James F. Gomez
Principal Cloud (GCP & AWS), Network Security & Agentic AI Infrastructure Architect • Multi-Cloud IaC, Carrier Routing & Zero-Trust SecOps Lead
Principal Cloud, Network Security & AI-Ops Architect with 15+ years of progressive production experience designing, securing, and automating mission-critical Google Cloud Platform (GCP) and Amazon Web Services (AWS) environments, high-compliance enterprise & carrier networks (1,000+ managed routers, switches & firewalls), and autonomous Agentic AI operations (ai-ops). Proven track record leading global golden-image and Infrastructure-as-Code CI/CD pipelines across NA, LATAM, EU, and APAC (Terraform Enterprise across 500+ workspaces, Ansible, Puppet, Pulumi, Packer, GitLab CI/CD, GitHub Actions, Jenkins), architecting Zero-Trust & PCI-grade cloud/network security (Wazuh SIEM/XDR, AWS GuardDuty/Security Hub, GCP Cloud Armor, Juniper SRX JNCIP-SEC, global factory IPsec/VTI fabrics, RADIUS/TACACS+ AAA, HashiCorp Vault), migrating 1,000+ VMs to AWS/cloud infrastructure, and authoring 148+ merged upstream Open-Source Pull Requests (@nertwork).
ai-ops) & Knowledge Graph ToolingCore Architecture & AI-Ops Engineering Domains
Agentic AI & Autonomous Operations (ai-ops)
Architected a production two-tier Orchestrator + Scoped Sub-Agent platform pairing frontier LLMs with deterministic Python CLIs, Model Context Protocol (MCP) servers, and pre-compiled Graphify knowledge graphs.
- Enforced fleet-wide interface, hostname, VTI IPsec, and zero-hit ACL standards across 1,000+ devices with candidate diff staging and human-in-the-loop approval gates.
- Built autonomous
Hermeswatchdogs for closed-loop Prometheus/Mimir, Loki, and Wazuh SIEM alert triage and self-healing GitLab CI/CD pipelines. - Reduced cross-repository blast-radius and topology queries to
<150 tokensusing persistent AST and NetBox SSOT graphs.
Multi-Cloud Architecture (GCP & AWS) & Global Golden-Image CI/CD
Architected enterprise landing zones, hybrid cloud transit hubs, and automated golden-image pipelines across North America, LATAM, EU, and APAC on GCP and AWS.
- Google Cloud Platform (GCP): Multi-region GKE & Cloud Run platforms, Shared VPC, Cloud Router & Network Connectivity Center (NCC) HA BGP/IPsec interconnects, Cloud Armor WAF/DDoS & hierarchical firewall policies, Workload Identity Federation, Cloud KMS/Secret Manager, and BigQuery/Managed Prometheus observability.
- Amazon Web Services (AWS): Led 1,000+ VM migrations to AWS; architected AWS Transit Gateway (TGW) & Direct Connect hub-and-spoke VPCs, Amazon EKS/ECS, IAM Identity Center/IRSA, GuardDuty, Security Hub, AWS Network Firewall & WAF, and EC2 Auto-Scaling/Spot FinOps.
- Global IaC & Golden Image Factory: Automated immutable image builds and deployments with Packer, Ansible, Puppet, Pulumi, and Terraform Enterprise (TFE • 500+ workspaces) via GitHub Actions, GitLab Runners, and Jenkins.
Carrier Routing, Data Center Fabrics & Traffic Engineering
Deep protocol-level mastery across multi-datacenter spine-leaf fabrics, global WAN interconnects, and high-throughput carrier peering edges.
- Architected and operated routing and switching across 4+ data centers and 1,000+ network devices running Juniper Junos (MX/EX/QFX/SRX), Cisco (IOS-XE/NX-OS/ASA), and Cumulus Linux (FRRouting).
- Optimized BGP, OSPF, EVPN-VXLAN, VRF-Lite, ECMP, VRRP, LACP, and STP topologies to balance 95th-percentile carrier commits and prevent transit overages.
