Zhanybek Mamataliev

Cognizant · Senior DevOps Engineer

Sep 2019 – Present · Remote

• Leadership advisory. Advise senior engineering leadership across architecture, software engineering, and AI/ML on the internal and external tooling their organizations depend on, using real production scenarios to shape solution and implementation decisions. Mentor 30+ engineers on ticket handling and application security.
• Delivery path. Architected the shared delivery path and drove its adoption (Jenkins, CodePipeline/CodeBuild, GitHub Actions, and Harness) with SonarQube and Nexus IQ gates and automated promotion rollback; 50+ microservices ship on it and deployment lead time fell 40%.
• Supply chain. Architected software supply-chain governance for 6,300+ developers: Hugging Face, npm, Maven, and PyPI intake through governed Nexus proxies and Firewall rules, per-application SBOMs, Checkmarx One gates, and automated fix pull requests (Golden PRs).
• Artifact platform migration. Owned the zero-downtime move of the artifact platform behind 7,000+ applications to AWS end to end (parallel blue-green environments, checksum-validated artifacts, rollback held open through cutover) at 99.99% availability; then cut its storage spend 98% with automated S3 versioning and lifecycle tiering.
• Reliability. Established platform SLAs and SLOs with automated canary rollback, and connected ServiceNow ticketing and incident diagnostics through Model Context Protocol (MCP) integrations, reducing MTTR across multi-cluster Kubernetes.
• Multi-cloud. Led the move of 20+ applications from on-premises to AWS, Azure, and GCP onto one Kubernetes release model (EKS, GKE, and AKS with Helm, ArgoCD, RBAC, and network policy) on standard network baselines and Terraform/CloudFormation infrastructure.
• Release promotion. Replaced manual UDeploy release steps with compliant multi-environment promotion, artifact lineage, and rollback points.
• AI/ML platform. Brought model workloads onto the platform: governed Hugging Face intake and MLflow/ECR model-registry workflows.
• Wall Street financial advisory platform (2019–2022). Modernized data-center infrastructure and release automation for a Wall Street asset-management project running investment and financial advisory systems.

EPAM Systems · Senior DevOps Engineer

Nov 2018 – Sep 2019 · Oil & Gas IoT · Remote

• Supported an Oil & Gas IoT program aggregating subsea pipeline telemetry; deployed its data services on Kubernetes with custom Helm charts and namespace isolation.
• Provisioned environments with Terraform and Ansible and built delivery pipelines and alerting for data-processing services.

NDA Asset Management · Systems Engineer

Jul 2015 – Nov 2018 · On-site

• Built Terraform modules for AWS, cutting environment setup time 60%, and managed Ansible configuration and patching across 100+ servers.
• Automated Jenkins build, test, and deploy pipelines for same-day releases, eliminating 70% of manual configuration.

INTERPOL · Systems Engineer

Apr 2012 – May 2015 · On-site

• Integrated regional web tools with the I-24/7 global communication system and tuned criminal-intelligence query performance.
• Handled security patching, vulnerability remediation, and RBAC/identity management under INTERPOL IT security standards.

01 · Zero-downtime Nexus migration

Assessed application dependencies on the Nexus repositories first, then built parallel AWS infrastructure on EC2, S3, and RDS and cut over with a blue-green DNS switch. Artifact integrity was checksum-validated across environments and rollback stayed available through the live traffic switch: 99.99% availability, no migration downtime. Automated S3 versioning and lifecycle tiering cut Nexus repository cloud-storage spend by 98%; the platform now supports 7,000+ dependent applications.

02 · A paved road for 50+ services

Mapped how 50+ services actually reached production, then replaced the per-team paths with reusable CodePipeline and CodeBuild templates carrying SonarQube and Nexus IQ gates and promotion gates with automated rollback. Lead time fell 40%, and every service now clears the same checks.

