About Chris Jaimon

Chris Jaimon is a senior software and platform engineer and a CNCF Golden Kubestronaut. He is the sole platform engineer behind Nexus, a Frost & Sullivan Top-20 Global MDR product, operating a multi-tenant Amazon EKS platform of 300 to 400 nodes and 250+ microservices. His work spans Kubernetes (including bare metal with Talos, Cluster API, Metal3, and Cilium), AI and LLM inference (vLLM, GPU, AWS Trainium, AWS Inferentia), platform engineering with Crossplane and Backstage, GitOps with Argo CD, observability, and cloud security.

Projects

Multi-Model LLM Inference on EKS, Across Three Generations of Silicon — Production LLM serving on AWS Inferentia2, Trainium2, and NVIDIA L40S: spot-first, no lock-in, fronted by an Envoy AI Gateway.

AI for Cyber Defence: Phase One — An AI investigation layer for the SOC. A DeepAgents harness that triages SIEM incidents end to end, from raw-event queries to a scored attack story, and auto-closes the false positives.

AI for Cyber Defence: Phase Two — Offense-informed defense: autonomous penetration testing with PentAGI, and breach-and-attack simulation with OpenAEV, wired so a plain-English threat compiles into a controlled Caldera simulation and a graded verdict. Detection-as-code for the SOC.

An Internal Developer Platform That Hides Kubernetes — Crossplane compositions that turn a Git repo into a fully-wired, secure service that ~60 engineers ship without ever touching raw YAML.

From ECS to a Cloud-Native Platform: the Five Pillars — I drafted the proposal, won leadership buy-in, and set the technical direction that took Nexus from ~75 services on ECS to 250+ on EKS.

Observability, LGTM — Four telemetry signals on Grafana's LGTM stack (metrics, logs, traces, profiles), shipped by one eBPF-aware agent, plus Langfuse for the LLM stack, Hubble for the mesh, and a HolmesGPT-enriched alert path.

Service Mesh Evolution: Istio Sidecars → Cilium eBPF — Blue-green migrated a 300-node production mesh off Istio sidecars onto a Cilium eBPF dataplane, unifying CNI and mesh, cutting API latency ~5%, and stretching one fabric across two clouds.

Agent-Driven Operations: ~70% of SRE, Run by an AI Operator — HolmesGPT in operator mode as a member of the on-call rotation: it runs 24/7, investigates alert to resolution across the whole estate, verifies every deploy, and opens the PR to fix what it finds.

Eight Arms, One Source of Truth — The full Argo ecosystem, wired so developers do everything from a GitHub pull request: develop, preview, promote, roll back, and self-heal, with Git as the only source of truth.

Five Levers to a 70% Lower Cloud Bill — Karpenter-driven, ~80% spot, with weighted NodePools and on-demand fallbacks: 60–70% lower cloud cost without trading away reliability.

Multi-Cluster, Multi-Cloud, Hybrid: One Network Fabric — Two independent AWS regions plus an Oracle OKE burst cluster, made to feel like one network: Route 53 and Global Accelerator for failover, an IPSec site-to-site VPN for the hybrid link, and Cilium ClusterMesh joining only the primary EKS to OKE.

One Week to One Hour: Automated IaC Delivery to 150+ SIEM Tenants — Wrapped Atlantis in a middleware that hides the pull requests and drives the whole flow from our own product: one merge fans a Terragrunt change across ~150 customer environments, with per-tenant plans, LLM summaries, and customer approval.

LetsBloom: Compliant-by-Default Landing Zones — A marketplace of 18 secure-by-design landing zones and blueprints for a global bank's fintech arm, all defined as Terraform and kept continuously compliant by policy-as-code.

Casbin: RBAC Made Easy — The authorization framework behind LetsBloom: one RBAC policy engine, the model separated from the policy, enforced at the Envoy sidecar in the Consul service mesh.

A Distributed DAG Scheduler for Landing Zones — Onboarding and landing-zone provisioning modeled as a dependency graph in ArangoDB, executed by a Celery worker pool: every task runs the moment its dependencies are done.

DevSecOps as a Pipeline — The secure delivery pipeline behind LetsBloom: every commit, image, and landing zone runs a gauntlet of security gates from pre-commit to runtime, so nothing reaches production dirty.

CSPM with Cloud Custodian — Keeping customer-modified blueprints compliant to a bank's security posture across AWS, Azure, and GCP, with Cloud Custodian (c7n) policies I deployed and managed through middleware.

A Zero-Downtime AWS→Azure, ECS→AKS Migration — Re-platformed a fintech product across clouds and onto Kubernetes (100+ nodes, zero downtime), and wrote ~40% of its Go services.

Misc

Living on a YubiKey — Why a hardware security key is the 2FA I trust, and everything I put behind a touch: every account, my SSH identity, and a signature on every commit.

Home Networking Setup — Dual-ISP failover, a PoE switch, eleven cameras, and a Mac Studio in the rack. Built from the crimping up.

How This Site Works — The architecture end to end: git-push deploys, the edge, D1, the AI concierge, generative UI, and RAG.

Why Cloudflare, for Free — The free tier is a genuinely usable platform. Why it suits a portfolio and a small business.

The Laptop Sticker Question — Yess stickers or less stickers? Vote, then tour the evolution since 2018.

Desk Setups Through the Years — Where the work actually happens. A gallery that grows backwards in time.

Why I don't use LinkedIn — A deliberate choice, not an oversight.

Claudius and the Tungsten Cube — The tungsten cube saga, abridged and silly.

Chris Jaimon

Platform & Infrastructure Engineer · Golden Kubestronaut

Experience Projects Open source Writeups Certifications Awards Misc Résumé Contact

Ask anything, or pick a topic.

About Chris Jaimon

Projects

Engineering writeups

Misc

Chris Jaimon