- Designed resilient global IPsec/VTI encryption fabrics connecting international manufacturing and factory facilities.
Network Automation, SSOT & Full-Stack Observability
Replaced manual CLI changes with declarative Single Source of Truth (SSOT) data models, automated configuration backups, and unified telemetry.
- Built zero-touch provisioning and audit frameworks in Python using Juniper PyEZ, NETCONF, Paramiko, and Ansible backed by NetBox IPAM/DCIM and Oxidized.
- Developed custom internal Network Management Systems (Ruby on Rails, MySQL, Bootstrap) for automated switch port control and IPv4/IPv6 lease governance.
- Unified metrics, logs, and synthetic probes across Grafana Cloud, Prometheus/Mimir, Loki, Alertmanager, and LibreNMS.
Private Cloud (OpenStack / Proxmox VE) & Kubernetes
Full-lifecycle design of high-availability bare-metal hypervisor clusters, software-defined storage, and GitOps-managed Kubernetes platforms.
- Designed and deployed multi-node OpenStack private clouds with custom Software-Defined Networking (SDN) and multi-tenant Neutron IPv4/IPv6 routing.
- Architected high-IOPS Proxmox VE clusters on NVMe/ZFS with automated cloud-init templates, HAProxy TLS WebSocket proxies, and KVM LACP bridges.
- Operated production Kubernetes clusters with ArgoCD, Traefik, MetalLB BGP/L2 load balancing, and Longhorn distributed block storage.
Zero-Trust Network Security, AAA, SIEM/XDR & Compliance
Certified Network Security Architect (JNCIP-SEC) engineering defense-in-depth perimeter firewalls, high-compliance micro/macro-segmentation, global AAA, and automated vulnerability remediation.
- Stateful Firewall & IPsec/VTI Architecture: Multi-zone security policy design on Juniper SRX, Cisco ASA, and Linux netfilter; automated zero-hit ACL pruning and canonical object-group normalization; encrypted global site-to-site and manufacturing factory IPsec/VTI interconnects.
- Identity, RADIUS/TACACS+ AAA & Secrets Governance: Multi-region RADIUS/TACACS+ AAA infrastructure, HashiCorp Vault KV v2 dynamic secret injection, Authentik SAML/OIDC Zero-Trust SSO forward-auth gates, and automated TOTP/PKI rotation.
- SIEM/XDR & CIS Compliance Hardening: Fleet-wide Wazuh SIEM/XDR deployment for real-time CVE correlation, active-response blocking, and automated CIS Benchmark SCA compliance patching via Ansible and hardened Packer golden images.
Industry Certifications & Technical Accreditations
Executive Engineering & Architecture Experience
Principal Infrastructure, Cloud & Agentic AI Architect
- Architected and scaled automated golden-image build and infrastructure deployment pipelines using Packer, Ansible, Puppet, and Terraform Enterprise (TFE) across 500+ workspaces and multiple CI/CD platforms (GitHub Actions, GitLab Runners, Jenkins), cutting deployment lead times across NA, LATAM, EU, and APAC regions.
- Pioneered a two-tier Agentic AI Operations (
ai-ops) framework combining deterministic Python CLIs, Model Context Protocol (MCP) tools, andGraphifytopological knowledge graphs to automate multi-datacenter network governance, Prometheus/Mimir/Loki observability queries, and zero-hit firewall/ACL hygiene. - Engineered secure global IPsec/VTI and carrier interconnect architectures linking international manufacturing and fulfillment facilities with zero unplanned downtime.
- Drove cloud FinOps optimization by implementing dynamic auto-scaling and right-sizing compute/storage tiers across multi-cloud environments (GCP, AWS, Proxmox VE), delivering substantial recurring infrastructure cost reductions.
- Served as primary escalation architect for cross-regional routing, DNS/rDNS governance, SAML/SSO authentication, and high-severity production incidents.
Principal Network Architect & Engineering Team Lead
- Directed network architecture, capacity planning, and vendor strategy across global hosting data centers while directly managing 3 full-time network engineers and external contractors.
