Resume

Overview

Infrastructure engineer who owns a production GPU/Kubernetes platform end to end: bare-metal provisioning, RoCE/RDMA host configuration, NVIDIA driver and GPU Operator lifecycle, HA control plane, GitOps, GPU scheduling, storage, identity, and the inference layer. I write the deploy and verify code, run the change windows, and debug from kernel and PCIe up to fabric and scheduler. I also own the conversations around the platform: requirements from researchers and regulated customers, and design reviews with security and network teams. Earlier: datacenter operations for 30,000 users, VMware End-User Computing CTO Office (3 issued patents, code that shipped), Nutanix and Datrium.

Core technical skills

GPU nodes and bare metal: NVIDIA HGX H200 and RTX PRO 6000 Blackwell, GPU Operator, open kernel modules, Fabric Manager, DCGM, NCCL, HAMi; MAAS, iPXE, Redfish, Packer, cloud-init, Ubuntu Linux, kernel and BIOS policy, systemd, canary-then-fleet rollout, staged decommissioning.

Kubernetes and GitOps: kubeadm, etcd, kube-vip, containerd, Calico, scheduler extenders and webhooks, CRDs and operators, gang scheduling (KAI Scheduler selected, Kueue evaluated), Argo CD, Helm, Kustomize, Kyverno, NetworkPolicy, PodSecurity, RBAC, Gateway API, MetalLB, cert-manager, CloudNativePG.

Networking, storage, inference: host-side RoCE v2 (PFC, DSCP, DCQCN), GPUDirect RDMA, ConnectX-7, SR-IOV, PCIe ACS; VAST NFS (CSI planned); vLLM, Bifrost, Ollama, Coder, Kubeflow, pgvector, MCP servers.

Reliability, languages, identity: Prometheus, Alertmanager, Grafana, SLO-style gates, incident response, on-call; Python (FastAPI, SQLAlchemy, pytest), Bash, Go (open source), TypeScript, SQL, Docker, Terraform (Coder templates), GitHub Actions; Keycloak, FreeIPA, eduGAIN, OIDC, Cloudflare Access, secrets-at-rest encryption, audit logging.

Experience

Infrastructure Engineer and Platform Owner, GPU and Kubernetes (title: Chief AI Officer) · ASI Solutions Ltd · Auckland, New Zealand · Jul 2024 – Present

Own the GPU fleet, the Kubernetes platform, and the path from bare metal to serving for a sovereign AI platform used by government, research, and regulated enterprise. Set technical direction for, and led, the multi-quarter delivery programme across the university, network engineering, storage, and security teams, with no reporting authority over any of them and no platform team beneath me; translated researcher and customer requirements into platform design.

Designed and delivered a national AI research platform for a leading New Zealand university, won against hyperscaler bids: 8-GPU HGX H200 nodes (256 vCPU, 2.2 TB RAM), an RTX PRO 6000 Blackwell inference and development tier, NVLink/NVSwitch, 800 Gb Ethernet fabric, VAST parallel storage; GB200 expansion in flight. Runs multi-tenant across research groups.
Turned node bring-up from a hand-run procedure into code: MAAS with iPXE chainload for ConnectX-7 hosts, Redfish boot-order automation, Packer images, cloud-init, kernel options such as nokaslr, and an idempotent deploy/verify/teardown suite (canary node, then fleet) that refuses a node into the cluster until driverless-host, SR-IOV, Secure Boot, ulimit, PCIe ACS, RoCE QoS, Fabric Manager ordering, and etcd fsync p99 checks pass. Every live-node fix goes back into the image, so a redeployed node never regresses.
Found why multi-node inference crashed on a fabric that passed every bandwidth test: RoCE traffic was landing in the lossy queue because switch ports lacked DSCP trust. Worked it through with the network team, then changed fabric acceptance to an incast test so that class of fault cannot ship again. Own the host side end to end: 10 RDMA rails per node, PFC and DSCP marking, DCQCN, GPUDirect RDMA, NCCL environment.
Diagnosed daily spurious leader elections on the HA control plane (kubeadm, stacked etcd, kube-vip; control-plane VMs on Nutanix AHV, GPU nodes on bare metal) to fsync tail latency on virtualised disks that passed the average-based pre-flight probe; retuned the etcd Raft and kube-vip timers and made kubeadm-config the source of truth so no upgrade can silently revert the fix. Six-hourly etcd snapshots with tested restore.
Solved mixed-wattage GPU placement (tensor-parallel jobs landing on one 600 W and one 300 W card ran at the slower card's speed) after proving the device plugin's resource-renaming path does not work: introduced HAMi as scheduler extender with a namespace-opt-in webhook and whole-GPU allocation, and handed the node over behind three independent gates with zero downtime to live models. Diagnosed the CDI vs legacy device-injection conflict that failed every GPU pod at container create and fixed it with a runtime-class pin. Write-up: Handing one node's GPUs to HAMi without touching the live models.
Made driver and kernel-module upgrades routine rather than outage events: DKMS-built open-kernel-module driver rolled node by node through GPU Operator skip-labels, scale-to-zero, and upgrade-wait, with Fabric Manager state verified after each and DCGM exporting every GPU.
Designed configuration drift out of the platform after test-era live patches kept being reverted by Helm: every service now ships through Argo CD app-of-apps with self-heal, prune disabled, and no live patching; documented the ServerSideApply drift loops and "Healthy but never applied" failure modes so nobody debugs them twice. Removals are staged (scale-to-zero, 48-hour soak, delete); teardown-and-redeploy is the acceptance test for every service; one-way-door decisions are recorded as binding architecture decision records. Secrets live only in AWS SSM, with gitleaks in CI.
Eliminated the platform's most recurrent storage failure (root-squash against containers running as root, which had caused data loss and orphaned volumes in test) with LDAP-integrated VAST view policies and per-user quotas; PostgreSQL on CloudNativePG with tested failover. Replaced hand-built identity with realm-as-code Keycloak federated to eduGAIN, FreeIPA as the POSIX store, and a reconciliation-loop provisioner I wrote, so a researcher's first federated login yields a working POSIX account with no operator step; kube-apiserver OIDC with group-mapped RBAC.
Brought a 744B-parameter MoE (GLM-5.3, FP8) into production at TP=8 over NCCL/NVLink alongside TP=4 engines: 756 GB of weights pre-staged, cold start 4.5 min, KV cache sized to 457k tokens at 256k context. Gave researchers self-service without tickets: Bifrost gateway with per-user virtual keys and an air-gapped model catalogue, Coder GPU workspaces from Terraform templates. Acceptance gates as SLO-style thresholds and a fleet-level health collector spanning every layer from nodes to serving.
Shipped ASI Cloud's AI products: GPU-as-a-Service for regulated industries barred from hyperscalers by data-sovereignty rules; ML Workspaces, managed GPU Kubeflow on Nutanix AHV; GOVGPT (govgpt.asi.nz), a free national public LLM service on open-weight models, whose uptime I carry.
Built AKMS (write-up: The answer was already in Teams) so the company could find answers already buried in Teams, Linear, and SharePoint: Python (FastAPI, SQLAlchemy, Alembic, PostgreSQL with pgvector and full-text), hybrid retrieval fused by Reciprocal Rank Fusion with cross-encoder rerank, nine source connectors, separate API, worker, and scheduler services on a row-locked job queue, ACL-enforced retrieval with an audit log, a recall@k eval harness in CI, and an MCP server so engineers query it from their own editors and get cited evidence.
Built Data Insights so councils could classify documents and find personal information across their estates for Privacy Act compliance: FastAPI and SvelteKit, Ollama-served classifiers, PII detection mapped to the Privacy Act, HIPAA, and PCI-DSS.

