Akila Pramod

DevSecOps · Infrastructure · Platform Systems

Building reliable infrastructure for deployment, automation, and AI systems.

View Projects

Associate DevSecOps Engineer@ Emojot

AWS Security · IaC · Homelab Systems

Verified Production Ledgers

AUDITED INFRASTRUCTURE METRICS

[SEC-REMEDIATION]

Associate DevSecOps

Securing, operating, and automating multi-account AWS environments at Emojot.

[COST-IAC]

AWS Platform & IaC

Production security remediation, Terraform IaC, and ~65% EC2 cost optimization with ECS Spot.

[PVE-BAREMETAL]

Homelab Infrastructure

Built isolated Proxmox services with automated health monitoring across self-hosted environments.

[AI-GATEWAY]

AI Agent Gateway

Deployed OpenClaw as a self-hosted agent gateway on homelab infrastructure.

About

Engineering immutable infrastructure, enforcing least-privilege security boundaries, and operating private AI systems.

Rather than treating DevSecOps as a checklist of tools, my work centers on verifiable production outcomes: multi-account AWS remediation, cost-efficient container clusters, and bare-metal homelab experimentation that proves architectures before they touch client workloads.

Operating Principles

Security Model:Least-Privilege IAM

IaC Standard:Terraform State Sync

Virtualization:Proxmox VE + LXC

Agent Gateway:GitOps Hot-Reload

What I Do

01 // ENTERPRISE PLATFORM

Associate DevSecOps Engineer at Emojot, securing and automating multi-account AWS environments across Dev, Staging, and Production. Previously designed containerized CI/CD pipelines as a DevOps intern at Sri Lanka Telecom.

How I Learn

02 // HYPERVISOR & LAB

Self-directed infrastructure work through a Proxmox homelab. Network isolation via virtualized OpenWrt, container orchestration with Portainer and Docker Compose, NAS with OpenMediaVault, and node health monitoring with automated Discord alerting.

What I'm Building Now

03 // AI SYSTEMS & GITOPS

Operating OpenClaw — an open-source, self-hosted AI agent framework running on homelab infrastructure. The stack includes multi-LLM routing, hybrid retrieval combining vector search with keyword matching and reranking, and privacy-respecting web research. All configuration is managed through GitOps workflows with hot-reloading sync.

Experience

Associate DevSecOps Engineer

Emojot (Pvt) Ltd

Sep 2026 – Present

Owned production-facing AWS security remediation across Development, Staging, Production and management accounts, addressing Critical/High Security Hub findings across S3, EC2, Security Groups, GuardDuty, Inspector, RDS, ElastiCache and SSM.
Completed Production SQS hardening, replacing public/broad access policies with least-privilege permissions while preserving email campaigns, workflow notifications, SES events, and DLQ processing.
Conducted infrastructure/security audits of legacy application components and data flows, identifying configuration and security risks across AWS-hosted services.

AWSSecurity HubIAMSQS HardeningGuardDutyInspector

DevSecOps Engineer - Intern

Emojot (Pvt) Ltd

Mar 2026 – Sep 2026

Restored and modernized a dormant AWS staging environment, enabling Development and QA activities to run independently and reducing production-release risk.
Designed and implemented an ECS Spot + On-Demand capacity-provider strategy for non-critical Development workloads, reducing EC2 costs by up to ~65%.
Managed AWS infrastructure with Terraform, including ECS, CodePipeline/CodeBuild, ECR, IAM, networking, load balancing and existing-resource imports.
Started the SQS security-remediation program in Development and Staging, identifying legitimate producers/consumers and replacing public access with least-privilege policies.
Modernized legacy Node.js, NGINX, Tomcat and Python base images through EOL, vulnerability and compatibility analysis.

AWS ECSTerraformCost OptimizationDockerCodePipelineCI/CD

DevOps Engineer - Intern

Sri Lanka Telecom

Aug 2025 – Feb 2026

Designed end-to-end CI/CD pipelines for containerized microservices, reducing deployments from days of manual effort to ~7 minutes.
Containerized backend services with Docker, administered RHEL Linux VMs, and contributed to NestJS/PostgreSQL/Prisma backend services.

Key Deliverable// Enterprise Release

echannelling.com

Containerized backend services using NestJS, PostgreSQL, Prisma, Docker, and Nginx

DockerCI/CDNestJSPostgreSQLPrismaRHELLinux

Core Stack

Technologies and platforms battle-tested in production AWS environments, container workflows, and self-hosted infrastructure.