- Designed and deployed a production OpenStack private cloud environment integrated with custom Software-Defined Networking (SDN), EVPN-VXLAN overlays, and automated multi-tenant IPv4/IPv6 subnet provisioning.
- Automated multi-vendor configuration compliance and zero-touch provisioning across Juniper Junos, Cisco, and Cumulus Linux fabrics using Ansible, Python (PyEZ, NETCONF, Paramiko), NetBox IPAM, and Oxidized.
- Optimized multi-terabit carrier transit commits using 95th-percentile traffic engineering across BGP and OSPF edges, eliminating bandwidth overage penalties while improving cross-datacenter failover convergence.
Senior Network Engineer
- Owned core, distribution, and top-of-rack routing and switching architecture across 4+ production data centers utilizing BGP, OSPF, VRRP, ECMP, LACP, and STP on Juniper MX/EX/QFX, Cisco NX-OS/IOS, and whitebox Linux switches.
- Consolidated and reclaimed fragmented IPv4/IPv6 address space into a centralized IPAM SSOT, extending IPv4 exhaustion runways and automating ARIN IRR route-object maintenance.
- Deployed distributed LibreNMS, Graylog, and Grafana telemetry stacks to provide real-time optical DOM, buffer drop, and BGP session alerting.
Lead Cloud Migration & Network Automation Consultant
- Led the architectural assessment, network redesign, and execution of a large-scale enterprise migration moving 1,000+ production virtual machines into AWS with redundant Direct Connect / IPsec transit and zero-trust VPC segmentation.
- Standardized repeatable Python and Ansible migration runbooks, cutting per-wave cutover windows and eliminating post-migration routing blackholes.
Multi-Datacenter Network & Systems Administrator
- Managed day-to-day carrier routing, customer BGP turn-ups, VLAN/VRF provisioning, and Linux KVM/LVM virtualization across 4 Los Angeles data centers.
- Engineered a custom internal Network Management System (NMS) in Ruby on Rails, MySQL, and Bootstrap that automated top-of-rack switch port provisioning, bandwidth graphing, and IP allocation for support and provisioning teams.
Converged Technology & Network Security Engineer
- Deployed and supported enterprise campus networks, multi-site stateful firewalls, high-density wireless (Ruckus / UniFi), VMware vSphere virtualization, and converged VoIP telephony (Asterisk / Mitel) for commercial clients.
Standardized Technical & Leadership Matrix
AI-Ops & Agentic Automation
Two-Tier Orchestrator/Sub-Agent Architecture, Model Context Protocol (MCP), Graphify Knowledge Graphs, Autonomous CI/CD & Alert Triage (Hermes), Candidate Diff Staging, Prompt & Token Engineering (<150-token CLIs).
Cloud, Virtualization & Containers
GCP, AWS (EC2, VPC, Direct Connect, IAM), Proxmox VE (NVMe/ZFS, Cloud-Init, HA), OpenStack (Nova, Neutron SDN), VMware ESXi/vSphere, Linux KVM/QEMU, Kubernetes (k3s/RKE2, ArgoCD, MetalLB, Traefik, Longhorn), Docker.
IaC, CI/CD & Configuration Management
Terraform & Terraform Enterprise (TFE • 500+ Workspaces), Pulumi (Python/TypeScript), Ansible, Puppet, Packer, GitLab CI/CD, GitHub Actions, Jenkins, GitOps.
Carrier Routing, Switching & NOS
BGP (eBGP/iBGP, Route Reflection, 95th-Percentile TE), OSPF, EVPN-VXLAN, MPLS/VRF-Lite, ECMP, VRRP, 802.3ad LACP/MLAG, RSTP/MST, IPv4/IPv6; Juniper Junos (MX/EX/QFX/SRX), Cisco (IOS-XE, NX-OS, ASA), Cumulus Linux (FRR/NCLU), Dell FTOS, MikroTik RouterOS.
Observability, SecOps & Languages
Grafana Cloud, Prometheus/Mimir, Loki, Alertmanager, LibreNMS, Oxidized, NetBox SSOT, Wazuh SIEM/XDR, HashiCorp Vault, Authentik SSO; Python 3 (PyEZ, NETCONF, Paramiko, AsyncIO), Bash, Ruby on Rails, SQL.
