12+ years in corporate IT infrastructure. Started in user support and sysadmin work at an MSP, grew into a systems architect covering the full stack — from bare metal and networks to AI agents in production. Equally comfortable building infrastructure from scratch, automating complex business processes with agent-based systems, and shipping LLMs into real workflows.
I work by simple rules: understand why the business needs it first, have a rollback plan before any change, and document after — so the system outlives my involvement. My soft spot is legacy that “must not be touched”: I enjoy getting it to a state where touching it isn’t scary.
Systems, identity and mail
I build the core of corporate infrastructure and keep it running for years — from hypervisor to mail and single sign-on.
VMware ESXivCenterProxmoxVeeamMS Exchange (DAG)PostfixDovecotmailcowPMGAD DSAD CSAD FSDFSWSUSWECSCCMRDS+FSLogixKeycloakZabbixTelegrafInfluxDBWindows Server
Networking, proxies and security
I tie sites into one managed fabric and hold the perimeter: routing, VPN, reverse proxies, event analytics.
4 sites in 2 countries · 100–200 users · 50+ servers · mail/AD/networking + cert automation, built solo turnkey
Designed and built corporate infrastructure for a large client from scratch: AD, Exchange with DAG between sites, mail pipeline via PMG + HAProxy with SNI routing, multi-site routing on WireGuard + GRE + OSPF + FRR, MikroTik RouterOS 7, ACME → Exchange cert automation pipeline. Audit-grade message tracking, BookStack for internal docs. End-to-end ownership, no handoffs.
Windows Server 2008 → 2022, three sites, multi-site replication, merged domains
Moved the legacy AD forest onto a current version and a unified structure: role distribution across three sites, object migration from multiple domains into one, predictable replication, and reduced operational risk.
Active DirectoryWindows ServerDNSDHCPSites & Replication
Active Directory hygiene: GPO audit and repair
Operational audit and repair of GPO/ACL on a large legacy forest, phased rollback-safe rollout
Ran operational audit and repair of GPO and ACL across a large legacy AD forest: 17 PowerShell scripts to detect broken policies, restore Security Filtering after a mass downgrade to Authenticated Users, cleanly remove stale NetLogon ACEs via pre-flight checks and phased rollout (Phase 1/2/3). Every change had a backup and rollback path. Final reports across hundreds of GPOs.
2FA / SSO for corporate mail with Keycloak + ANGIE
Custom Keycloak-based 2FA provider, SSO at the web-server layer for OWA and Outlook clients
Designed and rolled out a custom Keycloak-based 2FA provider for corporate mail access. ANGIE sits in front of OWA and Outlook clients and handles SSO at the web-server layer. 2FA runs on the Keycloak side without touching Exchange internals. Running in production today, handling all corporate mail traffic.
Consolidated virtualization on VMware, converted VMs from Hyper-V, brought up vCenter 7, and operated a fault-tolerant vSphere cluster. Worked alongside a vCloud Director-based cloud.
VMware ESXivCenterHyper-VProxmoxvCloud Director
Distributed Veeam and DRP
Backup on three sites, automated config backups, DRP
Built a distributed backup system across three sites: full Veeam coverage for VMs, automated backups of network equipment configurations, and a documented disaster recovery plan.
Veeam B&RSynologyTrueNASNextCloudrsync
Office-to-DC networking
Site-to-site IPSec, redundant channels, ~66% lower internet cost
Connected multiple offices and two data centers into a single managed environment via site-to-site IPSec VPN, rebuilt channels to the DCs on MikroTik and OpenVPN, and reworked network equipment — dropping internet connectivity costs by roughly two-thirds.
MikroTikUbiquitiTP-LinkIPSecOpenVPNVLAN
Zabbix + Grafana and automation
Unified monitoring with branch proxies and routine work automated
Set up Zabbix with proxies in remote networks and Grafana dashboards for fast diagnostics. Automated typical admin tasks with Python, PowerShell, and Bash scripts, and deployed services in Docker / Docker Compose.
