Jeffrey Paul Nelson

What I’m best at: Troubleshooting - I dig into production problems and stay with them until the root cause is clear. I’m adaptable: new tech is what energizes me, and I learn and integrate it into real systems (multi-cluster EKS, ArgoCD GitOps, Crossplane platform work, and systems fundamentals). I’m a proactive teammate on issues - I prefer architecture and observability that surface problems before a ticket has to be filed.

Senior Site Reliability Engineer with 20+ years of infrastructure experience spanning the full stack: physical datacenter operations, enterprise networking, Windows and Linux systems administration, database administration across four engines, and, over the last several years, modern cloud and Kubernetes-based platform engineering. 15 years at RW3 Technologies (2006-2021) building and owning on-premises infrastructure end to end, including a self-hosted ELK Stack built from scratch, enterprise network hardware, Active Directory, VDI, and dev-tooling infrastructure. Following RW3's acquisition by Wiser Solutions (January 2022), continued multi-site infrastructure ownership across three datacenters while moving into cloud/SRE work: AWS EKS, Terraform, a Crossplane self-service platform (internally named "Wiser Autopilot"), ArgoCD GitOps, and production incident response. As Wiser's datacenter footprint changed, Chicago was decommissioned, Austin was handed over as-is to an acquiring company (advised through the transition), and Toronto continued operating; day-to-day work shifted toward cloud platform engineering while systems depth stayed real.

Core Competencies

Professional Experience

Senior Site Reliability Engineer

Wiser (acquired RW3 Technologies): Austin, TX

2022 – 2026

Continued multi-site, multi-datacenter infrastructure ownership through acquisition and wind-down while shifting into cloud/SRE and platform engineering work as the datacenter footprint changed.

