Artem Penner

Day to day I oversee application and platform architecture on AWS and GCP: keeping things aligned with cloud best practice, but also folding them into one internal standard with Kubernetes as the core, so every service isn't a snowflake. Alongside that I build the platform itself — internal services in Go, APIs with OAuth2/OIDC in front of them — so internal teams and customers get self-service automation instead of a ticket queue. On top of those APIs sit agentic workflows, which means someone who doesn't write Terraform can describe the application or environment they need and get it provisioned, inside the guardrails, without waiting for a platform engineer.

A lot of my week goes into pipelines and tooling that take repetitive work away from SRE and support: automation for the tasks they used to do by hand, and internal bots that pull and correlate logs and metrics during an incident so the first useful insight arrives in minutes instead of after an hour of clicking through dashboards.

I own observability end to end — metrics, logs, traces, alerting, SLIs/SLOs and the SLAs on top of them. In practice that means Datadog plus a parallel VictoriaMetrics / VictoriaLogs / VictoriaTraces stack, because keeping everything in a commercial SaaS gets expensive fast, and the cheaper tier should still be able to answer the on-call question.

Security and compliance is the other half of that job. I run PKI and Vault integrated with Kubernetes so certificates, secrets, and workload identity are issued automatically and short-lived — end-to-end encryption and zero trust between applications, and between applications and their end users, as part of the platform rather than a bolt-on. I also watch cloud health, security posture, and spend continuously: Lambdas and custom checks that enforce the controls our certifications require and hunt down stale resources before they show up on the invoice. A good part of that work is advisory — telling teams what an auditor will actually ask for, and then implementing the controls with them.

Where I'm most useful to a client is the early, uncertain part: it's often far cheaper to bring in one person to prove an idea works — build the PoC, find the dead ends, size the real effort — than to commit a whole team to a roadmap on faith. I'm happy to be that person, and then to stay around as the guide while your team takes the implementation the rest of the way.

I started out in telecom datacenters, on the side of the stack where things are physical: a mixed Solaris and Linux fleet, SAN fabrics and storage arrays, tape backup, and the Oracle databases sitting on top of all of it — including a data warehouse in the tens of terabytes. It's a good school. When replication breaks at 3 a.m. and the DR site has to come up on a cluster with storage-level replication, nobody cares which layer the fault technically belongs to. It's also where I got tired of doing things by hand and wrote my own configuration-management tool, complete with its own DSL, a few years before Ansible made that a bad idea. I also moved the company off its commercial monitoring suite onto open-source Zabbix and wrote the automation that let it scale to the whole estate.

Twice I drove the infrastructure side of migrating an entire carrier's billing platform to a new vendor. Both times the job was the same shape: get Unix, storage, and the database layer ready for a system nobody had run before, keep disaster recovery intact through the cutover, and make sure everything was monitored before the first invoice depended on it.

Then the scale changed. I spent a few years unifying Unix and load-balancing operations across 19 datacenters — roughly 2,000 physical servers and 5,000 VMs — while a centralized billing platform had to land identically everywhere, Oracle, Kafka, Cassandra, Redis, and RabbitMQ included. We solved it with PXE boot, Puppet, and Foreman, so "give me a Cassandra node" became a provisioning decision instead of a runbook; put Pacemaker under the services that genuinely could not go down; and ran a distributed GlusterFS estate large enough that Red Hat used it as a reference. A lot of my time went into being the person on the bridge call deciding whether we were looking at the network, the database, the hypervisor, or the kernel.

After that I got interested in replacing expensive things with software. We migrated the internal virtualization platform off VMware vCloud onto OpenStack and moved the IT control plane onto Kubernetes — and, my favorite project of that era, built a storage platform on OmniOS/ZFS with a Python REST API and a custom OpenStack Cinder driver. It retired six commercial arrays and gave developers thin-cloned copies of production-sized datasets in seconds instead of hours.

The cloud years looked different again: data lakes on AWS and GCP for medical-device and pharma clients, Python ETL orchestrated with Step Functions, everything provisioned through Terraform, and security and audit requirements treated as design inputs rather than a pre-release scramble. From there it was a short step to running a managed database platform across three clouds — modular Terraform, GitOps with Argo CD and Argo Workflows, Cilium networking, SOC 2 and PCI DSS on top — which is roughly where the work I do today picks up.

• Depth across the whole stack: Linux internals, storage, and distributed databases up through Kubernetes, multi-cloud networking, and infrastructure as code — so problems don't get lost between layers or between teams.
• Observability people actually use: highly available metrics, logging, and tracing platforms (Prometheus, VictoriaMetrics/VictoriaLogs, Grafana, OpenTelemetry, Datadog), with alerting and SLOs tuned against real incidents instead of dashboards nobody opens.
• Data lakes & data platforms: designed and built data lakes on AWS and GCP for regulated enterprises — ingestion and ETL pipelines, streaming with Kafka, and the governance and access controls that come with pharma and medical-device data.
• Identity, access & secrets: OIDC/OAuth2 single sign-on for humans and workloads, short-lived credentials over static keys (Vault, SPIRE, workload identity federation), least-privilege IAM, and network segmentation — usually the part that decides whether an audit goes smoothly.
• I still write the code: Go and Python for automation, internal services and APIs, custom drivers and operators, and MCP servers that let AI assistants query real infrastructure — architecture backed by working software, not just diagrams.
• Proven at scale: thousands of physical servers and virtual machines across 19 datacenters, plus production multi-cloud database platforms serving customers on three providers.
• Hands-on leadership: led engineering teams of up to 22 people across several countries while still running incident response as the final escalation point — and comfortable turning stakeholder requirements into architecture, effort and cost estimates, and audit-ready documentation.