Roman Mednitzer

Vienna, AT · Systems & Platform Engineer

I run production Linux, virtualization, and Kubernetes infrastructure in regulated, business-critical environments — broad rather than specialized, from hardware and storage through to observability and verified recovery.

focus: Linux · virtualization & storage · Kubernetes/GitOps · observability · backup/DR
experience: 10 years in regulated & business-critical environments · estates of 50–500 hosts and VMs
seeking: senior systems integration, platform and infrastructure operations, or systems architecture — for a technically demanding product, facility, or platform
available: from October 2026 · Vienna and surroundings · on-site or remote · security clearance possible where a role requires one
certified: ISO/IEC 27001 ISMS Manager & Auditor (TÜV Austria, 2017)
approach: open source by default · mostly self-taught
languages: German (native) · English (fluent)
member of: IEEE · Austrian Computer Society (OCG)

About

I keep business-critical systems dependable in environments where both downtime and audit findings are expensive: medical device manufacturing, managed services at an Austrian IT provider, and group-wide enterprise operations. I work broadly rather than narrowly — Linux, virtualization, and hardware through storage and networking to container platforms, observability, and backup with verified recovery. Operations run under change control throughout, with evidence an auditor can follow.

I run the infrastructure and prove the recoveries, and I have implemented the ISO 27001 ISMS that has to satisfy the auditor, so the engineering and the governance get built together rather than bolted on. Alongside the day job I run a private lab and track the EU regulation that lands on platforms — NIS2, the CRA, and the AI Act — and I am orienting toward defense technology and sovereign systems.

Experience

Ten years of production operations, most of it at one Austrian IT service provider, from apprentice to senior engineer.

IT Systems Administrator, platform operations
2025 — now

Kwizda Holding GmbH · Vienna

Production platform operations across a heterogeneous Windows and Linux estate of roughly 200 to 500 hosts and VMs, with an active push toward containers and GitOps. I own backup and recovery with documented restore verification, run monitoring and alerting for operational visibility across the estate, manage infrastructure and server hardware, and support change management and compliance evidence aligned to ISO 27001 and NIS2.
IT Systems Engineer, senior level
2017 — 2025

EBCONT operations GmbH · Vienna

Eight years across managed-services customers and internal infrastructure, promoted from junior to senior. Incident, problem, and change lifecycle in production customer environments with structured documentation and a defined rollback; virtualization clusters on enterprise SAN storage; monitoring and alerting for estates of 50 to 200 hosts and VMs; Kubernetes platforms across several distributions with GitOps delivery; the internal source-control and CI platform, upgrades included; and a proof of concept for hyperconverged infrastructure with a high-speed switch fabric. Third-level support and on-call throughout.
IT Technician → IT Systems Administrator
2015 — 2017

medPhoton GmbH · Salzburg

Production server and application operations for a manufacturer of radiotherapy medical devices, under medical-device regulatory conditions. Structured troubleshooting with documented incident handling and root-cause analysis, backup and recovery with integrity checks, and hands-on ISMS and BCM practice including preparation for ISO 27001 audits. The standardized operating procedures and runbooks I wrote were adopted by the team.
IT Technician, apprenticeship
2012 — 2014

Ledl.net GmbH · Salzburg

First production Linux at a hosting provider: web hosting operations, domain administration, and customer support.

Apprenticeship in information technology, systems engineering focus, completed 2016.

Open source

The same arc as the day job, in public: the governed control plane that operates the fleet, and the infrastructure as code and configuration management that build it.

relay-shell

Apache-2.0 · MCP

A Model Context Protocol server that gives an AI client real shell and SSH capability over hosts I administer: local and remote execution, interactive PTY sessions, SFTP, port forwarding, and parallel fleet commands behind one audited runner. Authority is tiered — open, guarded, and read-only modes over a global deny-list — and every call is secret-redacted, recorded as a SHA-256 hash rather than a raw body, and bounded by timeouts and output caps.

infra

Apache-2.0 · OpenTofu

OpenTofu modules that build the fleet: cloud-init Ubuntu VMs on KVM/libvirt, and a Talos Linux module that stands up the Kubernetes cluster. Lab and production are separated, production state lives in an encrypted, locked remote backend, and every change is CI-gated.

automation

Apache-2.0 · Ansible

Ansible hardening and configuration management for the same hosts: a CIS-benchmark-based baseline of roles covering SSH, auditd, firewalling, and kernel and systemd hardening, plus playbooks for the SRE toolchain, local inference, and out-of-band management. Every control maps to NIS2, CRA, GDPR, and ISO/IEC 27001 in a machine-readable file.

More at github.com/rmednitzer

Skills

The fleet

A self-run, all-open-source personal fleet, organized as a strict control-plane / data-plane split and driven end to end through a governed Model Context Protocol control plane. Linux hosts and a single-node Kubernetes cluster, meshed and observable, run with the habits I bring to production.

control plane

MCP gateway cloud VM · OAuth 2.1 + PKCE · CIDR-locked proxy

plan
authorize
execute

every mutation, hash-chained

data plane

Data & inference GPU host · loopback-only
Observability & SIEM Talos Kubernetes
Git, services & storage always-on · ZFS

Every automated action enters through the gateway, and nothing above read-only reaches the data plane without crossing the gate.

Control plane

cloud VM

An authenticated, typed MCP gateway on a cloud VM is where every automated action enters the fleet. OAuth 2.1 with PKCE sits behind a CIDR-locked reverse proxy, and no provider credential ever lives in the network-facing process. Anything above read-only crosses an explicit plan → authorize → execute gate with a single-use confirmation digest, and every call lands in an append-only, hash-chained audit log.

Data & inference

GPU compute server

A single workstation-class host carries all local inference and the authoritative data store. Local LLMs run on llama.cpp via llama-swap; PostgreSQL 18 holds the corpora plus a pgvector and Apache AGE knowledge graph, fed by more than 130 OSINT sources on a four-hour cycle and six scheduled analysis agents. Over 170,000 documents with full embedding coverage and some 25,000 CVEs enriched with KEV and EPSS, retrieved by hybrid vector and full-text search with reranking. Loopback-only by default.

Observability & SIEM

Talos Kubernetes

A single-node Talos Linux cluster (immutable, API-managed, no SSH) carries fleet-wide telemetry across roughly 30 workloads, its state reconciled from Git by Flux alone: VictoriaMetrics, VictoriaLogs, Tempo, and OpenTelemetry behind Grafana, with vmalert and Alertmanager on top, plus a Wazuh SIEM with realtime file-integrity monitoring and agents across the Linux and Windows hosts. Everything Helm-deployed.

Git, services & storage

always-on server

The fleet's own Git authority runs on self-hosted Forgejo, alongside Ansible job automation and the notification service, so the code that builds the fleet does not depend on anything I do not run. Encrypted Restic backups go off-host. ZFS everywhere on Linux, with Sanoid snapshots, scheduled scrubs, and a pre-change snapshot before anything risky.