Daniel McDonough

Joined a largely manual environment with no formal SLOs, incident metrics, or standardized infrastructure practices. Built the GCP organization that replaced the legacy estate, then moved the platform onto it — networking, identity, databases, Kubernetes, DNS, and on-prem VMware under Terraform, with change flowing through pull requests instead of consoles.

• Built a new GCP organization from scratch — Shared VPC host project, per-environment service projects, HA VPN to on-premises and AWS, Cloud NAT, and organization IAM — replacing a single shared legacy project. GCP / GKE Terraform / Terragrunt Networking Security / IAM
  The architecture separates concerns deliberately: the shared-vpc deployment owns all networking and firewall rules, while a per-project infra module owns IAM, service accounts, CloudArmor, and Workload Identity Federation. Each environment is provisioned from the same modules, so promotions are mechanical rather than artisanal. Documented in a DESIGN.md so the reasoning survives me.
• Migrated the entire legacy GCP estate into the new organization over ~14 months — VMs, buckets, databases, DNS, and Kubernetes workloads — without a big-bang cutover. GCP / GKE Terraform / Terragrunt Networking
  VM migrations snapshot the source and relaunch from the snapshot via Terragrunt in the target project, so the migrated machine is code from the moment it exists. Bucket transfers used Storage Transfer with a temporary-bucket shuffle to preserve bucket names across projects, coordinated with the consuming application teams. VPC peering between old and new organizations allowed services to move piecemeal instead of all at once. QA and UAT environments were created along the way — they had never existed in the legacy project.
• Restructured the core Terraform repository around Terragrunt: reusable environment-agnostic modules, one state file per stack, and a three-layer DRY hierarchy — importing hundreds of live resources per project rather than recreating them. Terraform / Terragrunt GCP / GKE
  The model is 'modules are the code, stacks are the deployments, paths are state keys' — a stack's directory path mirrors its GCS state path, so state location is never a decision anyone has to make. Boolean feature gates default to false, which encodes the environment-validation requirement structurally: a feature lands in lower environments first and higher environments opt in explicitly. Migration ran in waves — ten small projects, then the core infra deployment (~200 imported resources per project), then GKE with its Helm releases, then the AI projects, then VMware. I reviewed every diff.
• Created a DNS-as-code repository replacing manual, unauditable record management across Cloudflare and on-premises Windows DNS, driven by one YAML file per environment. Terraform / Terragrunt GitHub Actions Networking Security / IAM
  One module fans each record out to Cloudflare and/or the Windows DNS server, with split-horizon support via a target field and an internal-IP override so the same name resolves differently per network. Windows writes go over GSSAPI/Kerberos with TCP forced to avoid oversized-response failures. Content variables let records reference per-environment load balancer and gateway addresses symbolically instead of hardcoding IPs. CI plans on pull request and applies on merge via self-hosted runners; workflow_dispatch helpers let other repositories add and query records programmatically. A second Terragrunt project in the same repo manages Cloudflare zone lockdown rules the same way.
• Deployed and operated the GKE fleet across dev, QA, UAT, prod, and tools clusters with workload identity, service mesh, and autoscaling node pools. GCP / GKE Kubernetes ArgoCD / GitOps Terraform / Terragrunt
  Private nodes route egress through the VPC's NAT so egress IPs are controllable and whitelistable. Platform services built around the clusters: external-dns with cross-project DNS access so application ingresses self-register records, cross-project Artifact Registry grants during image migration, OpenCost for cost visibility, and the Datadog agent rollout alongside an organization-wide Datadog-GCP metrics connection.
• Built the AI/ML platform twice — GKE, AlloyDB, and ArgoCD in the legacy organization, then rebuilt in dedicated projects in the new one — including a HIPAA-scoped project restricted to a small user set for a clinical coding model effort. GCP / GKE Kubernetes ArgoCD / GitOps Security / IAM
  Wrote the reusable GKE and AlloyDB Terraform modules, sized GPU node pools with the AI team, and installed ArgoCD via Terraform-managed Helm at cluster launch so GitOps existed from day one rather than being retrofitted. The rebuild added namespace-scoped workload-identity service accounts per application, Gateway API, and moved ArgoCD's SSO configuration onto the corporate identity provider.
• Built a composite Postgres module — instance, service account, secret, and DNS record as a single primitive — and used it to deploy and operate the database fleet across all environments. GCP / GKE Terraform / Terragrunt Python
  The interesting part is the defaults, not the resources. Deletion protection on every instance, environment-tiered backup windows and retention, and maintenance windows are module defaults rather than review checklist items, so DBA policy is enforced by construction. Every database gets a DNS record automatically. Workload-identity bindings are boolean-gated so GKE namespaces can bind directly to database service accounts.
• Replaced long-lived cloud credentials with Workload Identity Federation and least-privilege IAM in a HIPAA-regulated environment. GCP / GKE Security / IAM GitHub Actions
  GitHub-to-GCP federation with organization and per-repository service account impersonation, extended per project and into the AI projects. GKE workload identity exposes Kubernetes service accounts to GCP directly, reducing the number of GCP service accounts and scoping access to individual namespaced identities. The pattern later extended beyond CI: GCP-to-Snowflake federation for an internal application, and a federated deploy identity for pushing Composer DAGs to per-environment buckets.
• Consolidated 30+ GCP load balancers onto 4 gateways using URL masks on serverless network endpoint groups, saving over $1,000 per month, and replaced immutable classic certificates with certificate maps. GCP / GKE Cost optimization Networking
  Cloud Run services were serving on a vanity domain, which meant custom domains couldn't attach and traffic bypassed CloudArmor entirely. Moving them behind real load balancers with templated URL maps fixed both problems and cut the load balancer count. Certificate maps made renewals in-place, which removed most of the recurring certificate toil.
• Gave a vendor PHP/IIS application a real SDLC — source control, versioned build artifacts with checksums and SBOM, and a promotion pipeline to dev, UAT, and prod with environment approval gates. GitHub Actions Terraform / Terragrunt Security / IAM
  Push to master auto-builds a timestamped, SHA-tagged artifact. A separate promote workflow deploys any release to a chosen environment behind approval gates, with checksum verification, pre-deploy backup, config preservation, health checks, and timestamped promotion tags for audit. The Ansible playbook installs the application end-to-end on the IIS hosts including templated configuration, so a rebuild is a playbook run rather than a runbook.
• Brought on-premises vSphere under Terraform, making the directory tree the VM inventory. Terraform / Terragrunt VMware / vSphere Linux
  A base server module is never sourced directly; a customized wrapper adds secret-manager credential retrieval for domain join, subnet-to-gateway auto-calculation, and opinionated firmware/controller defaults. A parallel cloud-init module bypasses vSphere's native customizer — which doesn't work with Image Builder images — by injecting network metadata and cloud-config through GuestInfo keys. The Terragrunt import brought the existing fleet in one stack per VM, handling deleted source templates and disk-label mismatches without destructive recreation.
• Leading a licensing-driven Oracle Linux to RHEL conversion: convert2rhel viability spike, an Image Builder blueprint published as a vSphere template, and Red Hat Satellite lifecycle environments for content promotion. Linux Ansible Terraform / Terragrunt
  The spike validated conversion for OL8 and identified the OL7 outlier, producing gated conversion playbooks with report upload. Because Satellite couldn't land in time, an interim licensing host running virt-who handles hardware-based licensing against vCenter so the conversion isn't blocked on it.
• Wrote a reusable Ansible role joining Linux systems to Active Directory with Kerberos and GSSAPI, designed as a component of a fleet-wide policy-enforcement playbook. Ansible Linux Security / IAM
  Centralizes AD logins, group-based sudo, and Kerberos SSH auth instead of scattered local accounts across ~150 hosts. A later hardening pass added idempotency checks, deduplication, error handling, and graceful handling of systems carrying legacy LDAP configuration.
• Identified and corrected a latent production access failure caused by unsafe filesystem permissions on a long-running production VM, preventing a permanent OSLogin lockout during a planned migration. Linux Security / IAM
  A two-year-old permission change to the OSLogin binary had quietly broken it, and the root account was inaccessible. I caught it during a VM migration to another project by reading the logs on the original machine — the failure would only have surfaced after the source was gone.

