Xavier G. Lopez

Platform Engineer | Kubernetes | DevSecOps | OpAI

Summary

I help teams build and operate cloud-native, regulated environments where cloud infrastructure, Kubernetes runtime behavior, workload identity, SSO, network pathing, telemetry, certificate trust, policy controls, and the operating model combine to make secure workload delivery and operation the default path.

My work spans the full platform loop: define the platform model, build the path, operate the system, and feed what breaks back into the design so delivery and operation become understandable, repeatable, and easier for teams to use.

Technical Skills

Cloud & Infrastructure

GovCloud operations, account and environment boundaries, IAM, network controls, repeatable provisioning, module design, and automation.

Kubernetes & Runtime Operations

Control-plane behavior, workload rollout paths, desired-state management, ingress/routing, registry flows, secrets handling, and multi-environment operations.

Security & Compliance

DoD ATO environments, TS, Security+, NIST-aligned practices, vulnerability handling, SBOMs, rootless build posture, reviewable controls, and audit-friendly handoffs.

Identity & Observability

SSO, OIDC, SAML, JWT, workload identity, telemetry, logs, metrics, operational visibility, incident response, failure-mode analysis, and platform governance.

Software, Data & OpAI

API design, container build systems, data services, ETL workflows, AI-assisted infrastructure work, documentation, automation planning, and operational support.

ZaveStudios

ZaveStudios is where I turn my platform thinking into working infrastructure outside an employer environment. It is my internal developer platform sandbox: an opinionated platform architecture designed to make infrastructure predictable, composable, and easier to operate through bounded declarative contracts.

ZaveStudios

Independent platform practice

  • Building and refining a multi-workload reference platform where workload contracts declare intent and shared platform paths handle validation, build, promotion, runtime state, and governance.
  • Writing and maintaining the operating doctrine so repository boundaries, lifecycle rules, diagnostics, enforcement, and pull-request behavior are explicit instead of tribal.
  • Moving delivery mechanics into platform-owned workflows so workload repositories inherit the path instead of rebuilding it each time.
  • Treating tenant data boundaries, GitOps state, identity, and telemetry as part of the platform design, not cleanup work after deployment.
  • Using agent-assisted workflows for documentation, triage, code generation, and automation planning with reviewable human/agent attribution boundaries.
  • Keeping the platform in formation phase: clarifying the contract surface, tightening the operating model, and making the supported path easier to consume over time.

Experience

SAIC

Platform Engineer · Federal Defense Program · May 2026 – Present

  • Contain platform entropy by making control-plane behavior more legible, maintainable, and supportable across cluster state, identity, network boundaries, policy controls, and cloud-broker access paths.
  • Own AWS Security Hub remediation paths by separating team-owned findings from managed baseline controls and driving remediation, suppression, or escalation through supportable ownership paths.
  • Work with cloud-broker teams and vendor support to turn access, certificate-trust, RBAC, and network-inspection requirements into deployable Kubernetes configuration, secrets, documented steps, and Flux GitOps scaffolding for the stabilized path.
  • Own the nested GovCloud platform path from AWS account infrastructure to EKS to Spectro Palette Vertex to Domino Data Lab, where each layer becomes the control surface for the next layer of self-hosted AI/ML training operations.
  • Coordinate vendor support and product engineering to resolve blockers across deployment artifacts, manifests, RBAC, values files, scripts, private ECR/S3 paths, and cloud-broker constraints.
  • Lead Bedrock Mantle service development for GovCloud model inference and daily team development use through Terraform provisioning, provider/model/agent configuration, cost awareness, documentation, and operational handoffs.

Raft, LLC

Senior Platform / DevSecOps Engineer · Reston, VA · Jan 2024 – Nov 2025

  • Contributed to platform architecture for DoD ATO’d environments supporting internal engineering teams and tenant workloads.
  • Rebuilt AMI workflows around AWS Image Builder so remediation became part of the image lifecycle instead of a separate cleanup path.
  • Built an external-image approval pipeline with vulnerability scanning, cybersecurity review routing, internal registry promotion, audit-friendly handoffs, and notifications.
  • Led rootless build migration from Kaniko to Buildah and designed Terraform module boundaries and CI policy gates.

Charter Communications

Configuration Management / Automation Consultant · Independent Consultant · Jan 2024 – Apr 2024

  • Translated legacy Chef configuration workflows into structured Ansible roles and playbooks for repeatable infrastructure operations.
  • Standardized inventory layering, service-state management, validation, and idempotence checks.

Insight Direct

Platform Lead / DevOps Engineer / SRE · Chandler, AZ · Jul 2018 – May 2023

  • Led the organization’s Kubernetes strategy from research and decision framing through bare-metal and hybrid-cloud EKS delivery.
  • Built the team’s first CI/CD pipelines and Kubernetes deployments, moving release work out of manual operations and into a repeatable delivery path.
  • Improved cloud cost profile through migration strategy, rightsizing, and operational cleanup.

Earlier engineering work

Juniper Networks · Datalink · DST · 2012 – 2018

  • Delivered network automation and customer training, introduced DevOps and configuration-management practices across .NET and Rails stacks, and began in data extraction and transformation workflows.

Education & Credentials