03 · Multi-cloud migration factory

Classified workloads by cloud suitability (cost, latency, compliance) before moving any of them, then migrated 20+ applications from on-premises to AWS, Azure, and GCP on reusable Terraform modules per provider. ArgoCD GitOps workflows handle multi-cluster delivery; network peering, VPN, and security group configurations were validated per environment.

04 · One operating model for four Kubernetes estates

Standardized cluster bootstrap with eksctl, gcloud, and az CLI automation, built a unified Helm chart library for microservice deployments, and drove multi-cluster GitOps with ArgoCD ApplicationSets across EKS, GKE, AKS, and on-premises OpenShift. Prometheus + Grafana federation covers cross-cluster observability; network policies, RBAC, and OPA Gatekeeper are enforced on every cluster.

Agent Orchestration TUI (private build)

Human-in-the-loop cockpit for AI coding agents: Claude plans, Codex/OpenAI writes, DeepSeek reviews, and nothing touches the repo until a human approves the patch. Repo-aware runs with live streaming and durable SQLite history.

Python · Textual · LangGraph · SQLite · Langfuse

ReadThePlan (public MIT release v0.4.0)

A guardrail for infrastructure changes: classifies every Terraform/OpenTofu plan as safe, review, dangerous, or irreversible before apply. Shipped as a CLI and GitHub Action with documentation and a browser playground.

github.com/readtheplan/readtheplan

ADR 001 Cut Nexus over blue-green, not in place

Context

Nexus Repository and Nexus IQ sit in the build path of 7,000+ dependent applications. Moving them to AWS could not break builds or strand artifacts.

Decision

Stand up parallel AWS infrastructure on EC2, S3, and RDS, checksum-validate every artifact across environments, then switch traffic with a blue-green DNS cutover while the old environment stays live for rollback.

Alternatives

An in-place migration inside a maintenance window, or moving repositories one at a time behind mixed routing.

Tradeoff accepted

Two full environments run in parallel for the migration window. That cost buys an instant, rehearsed rollback path.

Outcome

Zero-downtime cutover with 99.99% availability maintained. Automated S3 versioning and lifecycle tiering then cut Nexus cloud-storage spend by 98%.

ADR 002 Route every public package and model through one governed proxy

Context

A platform team serving 6,300+ developers pulls from Hugging Face, npm, Maven, and PyPI. Each direct download is an unreviewed supply-chain entry point.

Decision

Serve all four ecosystems through Nexus proxies, with Nexus Firewall controlling what is ingested and Nexus IQ producing SBOM reports for what is consumed.

Alternatives

Let builds reach the internet and scan afterwards, or maintain allowlists team by team.

Tradeoff accepted

The proxy becomes critical shared infrastructure on every build path, which is why its migration was designed around rollback (ADR 001).

Outcome

Dependency and model intake is governed at one point, and each application has an SBOM instead of an unknown dependency tree.

ADR 003 Ship vulnerability fixes as pull requests, not tickets

Context

Nexus IQ and Checkmarx One surface vulnerable dependencies faster than owning teams can research and patch them.

Decision

Generate automated vulnerability-fix pull requests (Golden PRs) and enforce Checkmarx One gates in source control.

Alternatives

File findings as tickets for each owning team to investigate.

Tradeoff accepted

The platform team owns the fix automation and has to keep the pull requests it opens small, correct, and mergeable.

Outcome

Remediation arrives as a reviewable diff inside the normal delivery flow instead of as a backlog item.

ADR 004 One delivery template with gates, not a pipeline per team

Context

50+ microservices each carried their own path to production, with inconsistent quality and dependency checks.

Decision

Provide reusable CodePipeline/CodeBuild templates, alongside Jenkins, GitHub Actions, and Harness workflows, with SonarQube and Nexus IQ gates and environment promotion gates with automated rollback.

Alternatives

Keep bespoke pipelines and publish a checklist.

Tradeoff accepted

A change to the template reaches every service at once, so the template is changed with the same care as production.

Outcome

Deployment lead time fell 40% across 50+ microservices, with the same gates in front of every service.