PLAYER 1 AIANA SHADY LEVEL PLATFORM ENG HIGH SCORE ZERO ROLLBACKS

I run production. Then I teach agents to run it with me.

Platform engineer across AWS, Kubernetes and Terraform, with five years spent turning fragile, manual infrastructure into boring, self-serve platforms. More recently I've been building the agentic layer on top of it — custom agent skills and MCP integrations across Claude Code and Codex — and holding it to the same review standard as any production change.

Play the stack ▸ Read the case studies
$80K+
saved per year on NAT + public IPv4 — 30 EKS environments, zero rollbacks
300+
spec gaps and defects caught before merge last quarter — every PR, 50 repos
65+
static AWS credentials eliminated — Vault dynamic secrets, 20-min TTL
<2 min
pending-pod wait after a load spike, down from ~20–30 min
~60%
cut in alert noise — 40–50 a week down to 15–20 — real incidents still caught
the stack

It plays itself. Take over whenever you like.

Six things I've actually shipped. Three real incidents, resolved. Click the board to take over — arrow keys, WASD, or swipe on mobile — or just watch, it plays itself.

You Pellet — walk in for a skill I've shipped Ghost — walk in for a real incident, resolved
STACK 0/6 INCIDENTS 0
ATTRACT MODE — click the board to switch to player mode
Attract mode — clearing the stack on its own. Click in to take the controls.
Click the board, then ↑↓←→ or WASD — swipe on mobile demo running
experience

Two companies. Five years. One thread.

Five years of cloud fundamentals, with the agentic tooling layered on more recently.

Mar 2024 — Present

Platform Engineer

Samsara
  • Core engineer on a 6-person platform team serving 50+ developers. Migrated 30 EKS environments off CloudFormation onto custom Terraform modules and moved them to IPv6-primary nodes — eliminating NAT gateway and public IPv4 costs to save $80K+/yr, with zero rollbacks.
  • Built agent skills and a GitHub Action that catch spec gaps and defects before merge — 300+ caught last quarter, across every PR in 50 repos.
  • Standardized TLS, DNS, and secrets across 3 app teams onto cert-manager and Secrets Manager CSI, retiring manual certs and hardcoded secrets.
  • Built a least-privilege MCP platform for Claude Code — read-only observability, on-request infrastructure provisioning, and human-approved incident response — cutting how much triage still means copy-pasting into Slack.
  • Migrated production Kubernetes clusters off Cluster Autoscaler onto Karpenter — load-spike pod scheduling dropped from ~20–30 min to under 2 min.
May 2021 — Feb 2024

DevOps Engineer

Ramp
  • Stood up cross-region disaster recovery for business-critical Aurora PostgreSQL with Terraform-defined AWS Backup — validated to a 30–45 minute RTO through quarterly restore drills with automated checks.
  • Tuned AWS and Kubernetes alert routing and thresholds, cutting noise ~60% — from 40–50 a week down to 15–20 — without losing real incident detection.
  • Eliminated 65+ static AWS credentials from CI/CD, moving to HashiCorp Vault dynamic secrets via GitHub OIDC — credential lifetime cut to a 20-minute TTL.
  • Replaced Datadog with self-managed Prometheus and Grafana for non-critical environments, cutting monitoring spend by ~$100K/yr.
case studies

Three worth the full read.

The problem, what I built, and the number that proves it.

SAMSARA · 2024–Present

A least-privilege MCP platform for Claude Code

A lot of triage still meant pulling kubectl output or a Grafana panel and pasting it into Slack. I built a least-privilege MCP platform so Claude Code can query the platform directly — a read-only server for observability, a separate on-request server for infrastructure provisioning, and incident response that stops at a human approval before anything mutates.