Primary

Daily Production & Homelab Drivers

AWSTerraformDockerCI/CDGitHub ActionsLinuxProxmox VEPodman

Infrastructure & Networking

AWS Security HubGuardDuty & InspectorOpenWrtTailscaleNginxDocker ComposePortainer

AI / ML Ops

Multi-LLM routingHybrid retrieval (RAG)Vector searchWeb research pipelines

Languages

BashPythonJavaGoSQL

Frameworks

FastAPINestJSSpring BootReact

Monitoring

Familiar

CloudWatchGrafanaPrometheusDiscord webhooks

Homelab & Platform

A single-node Proxmox homelab — built for learning infrastructure by doing, not just reading about it.

Filter View:

Proxmox VE NodeHOST: pve-primary // ARCH: x86_64

OpenWrtVM

Isolated homelab network with dedicated router

OpenMediaVaultVM

Archival storage, media backup, system images

Isolated NetworkVLAN 10 SEGREGATION

Arr Stack + PortainerLXC

Docker Compose orchestration for media services

OpenClaw AgentLXC

Self-hosted AI agent framework

Pulse MonitorLXC

Node + SSD health → Discord alerts

OpenClaw Stack Detail

GITOPS HOT-RELOAD

Multi-LLM routing— OpenAI-compatible API bridging

Hybrid retrieval— Vector + keyword matching + cross-encoder reranking

SearXNG— Privacy-respecting web research

GitOps config— Hot-reload via git-watcher sync

Tailscale overlay — secure remote access from anywhere

Engineering Decisions

ARCHITECTURAL RATIONALE

Why OpenWrt?

Network isolation for safe experimentation, minimizing impact on primary systems

Why hybrid retrieval?

Precision over pure vector similarity — combines semantic and keyword matching with reranking

Why GitOps config?

Reproducibility and version control with hot-reload into the running instance

Why Discord alerting?

Lightweight, immediate notification pipeline for a single-node setup

Featured Projects

OpenClaw Homelab Agent Stack

AUTONOMOUS AI GATEWAY

Problem

Need for autonomous, research-capable AI agents without relying on external SaaS platforms.

Outcome

Fully operational self-hosted AI agent framework with deep research capability, running on homelab infrastructure.

Approach

Self-hosted open-source agent framework with multi-LLM routing, hybrid retrieval combining vector search with keyword matching and cross-encoder reranking, and privacy-respecting web research via SearXNG. Configuration managed through GitOps workflows with hot-reloading sync.

Pipeline Architecture Flow

Isolated LXC

Gateway

API Router

Multi-LLM routing & bridge

Retrieval

Hybrid RAG Engine

Vector search + BM25 keyword

Synthesis

Cross-Encoder

Reranking & SearXNG research

Sync

GitOps Engine

Hot-reloading config sync

OpenClawLXCMulti-LLM routingHybrid RAGSearXNGGitOps

Architecture

Production Security Remediation

SQS Least-Privilege Policy Lockdown

Remediated public/broad wildcard access across multi-account AWS environments while preserving live transactional messaging (email campaigns, SES events, DLQ processing).

AUDITED: queue-policy.json (SEC-FIXED)STATUS: 0 FINDINGS

{
  "Version": "2012-10-17",
  "Id": "HardenedLeastPrivilegeQueuePolicy",
  "Statement": [
    {
      "Sid": "AllowAuthorizedEmojotProducers",
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::123456789012:role/EmojotWorkerRole" },
      "Action": [
        "sqs:SendMessage",
        "sqs:GetQueueAttributes"
      ],
      "Resource": "arn:aws:sqs:us-east-1:123456789012:emojot-production-events",
      "Condition": {
        "ArnEquals": {
          "aws:SourceArn": "arn:aws:ses:us-east-1:123456789012:identity/*"
        }
      }
    }
  ]
}

Multi-Account AWSZero Queue DowntimeLeast-Privilege Enforced

Presently

AI Presentation Coach

End-to-end CD pipeline with automated cloud orchestration for ML workloads including Whisper TTS and MediaPipe. Engineered a secure RESTful backend with FastAPI and integrated Gemini API.

Service Architecture

Flutter ClientFastAPI ServiceWhisper & MediaPipe MLGCP Cloud Run CD

FastAPIPostgreSQLFlutterGitHub ActionsDockerGCPGemini API

Source

EchoMarket

Microservices in Go

Learning-focused microservices project in Go with layered architecture (handlers → services → repository), Docker Compose for local data stores, and GitHub Actions for CI.

Service Architecture

REST HandlersDomain ServicesPostgreSQL RepoDocker Compose CI

GoPostgreSQLDockerRESTGitHub Actions

Source