Co-Founder · Inzpec Ltd · Auckland, New Zealand · Apr 2022 – Jun 2024

Property due-diligence platform built with Trade Me; designed the data platform and the AI property analysis and risk scoring for lenders and insurers.

Global Head of Product Marketing, Security and Identity · Citrix Systems, Inc. · Remote (Auckland) · Oct 2020 – Apr 2022

Owned the zero-trust portfolio (Secure Private Access, ZTNA, Enterprise Browser); architecture blueprints and a technical series.

Co-Founder (founding stage, non-operating) · CloudVector, Inc. · Los Altos, CA · Nov 2018 – Jun 2021

Co-founded an ML-based API threat-protection startup alongside my Datrium role; stepped back from day-to-day involvement early. Acquired by Imperva in 2021.

CTO APJ (previously Vice President, Solutions and Alliances) · Datrium, Inc. · Sunnyvale, CA · May 2017 – Aug 2020

Led the solutions architecture team for the DVX open converged infrastructure and cloud disaster-recovery platform: reference architectures, benchmarks, and technical papers that let enterprise customers run Oracle and other I/O-intensive workloads on it. Worked directly with engineering on features and bugs, and presented the technology to customers and at conferences, through the acquisition by VMware.

Head of Alliances Engineering and Verticals (from Senior Director) · Nutanix, Inc. · San Jose, CA · Jan 2014 – Apr 2017

Solutions and alliances engineering through hypergrowth and the NASDAQ IPO; filed two patents on EMR performance and PHI handling in distributed systems.

Senior Staff Architect, End-User Computing CTO Office (promoted twice from Senior Consultant Architect) · VMware, Inc. · Palo Alto, CA · Feb 2010 – Jan 2014

Advanced-development engineer: concept to prototype to product. Built Project Orcha (Horizon Workspace + View tech preview); several innovations shipped as product; 3 issued patents on remoting and UI virtualisation.
Scaled Horizon View to 10,000 desktops per vCenter pod (up from 2,000), defining the limits, storage (CBRC, SE Sparse), and cluster design. Co-authored two Horizon/View books and built the field's VDI sizing calculator; VMworld speaker 2011 and 2013.

Head of Datacenter Operations, APAC · TeleTech Holdings, Inc. · Sydney, Australia · Mar 2004 – Oct 2009

Ran IT operations and critical infrastructure for 30,000+ employees across APAC under contractual SLAs; led outsourcing programmes for telecommunications and banking clients. Earlier: Head of IT Operations, Blockbuster Brazil (1998 – 2004).

Open source, patents, education

GitHub: cryptopump (Go, real-time trading engine on goroutines and WebSockets) · ollama-gpu-calculator (JavaScript, GPU sizing for local LLM inference) · signalscope (TypeScript/Python ML pipeline). Patents issued: US 10,826,795; US 2015/0058286; US 2013/0290856. Filed: US 15/431,190; US 15/426,632.
Books: VMware View 5 and VMware Horizon 6 Desktop Virtualization Solutions; VMware View Security Hardening Guide. 600+ articles at myvirtualcloud.net, including the HAMi handover, hybrid retrieval, and production ML write-ups. Stanford Engineering, Machine Learning Specialization (2024) · Stanford GSB, Managing Teams for Innovation (2017) · B.S. Computer Science, São Paulo University of Technology · B.S. Business Administration, FAAP.
Cursor New Zealand Ambassador for Auckland (SpaceXAI, 2026 – Present) · Alchemist Accelerator mentor, 11+ years · VMware VCP/VCAP, vExpert (8 years), EMC Elect, VDI Ingenuity Award.