Adil Maralbayev

Hardcode · Astana, Kazakhstan

• Designed and delivered on-premise production infrastructure from bare metal upward — hypervisors, VMs, network segmentation, storage, backup and monitoring — growing the estate to 200+ VMs across 15+ hypervisors and supporting 30+ production customer systems at 99.9%+ uptime.
• Reduced GitLab CI/CD pipeline build time by ~50% through layered Docker build caching, dependency caches and a shared runner strategy — cutting delivery feedback loops for development teams.
• Embedded security gates directly into CI/CD as mandatory pipeline stages — automated secret detection (passwords, API keys, private keys, tokens), container image vulnerability scanning and configuration linting — preventing credentials and vulnerable images from ever reaching build artifacts or production registries.
• Prepared and successfully certified two government projects against Kazakhstan information security requirements as third-class (K3) information systems, verified by attestation testing of the State Technical Service. Owned the full cycle: gap analysis, OS and application hardening, evidence and documentation package, coordination with SOC and auditors, and remediation of all findings.
• Deployed and operated 15+ highly available Kubernetes clusters on on-premise infrastructure end to end and independently — 15–25 nodes each across 2–3 physical servers, with multi-master control plane, external etcd, keepalived VIP load balancing, CNI, ingress and persistent storage — with no managed cloud control plane to fall back on.
• Scaled production Kubernetes clusters horizontally, adding and safely draining/removing worker nodes with zero downtime to match workload growth and decommission hardware, including certificate rotation and control-plane maintenance.
• Hardened the Linux estate to security-baseline standard: SSH hardening, PAM policies, auditd rule sets, kernel and sysctl tuning, firewall policy and least-privilege access control — rolled out consistently across all stands via Ansible.
• Designed network segmentation and DMZ zoning separating public-facing entry points from application and database tiers, with controlled ingress/egress, reverse proxies and VPN-only administrative access.
• Administered PostgreSQL in production: HA clustering and replication, security configuration (network ACLs, pg_hba policy, role separation, TLS) and performance tuning — stabilising high-traffic production databases.
• Built enterprise backup and DR with Veeam, Vinchin and Proxmox Backup Server, plus PostgreSQL logical and physical backups with WAL archiving and point-in-time recovery — regular restore drills with a 100% successful restore record.
• Implemented full-stack monitoring and observability — Prometheus, Grafana, Alertmanager with Node/Blackbox/cAdvisor/SQL exporters, centralised ELK logging and n8n alert routing — cutting incident response time by 40–50%.
• Standardised infrastructure with IaC (Ansible roles and playbooks, Terraform provisioning), reducing manual operational work by ~70% and eliminating configuration drift.
• Automated recurring operational work with Go, Bash and Python tooling — health checks, backup verification, certificate expiry monitoring and bulk fleet operations.
• Adopted Claude Code and LLM-assisted engineering as a working part of the delivery process for automation scripting, IaC authoring, log and incident analysis, and introduced AI-assisted diagnostic workflows to colleagues.