm a platform engineer with about five years in cloud infrastructure — from building Ramp's first production SLO to running Samsara's 30-environment EKS platform. Deep in AWS, Kubernetes and Terraform, with CKA, CKAD, Terraform Associate and AWS SAA behind it.

The job, as I see it, is turning fragile and manual into boring, documented and self-serve — infrastructure reliable enough that nobody upstream has to think about it.

I work AI-first, with the engineering discipline behind it. Every agent task starts in plan mode with explicit checkpoints, my repos carry CLAUDE.md/AGENTS.md context, and I build reusable skills instead of re-typing prompts. Agents get scoped, read-mostly credentials; production access is a PR away, never a direct write. The agent moves fast — I stay accountable for everything that merges.

"Hiring one AI-fluent platform engineer isn't buying headcount — it's buying leverage. Every workflow I automate for myself, I can build for the team."