Los Angeles, CA · Remote

John Sweeney

DevOps Architect · Platform & AI Platform Engineer

I design secure, scalable platforms across AWS and GCP: Infrastructure as Code, Kubernetes, event-driven systems, and agentic AI that keeps authorization deterministic, state durable, and evidence auditable.

View work Résumé
Portrait of John Sweeney

Selected platform & architecture engineering

Work

Open any panel for the problem, the design, and what it proved. Full case studies and code live on GitHub.

Security · AI Platform · Terraform

A serverless SOAR platform on AWS where deterministic code holds security authority and Bedrock agents investigate and explain.

Private · available for demos

Bedrock explains. It never authorizes.

Problem

  • An API Gateway authorizer proves who the caller is, not what they may do.
  • Tokens get issued, never used, and never revoked.
  • WAF telemetry is written, not read, and findings arrive without context.

Design

  • Three-layer authorization: API Gateway scopes → in-Lambda group claims → IAM.
  • EventBridge fans each WAF finding out to four parallel agents: playbook, token safety, intel enrichment, threat assessment.
  • Four Step Functions + Bedrock Converse investigations with read-only tool loops, structured submit, and explicit termination.
  • Cognito OAuth/RBAC-protected FastMCP control plane exposing 33 controlled tools.

Impact

  • ~420 Terraform resources and 14 DynamoDB tables. Agents re-read authoritative state instead of trusting event payloads.
  • 436 pytest + moto tests in GitHub Actions. They're published as reusable workflows that validate three descendant repos.
  • Reports mapped to NIST CSF 2.0, CIS v8, PCI DSS 4.0, and ISO 27001, in English, Japanese, and Portuguese.
  • Operator observability for the agent layer: CloudWatch-backed status, invocation, error, duration, and trigger views across detection, action, and reporting agents.

Terraform · Python/Pydantic · Lambda · API Gateway · Cognito · WAF · EventBridge · Step Functions · DynamoDB · S3 · Bedrock Converse · MCP

Case study

AI Platform · Case Management · Bedrock

Every matter gets a board of deadlines, drafts, and reminders. AI proposes and the firm decides. Built on SEIR, so security isn't bolted on.

Private · available for demos

AI proposes; the firm decides.

Problem

  • Recurring deadlines, renewals, and status reports repeat across a whole caseload and are easy to miss.
  • Case files hold identity, medical detail, and education records (PHI and FERPA).
  • Model-confident citations are a liability, and every one has to be verifiable.

Design

  • Every matter has a board of deadlines, drafts, and reminders. Practice areas such as construction, litigation, and civil plug in under the same enum rules, so the platform scales out without forking.
  • AI proposes; the firm decides. Agents produce drafts and research aids with [VERIFY] citations under graduated autonomy (observe → draft → notify). No tier ever files.
  • Security isn't bolted on. It inherits SEIR's Cognito, WAF, and SOAR protection, and models only see records redacted by Comprehend + Comprehend Medical, enforced by IAM.

Impact

  • ~460 Terraform resources in one apply, sharing SOAR's Cognito pool, WAF, API, and jobs module.
  • 238 pytest tests plus a retrieval golden-eval set.
  • Built for a real practice, across two case types with different retention rules.

Bedrock · Step Functions · Comprehend Medical · OpenSearch · Cognito · SSM · Terraform · MCP

Case study

AI Platform · Policy · Multi-cloud

Decide whether data may go to a model before deciding which model: SaaS, company cloud, or on-prem.

Private · available for demos

Classify before transmit.

Problem

  • Agents hard-code if sensitive: use_model_x(), coupling business code to infrastructure.
  • That coupling blurs four separate questions: policy, service, network, and routing.

Design

  • Logical destinations (EXTERNAL_FM, COMPANY_CLOUD_LLM, COMPANY_ONPREM_LLM) stand in for vendors.
  • Independent evaluators for data, model, tool, and user policy, plus runtime health and network path, then a policy-safe fallback.
  • Every routing decision records why a route was chosen or blocked, as typed telemetry.

Impact

  • Live labs: MCP on AWS EC2 reaching a GCP-hosted Llama over private IPsec and a home-network Ollama.
  • ~430 inline contract tests, written test-first ahead of registry features.
  • The typed-domain-model approach was carried into SEIR.

Python · Pydantic · MCP · AWS EC2 · GCP · IPsec VPN · Llama · Ollama

Case study

AI Platform · GCP · RAG

Curated retrieval corpora for agents on Vertex AI, called from AWS Lambda without a single service-account key.