Owned multi-site infrastructure across three datacenters (Austin, Chicago, Toronto): physical infrastructure, storage, networking, and capacity planning, including Cisco Meraki with site-to-site AWS tunnels in Chicago and SonicWall firewall infrastructure in Toronto. Chicago's footprint ran on roughly 20kW of negotiated power capacity (about 5kW/rack, standard enterprise density); consolidated 5 racks down to 1 specifically to cut power costs.
Led Chicago's infrastructure decommission end to end: equipment sale, physical removal, and tearing down the site-to-site VPN endpoints and routes via Terraform/Atlantis, six figures in recovered capital. Separately, advised the acquiring company through Austin's ownership transition (handed over as-is, not decommissioned) over several months. Toronto continued operating as keep-the-lights-on support.
Operated AWS infrastructure broadly: EC2, networking (VPC, Transit Gateway, Site-to-Site VPN), and Kubernetes (EKS), not limited to any one layer of the stack.
Built a self-service Crossplane platform on AWS EKS (internally named "Wiser Autopilot") as part of a small SRE team, so application engineers could provision app-level infrastructure (e.g. RDS) from YAML claims instead of writing Terraform; the SRE team retained Terraform ownership of network/cluster infrastructure. First-pass compositions were generated with AI assistance scanning existing Terraform modules; the team's work was auditing, CI-gating, packaging, and hardening them for production.
Created the Crossplane package structure (versioned OCI images) for the platform's core XRDs, enabling independent versioning per composition and CI-gated releases.
Authored a GitHub Actions CI/CD pipeline for Crossplane composition testing and deployment: PR-time render tests, release-time validation via an ephemeral k3d cluster, staged deployment to a sandbox environment before production.
Independently researched and implemented Kyverno-Chainsaw (declarative Kubernetes-native testing tool) into the composition test pipeline.
GitOps delivery with ArgoCD: operated and troubleshot application sync across multi-cluster EKS (sync blockages, immutable field conflicts, chart upgrades validated per-service).
Led a GitHubTeamRepo v1-to-v2 Crossplane migration: rehearsed delete/reapply on real team repos, fixed a composition team-permission issue, cut over seven production claims to namespaced XRDs via versioned packages, verified zero accidental commits.
Independently led an EKS Hybrid Nodes proof of concept (Chicago): evaluated Proxmox before selecting KVM, then extended EKS to on-prem hardware using KVM-hosted nodes, Cilium CNI, and a VPN to the private EKS API, handling the networking configuration so AWS's control plane could manage the on-prem nodes. Validated the technical approach; the business ultimately chose to migrate the remaining datacenter workload to the cloud platform rather than operate hybrid long-term.
Executed EKS core-services upgrades: owned the Traefik v2-to-v3 Helm migration (breaking schema changes, resolved a CrashLoopBackOff on first deploy) and upgraded an inherited kube-prometheus-stack deployment as part of the same initiative, validated in sandbox before production rollout; observability was later migrated to OpenTelemetry/Coralogix.
Built Grafana dashboards and log-based alerting on Coralogix, giving engineering teams real-time visibility into their services.
Owned incident response end to end: diagnosed and resolved a production auth-service outage caused by a Kubernetes Service selector conflict (cleared an ArgoCD immutable-field block, flagged the chart design flaw for a pre-merge guardrail); restored a CI/CD pipeline after an expired-credential failure, rotating affected secrets and documenting blast radius across three teams; diagnosed and fixed a full Airflow service outage traced to a database connectivity failure (infrastructure-level, not DAG-level troubleshooting).
Investigated a cost-cleanup discrepancy: found that DLM was regenerating EBS snapshots and a scanner was inflating savings estimates 15-20x; corrected the projections reported to management.
Removed unused Route53 Resolver endpoints across accounts/regions via Terraform/Atlantis; extended the module so inbound/outbound resolver creation is optional.
Built nOps showback reporting and tag-based allocation rules so management could see accurate infrastructure spend by team, closing about 70% of a team cost-allocation gap over 30 days; used that visibility to identify and flag numerous untagged and unused resources for decommissioning. Also contributed to the underlying Spotinst-to-Karpenter migration, removing legacy nodeSelectors/scale-down annotations across workloads.
Remediated cloud security posture findings from Orca Security (AWS/EKS vulnerability and misconfiguration remediation), working directly with the security team.
Built an Ansible server from scratch ("Ansible the hard way," built manually rather than from pre-packaged roles) as a modernization initiative for on-prem VM configuration management; a real, working prototype that never went to production, shelved when the business chose full cloud migration over continued on-prem investment.
Prototyped a Terraform-deployed NetBox instance on AWS for network/IPAM documentation, built and tested but not adopted into production.
Supported Microsoft SQL Server VMs (infrastructure-level, not database administration); worked directly with PostgreSQL (connecting in, adding/removing tables, editing data when needed); managed MongoDB via Cloud Manager (MCM) agents, troubleshooting primary/secondary replica set issues, plus MongoDB Atlas experience.
Assisted an acquired company's team with GCP environment support before the company was divested; also has hands-on exposure to DigitalOcean. Used HashiCorp Vault for secrets management.
Used NinjaRMM for a period to monitor EC2 instances and on-prem servers.
Built Python automation for infrastructure tooling and operational dashboards, increasingly with AI-assisted development.
Evaluated incident-tooling alternatives (FireHydrant, Incident.io, Better Stack) against PagerDuty and presented findings to leadership.

Senior Systems Administrator

RW3 Technologies (acquired by Wiser): Austin, TX

2006 – 2021

Joined RW3's IT team in 2006; became the primary hands-on infrastructure person as the company downsized through layoffs, with support from one newer IT hire (not solely alone, and not from day one).