Led infrastructure and operations for a small security startup, owning all AWS architecture decisions, CI/CD strategy, and observability for their endpoint agent product.

• Designed CI-driven E2E test harness (GitHub Actions + Terraform + AWS) that provisions ephemeral VPC/ECS environments to validate endpoint agent behavior across supported deployment topologies. AWS Terraform / Terragrunt
  Tests were internet-connected, proxy-chained, and air-gapped against a live phone-home server, with automatic teardown to control cost.
• Integrated Datadog for service monitoring and Elasticsearch for centralized log aggregation and analysis. Observability
• Introduced CI/CD workflows to replace manual deployments, improving release reliability and reducing operational friction. GitHub Actions

Sole operations engineer supporting analytics and data science teams across production and QA AWS environments.

• Reduced annual AWS spend by $355K+ through EMR spot-instance migration, reserved-instance strategy for the Qliksense cluster, and systematic right-sizing. AWS Cost optimization
  Informed by CloudHealth and Trusted Advisor analysis. The bigger win was getting the analytics teams comfortable with spot, not the dollar number — that pattern kept paying back long after I left.
• Deployed and operated Kubernetes workloads on EKS using Terraform and Helm, supporting large-scale analytics pipelines with centralized logging via Elasticsearch. AWS Kubernetes Terraform / Terragrunt Observability
• Diagnosed and recovered a production Cassandra cluster failure using custom recovery scripts. Linux Observability
  No senior to escalate to. Recovery took most of a long night and resulted in a runbook the next on-call rotation could actually follow.