Private · available for demos

Keyless across clouds.

Problem

  • Agents need domain knowledge from a curated corpus, not the open web.
  • Calling GCP from AWS usually means a JSON key stored somewhere in AWS.
  • Raising top_k to 10 still returned 8 chunks from one document.

Design

  • Four purpose-built corpora on the serverless RAG Engine with text-embedding-005.
  • Workload Identity Federation lets Lambda roles call Vertex AI.
  • Corpus IDs live in SOAR's SSM registry. A per-document chunk cap fixes single-source dominance.

Impact

  • ~1,340 documents indexed, with create, import, rebuild, and cleanup scripts.
  • Credential-free integration between the AWS agent platform and GCP retrieval.

Vertex AI RAG Engine · Workload Identity Federation · Terraform · Lambda · SSM · Python

Case study

AI Platform · GPU · Packer

A GPU inference box on AWS that rebuilds without losing state, and consumes jobs from the SEIR queue.

Private · available for demos

S3 is the source of truth.

Problem

  • GPU boxes accumulate hand-made state that disappears when the instance is replaced.
  • Idle GPUs are expensive, so the box must stop, start, and resize safely.
  • Model buckets are easy to over-share, and just as easy to lock yourself out of.

Design

  • Packer golden AMI. user_data restores models, workflows, and certificates from S3 on every boot.
  • Vertical scaling in place with a 60-second Route 53 TTL, so no Elastic IP is needed.
  • Wired to SEIR's POST /jobs → SQS pipeline through SSM contracts only.

Impact

  • An AMI rebake replaces the instance and restores full working state.
  • Cost guide across L4, A10G, L40S, and T4, with spot savings of about 60–70%.

Packer · Terraform · EC2 GPU · S3 · SQS · Route 53 · SSM

Case study

Cloud Networking · Terraform modules

Seven AWS regions on one Transit Gateway mesh, with geolocation DNS. Apps run anywhere, and personal data stays in Japan.

Public repo

Forward, don't store.

Problem

  • Seven copy-pasted region stacks: one change meant seven edits.
  • One DNS record sent every customer to Tokyo.
  • Syslog and personal data could not be stored abroad.

Design

  • Hubs in Tokyo, Hong Kong, Sydney, California, New York, London, and São Paulo.
  • A regional-network + regional-site module pair driven by a single sites map.
  • Route 53 geolocation to the nearest ALB. Tokyo is the only writer to Aurora, over private paths.

Impact

  • ~100 Terraform resources expressed as five reusable modules.
  • Scripted verification of reachability, blocked HTTPS, RDS writes, and Secrets Manager.
  • Self-hosted Prometheus / Grafana / Loki over the mesh, so metrics never leave Japan.

Transit Gateway · Route 53 · ALB · Aurora · VPC endpoints · Terraform · Prometheus · Grafana · Loki

Case study Code

Cloud Networking · AWS + GCP · Compliance

Patient data stays in Tokyo while AWS São Paulo and GCP New York compute read and write over Transit Gateway and HA VPN with BGP.

Private · available for demos

Degrade, but never violate residency.

Problem

  • Japanese patient data must physically stay in Japan, even for overseas doctors.
  • São Paulo staff run on AWS and New York staff run on GCP.
  • Auditors have to follow where every read and write travels.

Design

  • Tokyo is the data authority. São Paulo and New York are stateless compute.
  • Transit Gateway plus Cloud HA VPN with 4 redundant BGP tunnels form an auditable data corridor.
  • One global URL: CloudFront + WAF, origins cloaked, and PHI never cached.

Impact

  • 6 reusable modules and 4 independently deployable stacks, ~310 Terraform resources.
  • Bedrock-drafted, translated incident reports, with a human who verifies before anything is final.
  • Staged apply and destroy, SSM sanity checks, and a Jenkins pipeline.

Transit Gateway · GCP HA VPN · Cloud Router · BGP · CloudFront · Aurora MySQL · KMS · Bedrock · Terraform

Case study

Cloud Networking · GCP

A multi-project GCP mesh across four continents with HA VPN and BGP, and no service-account key files anywhere.

Public repo

Adding a project is a map entry.

Problem

  • Downloaded JSON keys are the most common way GCP credentials leak.
  • IAM and network have different lifecycles.
  • Each new spoke multiplies gateways, tunnels, interfaces, and peers.

Design

  • Bootstrap / infra split: identities are seeded once, and the network rebuilds freely.
  • Service-account impersonation through ADC locally and Workload Identity Federation in CI.
  • A single tunnels map drives the whole mesh through flattened locals.

