Oleksii
Kuzkin

Serverless static site & contact-form backend

A production site with zero servers: every resource is defined in Terraform and deployed by pipeline.

• ›The site is served from a private S3 origin behind CloudFront, locked down with Origin Access Control, AWS WAF managed rule groups and geo-blocking.
• ›The contact form runs through API Gateway, Lambda and SES, with DynamoDB rate-limiting each IP, origin verification, and IAM scoped to exactly what each function needs.
• ›GitLab CI/CD deploys it, authenticating via OIDC federation instead of stored credentials, with SAST and secret scanning gating every merge.
• ›A strict CSP serves only self-hosted assets, DKIM and DMARC are enforced at p=reject, and I imported the console-created resources into Terraform state without any downtime.

Self-hosted AWS/EKS platform for a rental-listings scraper

A full-stack scraper that aggregates Bratislava apartment listings from rental sites and Telegram channels, plus the Kubernetes platform underneath it.

• ›It normalizes heterogeneous listing sources into a single unified dataset.
• ›The platform underneath is Terraform and Helm on EKS, deployed by GitLab CI with OIDC auth and Buildah-built images, with zero-downtime rollouts and secrets encrypted at rest.
• ›Prometheus, Loki and Grafana dashboards and alerts are defined as code, and I documented the autoscaling trade-offs I made to keep cost in check.
• ›A Makefile tears the cluster down and rebuilds it on demand - RDS and S3 persist, compute doesn't - so I can cap spend without risking data.

AI film production platform

In progress: an end-to-end pipeline that turns a text film idea into a finished short.

• ›A stateful Temporal workflow coordinates multiple LLM, image and video vendors, failing over automatically when one is down.
• ›Generation steps are cost-gated before they run, on AWS ECS, RDS and S3, split across separate AWS Organizations accounts.
• ›It's delivered through GitLab CI/CD, with scope tracked in Jira.

This site - identity-gated resume platform

You're on it now: a static resume site whose CV download is behind a real AAA identity gate, not just a link.

• ›Private S3 and CloudFront (Origin Access Control), AWS WAF managed rule groups, ACM TLS and Route 53 are all defined in Terraform, with state locked natively in S3.
• ›The CV download sits behind real authentication: Cognito's Hosted UI federates to Google using Authorization Code + PKCE, so no client secret ever touches the browser, then a Lambda verifies the token, rate-limits downloads to 3 per hour per user, and presigns a 60-second S3 URL.
• ›Every download gets logged to DynamoDB with a 12-month TTL and emailed to me via SNS, and a WAF rate-based rule backstops the endpoint against throwaway-account abuse.
• ›GitLab CI/CD deploys it using OIDC-federated short-lived credentials scoped to only the S3/CloudFront actions it needs, gated by SAST, IaC and secret scanning. CloudWatch alarms watch CloudFront, WAF and Lambda errors, and an AWS Budgets guardrail caps spend - all defined as code.

Technical Support Team Lead

• ›Led a 6-person technical support team delivering enterprise IT support to approximately 1,200 employees, supporting the transition from on-premises Active Directory to a hybrid environment with Azure AD/Entra ID and Microsoft Intune-managed endpoints.
• ›Served as the primary escalation point for high-priority and complex incidents, coordinating resolution across infrastructure, network, security and application teams.
• ›Administered Active Directory, Azure AD/Entra ID and corporate systems: managing users, groups, permissions, authentication and employee lifecycle processes; managed Windows endpoints through Microsoft Intune, including provisioning, configuration, software deployment and updates.
• ›Provided hands-on troubleshooting across Windows/Linux workstations and servers, TCP/IP, DNS/DHCP, VPN, Wi-Fi/LAN and Microsoft 365/Exchange environments.
• ›Led incident response and root-cause analysis for recurring issues, service outages and critical incidents; developed runbooks and coordinated technical teams through resolution.
• ›Improved incident, escalation and knowledge-management processes, reducing repeat incidents through root-cause analysis, standardized troubleshooting procedures and knowledge-base expansion.
• ›Partnered with infrastructure and network engineering teams on change implementation, service maintenance and incident resolution, ensuring effective communication and handover between support and engineering functions.

Technical Support Engineer

• ›First-line support (L1/L1.5) - user requests via ticketing systems, phone, email and chat against client SLAs.
• ›Supported Windows/Linux systems and endpoints, diagnosing OS, application, networking, VPN and connectivity issues on user workstations and occasional server systems.
• ›Administered on-premises Active Directory, managing users, groups, permissions, authentication and employee lifecycle processes - account creation/disabling, password resets, onboarding/offboarding.
• ›Troubleshot TCP/IP, DNS, DHCP, VPN, Wi-Fi/LAN and remote-access issues (RDP, TeamViewer), performing initial root-cause analysis and escalating complex infrastructure incidents to L2/L3 teams.
• ›Supported Microsoft Exchange and Office services, investigating authentication, mailbox, connectivity, synchronization and application-related issues across Outlook, Teams, SharePoint and OneDrive.
• ›Performed endpoint provisioning and configuration, including OS/software installation, device setup, access configuration and lifecycle management for new and departing employees.
• ›Incident and request management per ITIL - classification, prioritization, escalation to L2/L3 teams, SLA tracking, ticket documentation and technical handovers.