Owned Active Directory end-to-end: full tree/OU structure and user management, with database machine access gated through AD security groups. Also did AD-related work tied to the company's Chicago datacenter alongside the primary Austin site. Built a pfSense-based lab environment to test AD network configurations outside of production.
Owned production infrastructure end to end: ~200 VMs on multi-vendor SAN (Nimble, EqualLogic, Compellent), Windows Server, Linux, IIS and Apache web servers, enterprise network hardware (Cisco, Dell Force10, HP, and Brocade switches), Astaro/Sophos firewalls, Cisco wireless, and a ShoreTel VOIP system.
Led network and storage upgrades, including a 10GbE build-out giving the virtualization cluster a dedicated iSCSI backbone.
Performed routine P2V (physical-to-virtual) server migrations as ongoing practice, consolidating physical infrastructure onto fewer virtualization hosts over time; full datacenter rack relocation within a 24-hour window.
Set up and administered a VMware View (Horizon) VDI environment (2012-2015): image management, connection brokers, and pool provisioning for the end-user desktop environment.
Built and personally installed hot/cold aisle containment in the office server room, which also ran an APC air handler and a Liebert UPS; used APC PDUs across both datacenter and office server racks.
Extensive out-of-band management experience: iDRAC (Dell) and Supermicro IPMI/BMC interfaces.
Administered Microsoft SQL Server with real depth: replication setup, job troubleshooting, permissions, and app-to-database error debugging. Also worked directly with MySQL (connecting in, adding/removing tables, editing data when needed).
Set up an Azure-to-on-prem network tunnel and supported running some databases in Azure as part of a cost-evaluation project pricing out an on-prem-to-Azure migration (this predates the Wiser acquisition).
Owned Team Foundation Server (TFS) for the development team: kept the server/service running and provisioned developer access; troubleshot build definitions and build agents whenever developers ran into issues.
Managed .NET SDK versions across developer machines and CI runners, including version pinning, so teams on different .NET versions didn't collide, and kept machine images in sync.
Standardized developer machine provisioning: imaged dev machines with Altiris, later Clonezilla; built and deployed Visual Studio install packages via Altiris across the development team.
Designed, built, and administered a self-hosted ELK Stack (Elasticsearch, Logstash, Kibana) with Filebeat/Metricbeat agents fleet-wide; ran Splunk earliest, and Graylog as a second log aggregation platform. Earlier still, set up and maintained Watchtower, an SNMP-driven monitoring platform.
Used the SolarWinds suite (Virtualization Manager, including its VMware-to-AWS cost analyzer to model the savings of staying on-prem versus migrating to AWS; NetFlow Traffic Analyzer, IP Address Manager, Ping Monitor) and CheckMK/Nagios/Zabbix for day-to-day infrastructure monitoring. Used ntop to track network activity and Wireshark for network troubleshooting.
Mentored a junior IT team member in the company's final years, when the IT team was down to just the two of them, real, sustained informal leadership, not a one-off.
Senior-level Tier-3 incident response for critical production systems.

Technical Skills

Systems	Windows Server, Linux, Active Directory (full tree/OU/user ownership, on-prem only)
Networking	Cisco, Dell Force10, HP, and Brocade switches; Astaro/Sophos, SonicWall, and Cisco Meraki firewalls; Cisco wireless; ShoreTel VOIP; VLANs, tunnels, site-to-site VPN, 10GbE/iSCSI; DNS/DHCP/routing
Virtualization	VMware vSphere (~200 VMs), VMware View/Horizon VDI, KVM (hybrid cloud networking context)
Cloud	AWS (EC2, EKS, VPC, TGW, Site-to-Site VPN, RDS, ALB/NLB, IAM), Azure (networking, cost-evaluation), GCP (support-level), DigitalOcean (hands-on exposure)
Kubernetes & Platform	EKS, Crossplane v2 (XRDs, Compositions, OCI packaging), Helm, Karpenter, KEDA, Kyverno, Cilium, Traefik, Docker
CI/CD & GitOps	GitHub Actions, ArgoCD, Team Foundation Server / Azure DevOps
IaC & Automation	Terraform, Terragrunt, Atlantis, Python, PowerShell, Bash; built an Ansible server from scratch (prototype, not adopted into production)
Observability	Splunk (earliest, RW3), ELK & Graylog (built/operated), CheckMK, Nagios, Zabbix, NinjaRMM (Wiser), SolarWinds, Watchtower (SNMP), Prometheus, Grafana, Coralogix, OTEL
Databases	Microsoft SQL Server (replication, job troubleshooting, permissions, RW3), MySQL (RW3), PostgreSQL (Wiser), MongoDB (Cloud Manager, Atlas, Wiser)
Security	Orca Security (AWS/EKS vulnerability and misconfiguration remediation), HashiCorp Vault (secrets management)
Facilities & Hardware	Server/switch/SAN install and troubleshooting, OOB/IPMI (iDRAC, Supermicro), APC PDUs, hot/cold aisle containment, power/capacity planning
Developer Tooling	.NET SDK version management/pinning, Visual Studio deployment via Altiris, dev machine imaging (Altiris, Clonezilla)
Incident Management	On-call, root-cause analysis, runbooks, production troubleshooting, PagerDuty

Education

Austin Community College: Associate of Arts, General Studies Liberal Arts, all requirements complete per degree audit, conferral expected December 2026 pending formal registrar processing. Texas State University: Bachelor of Applied Arts and Sciences coursework (2007-2011), 9 hours remaining per OWLS, not yet completed.

Professional Summary

Core Competencies

Professional Experience

Technical Skills

Education