Adam Kierat
I build the infrastructure that never makes the headlines.
Tech Lead / Cloud Architecture / Platform Engineering
From zero infra to 90+ services
in under three years
I took Beesafe from zero infrastructure to 90+ production microservices on AKS — and now own every technical decision from network topology to deployment strategy.
As Infrastructure Tech Lead, I architected the entire cloud platform from scratch: Kubernetes clusters, GitOps pipelines, full observability stack, and zero-trust security. The result? ~30% cloud cost reduction, 15+ daily automated deploys, and a platform that lets development teams ship without opening infrastructure tickets.
My path: Linux administration at Kyndryl, cloud migration at ING, then building everything from the ground up at Beesafe. Each step was about going deeper into platform ownership.
name: Adam Kierat
role: Infrastructure Tech Lead
location: Gliwice, Poland
education:
degree: BSc Computer Science
university: Silesian University of Technology
languages:
- Polish # native
- English # C1
interests:
- Cloud Architecture
- Platform Engineering
- Infrastructure Automation
status: operational # 99.9% uptime
Numbers That Matter
Quantified results from production
Credentials
git log
--oneline --graph
Infrastructure Tech Lead @ Beesafe
Warszawa (remote from Gliwice) HEAD
Promoted from DevOps Engineer to Tech Lead. As sole infrastructure engineer, architected the entire cloud platform from zero — now serving 90+ production microservices and the Guidewire insurance platform across Azure.
- + Architected the entire cloud platform from zero — AKS clusters, GitOps pipelines (ArgoCD + GitHub Actions), observability stack (Prometheus, Mimir, Grafana, Loki), and secrets management (Vault)
- + Own all technical decisions across infrastructure, security, and deployment strategy, establishing engineering standards adopted by all development teams
- + Reduced Azure cloud spend by ~30% through spot instance strategies, reserved capacity, and resource right-sizing
- + Designed zero-trust security architecture with Cloudflare WAF, K8s network segmentation, and Vault — zero security incidents since implementation
- + Increased deployment frequency from weekly manual releases to 15+ automated deploys/day via ArgoCD and Terraform
Junior DevOps Engineer @ ING Hubs Poland
Katowice
Managed production, staging, and development environments across enterprise middleware. Led migration of customer applications from on-premise to ING Private Cloud. Transitioned to Beesafe to architect a greenfield cloud platform.
- + Managed production, staging, and development environments running enterprise Java middleware (IBM WebSphere, JBoss, WebLogic, Apache Tomcat)
- + Led migration of customer applications from on-premise infrastructure to ING Private Cloud, ensuring zero-downtime transitions
- + Built and maintained CI/CD pipelines in Azure Pipelines for automated build, test, and deployment workflows
Junior Linux Administrator @ Kyndryl
Wrocław
Administered Red Hat Enterprise Linux systems in production environments, progressing from L2 to L3 support through demonstrated expertise.
- + Administered Red Hat Enterprise Linux systems in production environments, progressing from L2 to L3 support
- + Developed automation scripts in Bash for disk management, LVM provisioning, network configuration, and service monitoring
- + Resolved complex system issues involving file systems, VLAN configuration, package management, and process control
Production Challenges
Real incidents, details anonymized
Timeline
Root Cause
Entire spot fleet was provisioned in a single availability zone (eu-west-1a). AWS reclaimed all spot capacity in that AZ during a regional demand spike, causing simultaneous termination of all instances.
Resolution
Implemented multi-AZ spread constraints in ASG configuration. Added on-demand base capacity (20%) as fallback. Deployed capacity rebalancing with mixed instance policies across 3+ instance families.
Lessons Learned
- → Never concentrate spot capacity in a single AZ — diversify across at least 3
- → Maintain an on-demand baseline for critical workloads
- → Spot interruption notices (2min) are not enough time for graceful failover without pre-provisioned capacity
Timeline
Root Cause
Self-hosted Prometheus hitting vertical scaling limits at 2M+ active time series. Single-node architecture created a SPOF for all observability. Needed horizontal scalability and long-term storage.
Resolution
Deployed Grafana Mimir in microservices mode with S3 backend. Used dual-write strategy during migration to ensure zero data loss. Implemented recording rules to reduce cardinality by 35%.
Lessons Learned
- → Dual-write migrations eliminate the 'big bang' cutover risk
- → Always validate dashboard query parity before switching read paths
- → Recording rules should be implemented proactively, not as a migration afterthought
Timeline
Root Cause
A new Cloudflare WAF rate limiting rule was deployed without exemptions for internal service-to-service traffic. The rule's threshold was set too low, treating legitimate internal API calls as abuse.
Resolution
Built a WAF rule testing pipeline that validates rules against recorded production traffic patterns before deployment. Implemented canary deployments for security policies — new rules deploy to 5% of traffic first with automated rollback on error rate spikes.
Lessons Learned
- → Security policies need the same CI/CD rigor as application code
- → Internal service traffic must be explicitly allowlisted in WAF rules
- → Canary deployments aren't just for apps — security policies benefit equally
terraform plan
Infrastructure I've Built
Terraform will perform the following actions:
Plan: 4 to add, 0 to change, 0 to destroy.
kubectl exec -it
Let's connect
Skip the terminal? Reach me directly: