Sebastian Malieni

Cloud Engineer (Contract) · Uramielo Producciones

A platform where independent filmmaker Uramielo Producciones will sell and stream their own film directly to viewers. Built together with a senior cybersecurity architect; launching soon.

• Designed the architecture: one CloudFront distribution serving the public site, private video and a serverless API (Lambda + DynamoDB), with no servers to manage. All infrastructure defined in Terraform.
• Separated environments with Terraform workspaces: dev in a sandbox AWS account, prod in the client's account.
• Locked S3 and Lambda origins behind Origin Access Control, so nothing is reachable except through CloudFront.
• Designed access control for paid content with CloudFront signed cookies (RSA key pair, trusted key group), keeping the signing key in SSM SecureString behind narrowly scoped IAM.
• Diagnosed a SigV4 signing failure between CloudFront and Lambda on requests with a body, confirmed the root cause in AWS documentation, and planned an API Gateway front for the payment webhook.

DevOps Engineer (Freelance) · Fundación Huésped

Infrastructure for a Buenos Aires HIV/AIDS research NGO that tracks biological samples across freezers and liquid nitrogen storage.

• Containerized a legacy PHP/Apache application tracking biological samples and delivered it to the foundation, ready to deploy.
• Replaced a manual, fragmented setup with a single-command Docker Compose deployment (web, database, backup).
• Isolated MariaDB on an internal-only network, applied least-privilege credentials, and kept secrets out of the repo with .env templates.
• Added automated daily database backups with 7-day retention.
• Set up GitHub Actions to validate Docker builds and Terraform on every push.
• Proposed a low-cost AWS migration (EC2 + Nginx) and delivered the Terraform for it.

Built with and mentored by a senior cybersecurity architect.

• Built a physical server from scratch and connected it to the internet through a business fixed IP (Movistar), bridged to a MikroTik L009 router.
• Configured PCIe passthrough of two NVIDIA RTX A5000 GPUs to a dedicated VM on a new 1 TB NVMe, used for local LLM inference and low-latency remote streaming (Sunshine).
• Built a WireGuard hub-and-spoke VPN with VLAN segmentation and strict inter-VLAN firewall rules on RouterOS.
• Deployed a K3s cluster for self-hosted services, with persistent volumes and Nginx Ingress; Ansible playbooks for VM provisioning.
• Monitor hosts, containers and uptime with Prometheus, Loki, Grafana and Uptime Kuma, with alerting; the stack runs in its own VM so it survives cluster maintenance.

• GitHub Actions pipeline that type-checks and builds a SvelteKit site, then deploys only the compiled output from a private repo to a public GitHub Pages repo.
• Used npm ci, dependency caching, pinned action versions, and a token scoped to the deploy repo only.