Engineering Leadership & Governance
Direct Engineering Team & Contractor Management, Cross-Functional Architecture Review Boards, Cloud FinOps & Carrier Contract Optimization, Agile/Scrum & JIRA Delivery, Post-Incident RCA & Runbook Standardization.
All Published Engineering Articles & Deep Dives
Every technical article, CLI reference, and architectural deep dive authored by James F. Gomez on nertwork.com, organized by engineering domain:
AI & Automation
9 ArticlesAgentic AI, AI-Ops, Leveraging AI for a Homelab, Declarative Infrastructure-as-Code (Terraform, Pulumi, GitLab CI/CD), and Autonomous Network Engineering.
- Autonomous Cloud & Infrastructure SecOps: Integrating Wazuh SIEM/XDR, HashiCorp Vault, and Agentic AI Across AWS, GCP, and Proxmox Fleets
- Leveraging AI for a Homelab: Declarative Proxmox VE Infrastructure with Terraform, Pulumi, and GitLab CI/CD
- Enforcing Network Standards Across a 1,000+ Device Fleet with Agentic AI
- Enterprise Networking Trends: SASE, Multi-Cloud, Private 5G, and AI Network Management
- Modern Computer Networking: Wi-Fi 6E, Edge Computing, 5G, SDN, and AI Cybersecurity
- Single-Line Parted Command to Partition and Mount a 100% Linux Disk
- OpenStack Neutron CLI Commands: Creating IPv4 and IPv6 Subnets
- How to Update ARIN IRR Route and Maintainer Objects via Email Templates
- Minute MTR: Automated Continuous Traceroute Logging and Retention Script in Ruby
Network Architecture
14 ArticlesEnterprise routing, BGP, EVPN/VXLAN, VRFs, 802.3ad LACP, SDN, and packet-level network engineering.
- Autonomous Cloud & Infrastructure SecOps: Integrating Wazuh SIEM/XDR, HashiCorp Vault, and Agentic AI Across AWS, GCP, and Proxmox Fleets
- Leveraging AI for a Homelab: Declarative Proxmox VE Infrastructure with Terraform, Pulumi, and GitLab CI/CD
- Enforcing Network Standards Across a 1,000+ Device Fleet with Agentic AI
- Importing OpenVPN Access Server (.ovpn) Profiles into Linux NetworkManager via nmcli
- What Is a VRF (Virtual Routing and Forwarding) and How Does Network Virtualization Work?
- Whitebox Switching Providers & Open Network Operating Systems (NOS) Guide
- How to Update ARIN IRR Route and Maintainer Objects via Email Templates
- Changing a Linux or Cumulus Switch IP Address Remotely Without Losing SSH Connectivity
- Configuring Ubuntu 802.3ad LACP Bonding with a KVM Network Bridge (/etc/network/interfaces)
- Minute MTR: Automated Continuous Traceroute Logging and Retention Script in Ruby
- What Is Software-Defined Networking (SDN) and How Does Controller-Based Automation Work?
- Verifying Global eBGP Route Propagation Using Public Looking Glass Servers
- Fast IPv4 CIDR Subnetting Math: Calculating Subnets, Block Sizes, and Usable Hosts
- IPv4 Address Classes (Class A, B, C, D, and E) and CIDR Prefix Definitions
Linux & Virtualization
12 ArticlesProxmox VE clusters, KVM hypervisors, Linux storage (LVM, parted, ZFS), HAProxy, Docker, and systems administration.
