mdozhdev@gmail.com · linkedin.com/in/maximdozhdev · gitlab.com/mdozhdev · Spain (remote) · CET
DevOps / SRE engineer, 15+ years in production. The last two roles I've been the only infrastructure person on the team, owning everything from greenfield design and IaC to on-call. GCP/GKE is home territory. Strong on cost work: spot-only node pools, CUDs, self-hosted OSS instead of paid SaaS where it makes sense. I like small distributed teams and open-source ecosystems, and I'm interested in peer-to-peer / Bitcoin-adjacent infrastructure.
Apr 2025 – present · Sole DevOps engineer
- Built the GCP infrastructure from scratch with Terraform: zonal dev cluster, regional HA prod GKE. Both run on spot node pools with PDBs and anti-affinity. Workloads stay stable at a fraction of on-demand cost.
- One shared GitLab CI template library and one Helm chart cover every service (NestJS API, Next.js site, React admin). Fewer places to fix things, no per-team drift.
- Self-hosted observability: SigNoz on a 3-node ClickHouse cluster (3 × 256 GiB replicated PVCs), with four OpenTelemetry collectors split by purpose (gateway, Prometheus scrape, GCP Cloud Monitoring bridge, per-database sidecars). Distributed tracing runs end to end — Next.js → NGINX ingress (X-Trace-ID propagation) → NestJS → databases. Alerts go to Slack.
- Per-branch preview environments in GitLab CI, with live pod-watch and automatic Helm rollback on failed deploys.
- Stateful tier: MongoDB replica set under the Percona Operator (spot-tolerant, GCS PITR), CloudNativePG with PgBouncer, Redis Operator, CloudSQL. Secrets via Vault and the Vault Secrets Operator — nothing static in manifests.
- Moved Next.js to standalone output with a Redis-backed shared cache handler. No more cold-cache thundering herd on rolling restarts.
- Significant GCP spend reduction: CUDs across Compute Engine and Cloud SQL, spot pools in dev and prod, and a registry-backed BuildKit cache that replaced GCS-backed PV caches entirely. Self-hosted SigNoz removed the SaaS observability bill too.
Feb 2024 – Apr 2025
- Set up GCP Dev/UAT/Prod for a new service portfolio. Terraform + Terragrunt for DRY multi-env layout, Ansible for the rest: GKE, GCE, Cloud Load Balancing, GCS, Cloud SQL.
- CI/CD on Cloud Build and Cloud Deploy for a polyglot stack: Go, Node.js, PHP.
- Hardened the platform: Vault for secrets, Cloud Armor for WAF and DDoS, fine-grained IAM. Application security pipeline combining OWASP ZAP DAST, DefectDojo, Dependency-Track, Trivy.
- Observability on GCP Managed Service for Prometheus, with Grafana dashboards and alerting.
Jul 2020 – May 2023
- Built the company's first production Kubernetes platform on GKE + CloudSQL. It became the baseline for every customer rollout after.
- On-demand UAT environments on Compute Engine with k3s and Helm, for fast product iteration.
- Brought up the first AWS footprint (EKS, EC2, NLB, RDS) — multi-cloud from there on.
- Owned incident management end to end. Introduced Terraform as the standard for new customer site rollouts.
- Observability with Prometheus, Grafana, Zabbix. Deployments automated in GitLab CI with Ansible and Python.
Nov 2019 – Dec 2021
- MVP infrastructure on AWS (Lambda, RDS, CloudFront, ALB), CI/CD via Bitbucket Pipelines for Java and Python services.
- After the product pivoted, rebuilt the stack around containers (Docker, ECS, Node.js) with custom CloudFormation tooling and Python automation. Added auto-scaling and an ELK / OpenSearch logging stack.
May 2018 – Oct 2019
- Initial GKE platform launch with CloudSQL. Passed a PCI DSS audit on the GCP infra (KMS, network firewall hardening, IAM).
- Jenkins / Groovy CI/CD for Go and Java services. Wrote a custom Kubernetes operator in Go using the Operator Framework. Sat on 3rd-line support and shipped root-cause patches in-house.
- EPAM Systems — System Engineer (2014–2016). HPC / SGE support for a bioinformatics customer; Ansible / Chef / CFEngine / Kickstart; deployed and scaled GitLab, Jenkins, Maven.
- CardsMobile (Koshelek) — Lead of IT Operations (2013–2014). Built the platform from scratch on Debian/Xen + Windows Server. Full stack under Puppet. Passed MasterCard GVCP and PCI DSS audits.
- i-Free — Head of System Administration (2007–2013). Built and ran an on-prem DC and an AWS cloud footprint. Led a team of six.
Cloud & infra: GCP (GKE, GCE, Cloud SQL, Cloud Build, Cloud Deploy, Cloud Armor, Cloud Monitoring); AWS (EKS, EC2, ECS, RDS, Lambda, CloudFront) IaC & config: Terraform, Terragrunt, Ansible, Helm, Puppet, Chef, CloudFormation Kubernetes & containers: GKE, EKS, k3s; Docker, BuildKit; Percona Operator, CloudNativePG, Redis Operator CI/CD: GitLab CI, GitHub Actions, Cloud Build / Cloud Deploy, Jenkins, Bitbucket Pipelines Observability: SigNoz, OpenTelemetry, Prometheus, Grafana, Zabbix, ELK / OpenSearch, GCP Cloud Monitoring Security & networking: Hashicorp Vault, Cloud Armor (WAF / DDoS), OWASP ZAP, DefectDojo, Dependency-Track, Trivy, KMS; iptables, SELinux, WireGuard; NGINX ingress, OpenResty, Cloudflare; PCI DSS Databases: PostgreSQL, MongoDB, Redis, ClickHouse, Cloud SQL, Neo4j Languages: Bash, Python, Go (operators and tooling), Groovy (Jenkins DSL), HCL. Comfortable reading and modifying Rust, JavaScript, TypeScript.
St. Petersburg Electrotechnical University 'LETI' (SPbGETU) — Specialist degree, Radio Electronic Systems, 2006.
Languages: English (professional), Russian (native).
Interests: Sailing (J/70 crew); machining & metalworking (Steel Arts Workshop).