Rafael Santiago Silva — Senior Infrastructure & DevSecOps Engineer

Senior Cloud Operations Analyst | e-Core (AWS Partner MSP)

Sep 2023 – Present

• Operate roughly 20 enterprise AWS accounts across financial services, payments, energy, healthcare and research, with hard separation between tenants enforced by centralized cross-account IAM role assumption with External ID, least-privilege policies and per-account guardrails.
• Support multi-cluster EKS for a financial services client: IRSA for pod-level AWS identity, cross-account Transit Gateway connectivity, Amazon MSK for streaming, and distributed tracing with ADOT and OpenTelemetry.
• Design and operate event-driven integrations on SQS, EventBridge and MSK; run RabbitMQ in production at an energy utility, including version upgrades, backup strategy and enabling the client team, and Redis/ElastiCache across four client environments.
• Harden environments at scale: Systems Manager Patch Manager with custom baselines, CloudFormation StackSets in SERVICE_MANAGED mode across the organization, Secrets Manager and KMS adoption, SSL/TLS certificate lifecycle, and recurring security exposure reviews.
• Build operational tooling in Python with boto3, and designed and shipped a multi-tenant FinOps portal from scratch (React/Vite, AWS Amplify, API Gateway, Lambda, DynamoDB, Cognito, Terraform) where tenant isolation is enforced by centralized role assumption rather than application logic.
• Run production change windows end to end with validation and rollback plans, including PostgreSQL and MySQL RDS major-version upgrades for different clients with zero unplanned downtime.
• Documented a previously unpublished AWS Backup limitation on AWS re:Post, later confirmed by an AWS Expert, and identified and remediated 723 TB of unmanaged S3 object versions through lifecycle and versioning policy.
• First escalation point for client incidents: daily AWS Health triage, CloudWatch dashboards and alarms built from scratch, root cause analysis and written postmortems.

Cloud Infrastructure Analyst, Propz

Jan 2023 – Sep 2023

• Managed 19 AWS accounts covering provisioning, access control and day-to-day infrastructure change across client-facing and internally owned environments.
• Applied infrastructure changes through Terraform and automated delivery with Jenkins pipelines triggered from Bitbucket; authored reusable Terraform modules for Route 53 and DNS management.
• Acted as the daytime execution point for distributed engineering teams in Russia and Poland, keeping deployment continuity across time zones; operated across AWS and GCP.

Infrastructure Analyst, Bit Pagg → Bit Tech (Payments Fintech)

Sep 2021 – Jan 2023

• Sole infrastructure owner at a 50-person payments fintech, accountable for the entire stack in a regulated environment with no second line of support.
• Provisioned AWS accounts and environments with CloudFormation from scratch; ran application delivery on Azure DevOps and identity on Azure AD.
• Managed the full on-premises side: firewall, Windows Server and Active Directory, DNS, and Red Hat Linux database servers running SQL Server, partnering with developers to unblock hybrid deployments.

Independent IT Consultant | Self-employed

2018 – 2021

• Delivered on-premises infrastructure projects for small and mid-size businesses: networking, Linux and Windows Server environments, physical server builds, firewall configuration and backup routines.

Senior Service Desk Analyst | CBMM

Aug 2015 – Aug 2018

• IT support and shift-based on-call for a global mining operation with subsidiaries in the US and Singapore, supporting SAP ERP and networking in a business-critical context; hands-on production server builds and DLL-level troubleshooting on legacy systems.

IT Sector Manager | Capal Cooperativa

Mar 2011 – Jul 2015

• Led a 3-person IT team and designed multi-branch network infrastructure, including radio links, for environments of 70 to 150 endpoints on Linux and Windows Server.

GitOps Lab — ArgoCD, Kustomize, Kubernetes github.com/tommmdl/argocd-lab

• Reproducible kind-based lab isolating ArgoCD reconciliation behaviour: two Applications with identical automated sync differing only in self-heal, used to compare drift detection, automatic revert and Git-driven change. Documents the Kustomize label and selector immutability trap and the server-side apply requirement for oversized CRDs.

Multi-Tenant FinOps Portal

• Internal platform serving per-client cost and account data with isolation enforced through centralized cross-account role assumption; React/Vite front end on AWS Amplify, serverless back end on API Gateway, Lambda, DynamoDB and Cognito, infrastructure in Terraform.