Impact

  • Six projects on four continents, built from seven reusable modules.
  • Makefile, staged apply and destroy, CI bootstrap, and a "doctor" diagnostic.
  • Delivered by a seven-engineer team.

GCP · HA VPN · Cloud Router · BGP · Network Connectivity Center · Terraform · WIF

Case study Code

Kubernetes · mTLS · MCP

Zero-trust MCP for AI agents on Kubernetes: mTLS identity, deterministic playbooks, and gated kubectl.

Private · available for demos

The LLM narrates. Code authorizes.

Problem

  • Once an agent reaches the API server, every verb in its ServiceAccount is in play.
  • Pod network reachability gets treated as trust.
  • Duplicate AWS and GCP YAML trees drift apart.

Design

  • nginx requires a client certificate from a lab CA before any request reaches MCP.
  • Thin MCP control plane. kubectl lives only in the executor.
  • restart_deployment returns 403 unless the caller sends approved=true and a named approver.

Impact

  • ~50 shared manifests deploy unchanged to kind, GKE, and EKS.
  • 44 pytest tests pin the governance invariants in CI.
  • An agent holding a rogue-CA certificate fails closed.

Kubernetes · EKS · GKE · kind · nginx mTLS · MCP · Python

Case study

Kubernetes · EKS · Kong

Terraform from VPC to runtime: EKS with the EBS CSI driver through IRSA, and Kong as the single front door, proven under load.

Public repo

"Is it working?" needs evidence.

Problem

  • A bare EKS cluster can't run stateful workloads.
  • Exposing every service directly scatters auth, rate limits, and routing.

Design

  • Two-AZ VPC, NAT, EKS in API auth mode, and a private node group.
  • An IRSA role for the EBS CSI controller, installed through the Helm provider.
  • Kong ingress with key-auth and rate-limit plugins.

Impact

  • ~30 Terraform resources stand up a working cluster.
  • k6 runs show the 5-per-minute limit counting down to 429.
  • Serves as the platform layer for Kube Agentic.

Terraform · Amazon EKS · Helm · IRSA · EBS CSI · Kong · k6

Case study Code

Solidity · Uniswap v4 · Hardhat

Self-funding Uniswap v4 ↔ Sushiswap arbitrage using v4 flash accounting, plus a scanner that separates real opportunities from liquidity mirages.

Public repo

Verify before trading.

Problem

  • Cross-DEX arbitrage needs inventory, or a flash loan with a fee.
  • v4's singleton PoolManager broke every existing V2/V3 integration.
  • A large, persistent spread usually means one side has no liquidity.

Design

  • Both legs run inside unlockCallback, and only the net is settled.
  • Prices come from StateView, and trades are simulated with the official V4Quoter.
  • The scanner flags pairs as thin v4 side instead of ranking them.

Impact

  • Pinning the fork block took the tests from ~60 s and flaky to ~6 s and stable.
  • Optional risk telemetry feeds a SOAR pipeline.

Solidity · Uniswap v4 · Sushiswap · Hardhat · ethers

Case study Code

Solidity · Aave V3 · Balancer

A Compound V2 → Aave V3 migration with zero-fee Balancer flash loans and a health-factor safety model measured on a mainnet fork.

Private · available for demos

Exit reads live debt.

Problem

  • The Compound V2 loop only paid because COMP rewards covered the spread.
  • Aave governance set DAI's loan-to-value to zero.

Design

  • USDC with 75% LTV covers the strategy's 70% borrow ratio.
  • Flash-loan entry: borrow 70%, supply 100%, borrow back to repay.
  • Exit flash-loans the current variable debt, so interest never leaves residue.

Impact

  • A full-cycle fork test: 120 USDC in returned 120.10, with zero debt left.
  • An honest verdict: the levered position earns ~1.3% APY, less than unlevered supply.
  • A halt flag blocks opening a position and never blocks exiting.

Solidity · Aave V3 · Balancer · Hardhat

Case study
Earlier Web3 work: DeFi ecosystem, DEX, DAO
  • DefiEcosystem: video demo, part 1VideoCode
  • DefiEcosystem: code walkthrough, part 2VideoCode
  • Flash-loan pool and trader contracts (Sepolia)PoolTrader
  • Sobek Market: AMM exchange front end (React)Code
  • Dark Unicorn Market: AMM exchange front end (React)Code
  • Decentralized exchange (React, Truffle)Code
  • DAO: decentralized autonomous organization (React)Code
Architecture diagrams
Full architecture portfolio on GitHub

How I build agentic systems

AI investigates. Code decides.