ZabbixGrafanaPythonPowerShellBashDocker
Automation & AI agents
Multi-agent workflow for solo development
3 specialized AI agents + MCP Memory Server: spec, code, and review without context-switching
Designed and built a multi-agent workflow for solo development of a complex system: three specialized AI agents (strategic consultant · knowledge-vault keeper · in-IDE developer) communicate through an MCP Memory Server and a shared knowledge layer. Each agent has its own role, constraints, and context; the vault stores ADRs and decisions; the memory server carries working context and subsystem state.
Live LLM conversation with customers over a cloud PBX, retrieval over KB, escalation on ambiguity
Built a voice agent answering customer questions in real time, sourced from a knowledge base and product catalog, over a cloud PBX. The realtime model holds a natural conversation, pulls answers from a retrieval layer over the KB, and escalates to a human on ambiguity. Not post-call analysis of recordings — the LLM is on the line with the customer in real time.
OpenAI Realtime APISIPCloud PBXRAGPython
LLM call analysis and BI/CRM pipeline
BI exports from the virtual PBX and automatic GPT-4 call review
Ran the corporate PBX and Megafon virtual PBX, optimized mobile and internet costs. Wrote Python exporters that fed BI and integrated GPT-4 to analyze call content with a report pushed back into the CRM.
AsteriskFreePBXMikoPBXMegafon PBXPythonChatGPT API
Experience
October 2023 — Present
Staff Infrastructure Engineer
Detsky Mir (large retail chain, ~30K employees)
📍 Moscow
Modernization of corporate infrastructure at enterprise scale: Linux stack overhaul, AD forest across three countries, VMware estate.
Production monitoring built from scratch to prod-ready coverage across thousands of objects: custom templates, proxy fleet across branches, automated agent deployment in stores.
Source of truth for the whole infrastructure auto-populated by Ansible / Bash / PowerShell scanners and synced from virtualization platforms; agents and configs roll out from the source of truth.
Reverse-proxy layer for critical corporate services: load balancing, SSO at the web-server layer for corporate mail.
2024 — Present
Solutions Architect · engagement
Enterprise client (NDA)
📍 Moscow
Designed and built corporate infrastructure from scratch: AD, Exchange + DAG.
Multi-site routing on WireGuard + GRE + OSPF + FRR, MikroTik RouterOS 7.
Mail pipeline via PMG + HAProxy with SNI routing.
ACME → Exchange cert automation pipeline. In parallel with primary role.
June 2021 — September 2023
Head of IT
Leto Realty (real-estate group, 2 countries / 4 offices)
📍 Sochi
Owned the IT function end-to-end: budget, vendors, procurement, contracts.
HA RDS farm, FSLogix, virtual PBX, internal network on MikroTik / TP-Link / UniFi.
Site-to-site IPSec VPN between offices and data centers, DC uplinks on MikroTik and OpenVPN.
Infrastructure across two countries: two DCs and 4 remote offices.
Hyper-V → ESXi migration, ESXi 5 → 6.7 upgrade, vCenter 7 rollout, distributed Veeam across three sites.
AD upgrade from Windows Server 2008 to 2022 and domain consolidation.
Deployed and ran MS Exchange, WSUS, Zabbix, OpenVPN, Nextcloud, WTware thin clients.
Python automation and GPT-4-based call analysis with reports pushed into the CRM.
Cut internet connectivity costs by roughly two-thirds.
Mentored three system administrators in remote offices.
June 2020 — May 2021
Senior System Administrator
Digital Systems (regional cloud and managed-services provider)
📍 Sochi
Designed and operated a fault-tolerant VMware cluster on ~15 bare-metal servers (vSphere 6.7–7).
vCloud Director-based cloud and a distributed backup system.
Windows and Linux: CentOS, Ubuntu Server, Debian; Hyper-V, ESXi, Proxmox.