- Autonomous Cloud & Infrastructure SecOps: Integrating Wazuh SIEM/XDR, HashiCorp Vault, and Agentic AI Across AWS, GCP, and Proxmox Fleets
- Leveraging AI for a Homelab: Declarative Proxmox VE Infrastructure with Terraform, Pulumi, and GitLab CI/CD
- Enforcing Network Standards Across a 1,000+ Device Fleet with Agentic AI
- Running MongoDB on Non-AVX CPUs Using Custom Docker Containers
- Configuring Proxmox VE NoVNC Consoles Behind HAProxy with Sticky Sessions
- Single-Line Parted Command to Partition and Mount a 100% Linux Disk
- Importing OpenVPN Access Server (.ovpn) Profiles into Linux NetworkManager via nmcli
- OpenStack Neutron CLI Commands: Creating IPv4 and IPv6 Subnets
- Google Calendar Custom Recurring Events Using iCalendar (.ics) RRULE Definitions
- Expanding an Ubuntu LVM Partition Inside a KVM Virtual Machine Using fdisk and lvresize
- Configuring Ubuntu 802.3ad LACP Bonding with a KVM Network Bridge (/etc/network/interfaces)
- How to Change or Update an SSH RSA Private Key Passphrase Using ssh-keygen
Tech Dispatch
9 ArticlesIndustry analyses, emerging networking standards (Wi-Fi 6E, 5G, SASE, AI networking), and architectural commentary.
- Leveraging AI for a Homelab: Declarative Proxmox VE Infrastructure with Terraform, Pulumi, and GitLab CI/CD
- Enforcing Network Standards Across a 1,000+ Device Fleet with Agentic AI
- Enterprise Networking Trends: SASE, Multi-Cloud, Private 5G, and AI Network Management
- Modern Computer Networking: Wi-Fi 6E, Edge Computing, 5G, SDN, and AI Cybersecurity
- Cumulus Linux 3.6 Release Highlights: FRRouting, VRF Route Leaking, and Policy-Based Routing
- Whitebox Switching Providers & Open Network Operating Systems (NOS) Guide
- Google Calendar Custom Recurring Events Using iCalendar (.ics) RRULE Definitions
- What Is Software-Defined Networking (SDN) and How Does Controller-Based Automation Work?
- Open-Source Networking & Disaggregated Switching: Juniper vs. Cisco in the Data Center
Juniper & Junos
9 ArticlesJuniper Networks Junos OS CLI, EX/QFX/MX routing and switching, Virtual Chassis, and network automation.
- Juniper EX4300 Junos OS Firmware Downloads and MD5 Checksums
- Juniper EX4300 Front-Panel Port Map and Junos OS VLAN Interface Configuration
- Fixing Juniper Junos ‘error: device ae1 not found’ When Configuring LACP Aggregated Ethernet
- Resetting a Juniper EX Switch After Removing a Node from a Virtual Chassis
- Understanding Juniper Junos OS CLI Modes: FreeBSD Shell, Operational, and Configuration
- Juniper Junos Candidate Configuration Modes: Exclusive, Private, and Dynamic
- Cisco IOS to Juniper Junos OS CLI Command Reference Table
- Juniper Junos OS CLI Keyboard Shortcuts and Line-Editing Reference
- Transitioning from Cisco IOS to Juniper Junos OS: First Impressions and Architecture
Cloud, SDN & Whitebox
7 ArticlesDisaggregated whitebox switching, Cumulus Linux, FRRouting (FRR), Open Compute Project (OCP), SDN, and OpenStack Neutron.
- Autonomous Cloud & Infrastructure SecOps: Integrating Wazuh SIEM/XDR, HashiCorp Vault, and Agentic AI Across AWS, GCP, and Proxmox Fleets
- Cumulus Linux 3.6 Release Highlights: FRRouting, VRF Route Leaking, and Policy-Based Routing
- Whitebox Switching Providers & Open Network Operating Systems (NOS) Guide
- OpenStack Neutron CLI Commands: Creating IPv4 and IPv6 Subnets
- Changing a Linux or Cumulus Switch IP Address Remotely Without Losing SSH Connectivity
- Recovering a Cumulus Linux Switch from U-Boot and Missing sysroot2 Partition Errors via TFTP
- What Is Software-Defined Networking (SDN) and How Does Controller-Based Automation Work?
Cisco & IOS
4 ArticlesCisco IOS/IOS-XE/NX-OS routing, switching, interface telemetry, and cross-vendor CLI references.