Before
Manual kubectl / Grafana copy-paste for routine triage questions.
After
Claude Code handles the read-only lookups directly; provisioning is on request, and incident response ships only after a human approves.
Read-only, kept separateObservability lives on its own server, apart from anything that can actually change infrastructure.
A human still approvesThe agent can provision on request and draft an incident response — a person signs off before anything mutates.
SAMSARA · 2024–Present

EKS: CloudFormation to Terraform, IPv6-primary

Thirty EKS environments were CloudFormation-managed and paying full NAT gateway and public IPv4 fees. I wrote custom Terraform modules for VPC, EKS, and IAM, then moved every environment to IPv6-primary networking.

Before
CloudFormation-managed clusters, full NAT + public IPv4 fees, across 30 environments.
After
Terraform-managed, IPv6-primary — $80K+/yr saved on NAT + public IPv4, zero rollbacks.
Zero rollbacksAll 30 environments moved over cleanly — nothing rolled back.
Built for reuseCustom Terraform modules for VPC, EKS, and IAM, replacing one-off CloudFormation stacks.
SAMSARA · 2024–Present

Cluster Autoscaler to Karpenter

With Cluster Autoscaler, a load spike meant statically-sized node groups and pods sitting pending while someone manually resized. I migrated production clusters to Karpenter, which provisions nodes directly off real pending-pod pressure.

Before
~20–30 minutes of pods stuck pending during a load spike.
After
Under 2 minutes — no manual resizing.
Production, not a pilotRolled out across the platform's production Kubernetes clusters.
Demand-drivenNodes provision off actual pending-pod pressure instead of a static group size.
also shipped

The rest of the fleet.

Shorter stories, same standard: real numbers, no exaggeration.

Show all 6
SAMSARA

TLS, DNS & secrets standardization

Standardized 3 app teams onto cert-manager and Secrets Manager CSI, retiring manual certs and hardcoded secrets for good.

SAMSARA

Agent skills for spec review

Built agent skills plus a GitHub Action that catch spec gaps and defects before merge — 300+ caught last quarter, across every PR in 50 repos.

RAMP

Cross-region RDS disaster recovery

Terraform-defined AWS Backup with cross-region copy for the business-critical Aurora PostgreSQL fleet, validated to a 30–45 min RTO through quarterly restore drills with automated checks.

RAMP

Vault dynamic secrets

Moved 65+ static AWS credentials out of CI/CD onto HashiCorp Vault dynamic secrets via GitHub OIDC — credential lifetime cut to a 20-minute TTL.

RAMP

Datadog to self-managed Prometheus/Grafana

Replaced Datadog with self-managed Prometheus and Grafana for non-critical environments, cutting monitoring spend by ~$100K/yr.

RAMP

Alerting & on-call tuning

Retuned alert routing and thresholds — cut noise ~60% (40–50 a week down to 15–20) without losing real incident detection.

about
Marvel-style poster of Aiana Shady surrounded by floating, lightning-charged AWS, Terraform, Kubernetes, EFK, Docker, Argo CD, Codex, Claude, Helm and GitHub icons, captioned 'A Platform Engineer: Assembling reliability. Automating impact.'

Every platform engineer’s actual on-call experience.

Fundamentals, plus the layer on top.

I'm a platform engineer with about five years in cloud infrastructure: from tuning alerting and DR at Ramp to running Samsara's 30-environment EKS platform. Deep in AWS, Kubernetes and Terraform, with CKA, CKAD, Terraform Associate and AWS SAA behind it.

The job, as I see it, is turning fragile and manual into boring, documented and self-serve, so infrastructure is reliable enough that nobody upstream has to think about it.

I work AI-first, with the engineering discipline behind it. My repos carry CLAUDE.md/AGENTS.md context, I build reusable agent skills instead of re-typing prompts, and I use both Claude Code and Codex for infrastructure and deployment work.

Agents get scoped, read-mostly credentials. Production access is a PR away, never a direct write. The agent moves fast; I’m still the one accountable for what merges.

"Hiring one AI-fluent platform engineer isn't buying headcount — it's buying leverage. Every workflow I automate for myself, I can build for the team."