The goal isn't to replace deterministic security engineering with AI. It's to define where AI adds value, where it should not have authority, and how the two operate together safely.

  1. PydanticvalidatesTyped domain objects at every boundary
  2. Fusion.pydecidesDeterministic correlation, severity, playbook
  3. DynamoDBremembersAuthoritative state, re-read by every agent
  4. S3provesTranscripts, evidence, compliance reports
  5. BedrockexplainsInvestigation and narrative, never authority

Agentic reasoning does not require agentic authority.

The more interesting question isn't “Can an AI agent do this?” It's “Should the agent be allowed to do this?”

From game production to platform engineering

Experience

  • Progressed from IT consulting into cloud, DevOps, automation, security, and AI-assisted platform engineering, modernizing internal systems through reusable infrastructure and event-driven workflows.
  • Implemented Terraform Infrastructure as Code and modular deployment patterns across AWS environments.
  • Built Python/Bash automation and event-driven workflows with Lambda, SNS, SQS, and EventBridge to decouple services and reduce repetitive operational work.
  • Managed containerized workloads with Docker and Kubernetes (EKS), and automated remediation with SSM Automation and Auto Scaling Group refresh.
  • Designed AI-assisted document processing with Amazon Bedrock, including serverless PII detection and redaction using S3 Object Lambda, Comprehend, and Textract.
  • Implemented GitHub Actions and Jenkins CI/CD, plus CloudWatch monitoring, alerting, and reporting, with IAM least privilege, encryption, and WAF controls.

  • Built Solidity contracts and React front ends: a decentralized exchange, a DAO, and a flash-loan DeFi ecosystem with two AMM markets.

  • Diagnosed mobile, IoT, application, and home-networking issues.
  • Selected as a top performer for a support pilot and for technician mentoring.

  • 2K Games, Associate Producer (2015–2016): game development and publishing, QA and database workflows, dedicated-server setup, and first-party submissions.
  • 505 Games, Project Manager / Submission Manager (2011–2014): multi-platform production, certification, risk, and release schedules with developers and platform partners.
  • Activision, Associate Producer / Production Coordinator (2002–2011): milestone coordination, QA, build and mastering, and production planning, including launch titles on new hardware.

Platform partners & licensors

  • Microsoft
  • Sony
  • Nintendo
  • Steam
  • Apple
  • Marvel
  • Fox
  • Hasbro

Selected titles

  • Call of Duty
  • Guitar Hero
  • DJ Hero
  • Tony Hawk
  • Quake III
  • Return to Castle Wolfenstein
  • Soldier of Fortune
  • Star Trek: Elite Force
  • Spider-Man 2 & 3
  • Spider-Man: Web of Shadows
  • Marvel Ultimate Alliance
  • Fantastic Four
  • Transformers Animated
  • Prototype
  • Terraria
  • Payday 2
  • Sniper Elite 3
  • Defense Grid 2
  • Battleborn

As a coach, I've also led teams through player development, performance reviews, and goal setting, bringing different personalities together toward one goal.

Core competencies

Skills

Cloud & Platform Architecture

AWS · GCP · Azure (foundational) · multi-cloud · serverless · distributed and event-driven systems

Infrastructure as Code

Terraform · reusable modules · remote state and locking · CloudFormation · Packer

Containers & Kubernetes

Docker · Kubernetes · Amazon EKS · GKE · Helm · Kong

CI/CD & Automation

GitHub Actions (reusable workflows) · Jenkins · Python · Bash · REST APIs

AI Platform Engineering

Bedrock Converse · agentic AI · Step Functions · MCP · Pydantic · Vertex AI RAG

Security / DevSecOps

Cognito OAuth/RBAC · IAM least privilege · WAF · KMS · Secrets Manager · Snyk

Observability & Reliability

CloudWatch · Prometheus / Grafana / Loki · alarms · incident workflows · evidence

Cloud Networking

VPC · Transit Gateway · Route 53 · ALB/NLB · HA VPN · BGP · Cloud Router · security groups · NACLs

AWS Certified Solutions Architect – AssociateVerify credential
UCLA ExtensionComputer and Information Sciences
The Ohio State UniversityComputer Science

Los Angeles, CA · Remote

Let's build something secure.

I'm a former producer and project manager turned cloud engineer. I build Terraform-managed security, networking, and AI platform systems on AWS, GCP, and Kubernetes. Private repositories are available for demos.

jastek.sweeney@gmail.com View résumé Download PDF