↓Skip to main content
Chrisando Wagner
Cloud Architect, Principal Scope  |  Platform Engineering Leader  |  DevSecOps Strategist
Johannesburg, Gauteng, South Africa
Technology leader with 25+ years in ICT, currently architecting secure, cost-optimised multi-cloud platforms (AWS & Azure) for mission-critical banking workloads inside one of South Africa's largest financial services groups. Operates at principal scope: setting enterprise-wide cloud and containerisation strategy, translating banking-grade regulatory requirements (POPIA, PCI-DSS) into reference architectures and IaC guardrails other engineering teams build against, and owning the FinOps governance program across the cloud estate. What differentiates this profile from most architects at this level is that the depth is not theoretical — a self-built, production-grade Kubernetes platform (Terraform, Ansible, ArgoCD GitOps, Cilium eBGP, full DevSecOps toolchain) proves every pattern recommended in a design review has actually been operated, broken, and fixed at 2am. That hands-on grounding sits on top of broad infrastructure breadth spanning VMware/ESXi, OpenStack private clouds, Red Hat ecosystems, complex Microsoft Server estates, hybrid cloud architecture, and a deep Cisco/BGP/OSPF networking background. Postgraduate Diploma in Software Engineering (University of Liverpool); pursuing Ph.D.
Key Achievements
  • Set enterprise-wide cloud and containerisation strategy for a top-tier banking group — architecting the shift from infrastructure management to platform design across AWS, Azure, and on-premise VMware/Red Hat estates.
  • Own the FinOps governance program end-to-end: architecture for efficiency, cost-optimisation tooling, and the guardrails that keep engineering teams accountable to it, across a regulated multi-cloud estate.
  • Translate banking regulatory obligations (POPIA, PCI-DSS) into concrete, reusable reference architectures and IaC patterns — bridging compliance and engineering rather than treating them as separate concerns.
  • Designed and automated a production-grade, highly-available Kubernetes platform end-to-end (Terraform, Ansible, ArgoCD GitOps, Cilium eBGP, full DevSecOps toolchain) as hands-on proof of execution behind every architecture recommendation.
  • Six-plus years embedded in the same banking group, progressing from Technical Team Lead to Cloud Architect — combining deep institutional and regulatory knowledge with hands-on technical leadership and mentorship of multi-disciplinary engineering squads.
↓ Download PDF
Professional Experience
Ebucks (FirstRand Group) 6 yrs 8 mos total
Cloud Architect Dec 2024 – Present
  • Architect, document and evangelise secure, cost-optimised, compliant cloud-native solutions (IaaS/PaaS/SaaS) for mission-critical banking workloads on AWS and Azure.
  • Translate stringent banking regulatory requirements into actionable technical guardrails, reference architectures, and infrastructure-as-code patterns.
  • Champion containerisation strategy across the organisation — driving Kubernetes (EKS/AKS) adoption and embedding DevOps practices into SDLC.
  • Lead cloud security posture: design "secure by default" architectures encompassing IAM, data encryption, network segmentation, and continuous compliance monitoring.
  • Design hybrid cloud architectures bridging on-premise infrastructure (VMware, Red Hat) with public cloud services, ensuring workload portability and data-sovereignty compliance across regulated environments.
  • Own the FinOps program — architect for efficiency, implement governance tooling, and lead cost optimisation initiatives across cloud estates.
  • Serve as trusted advisor and mentor to engineering teams, elevating cloud fluency and best-practice adoption organisation-wide.
Technical Team Lead Aug 2019 – Nov 2024
  • Led system analysis, solution design, and delivery of engineering initiatives across cloud and on-premise environments.
  • Defined and enforced operational standards, ensuring legal and legislative compliance (POPIA, PCI-DSS) across all technical processes.
  • Drove R&D initiatives to evaluate and adopt emerging technologies, directly informing the organisation's cloud migration roadmap.
  • Formulated strategic and operational objectives; implemented KPI dashboards to monitor production health and team performance.
  • Coached, mentored and supervised multi-disciplinary engineering squads; championed an Agile delivery culture.
Syrex (Pty) Ltd 7 yrs 8 mos total
Operations Manager — Support & Incidents Jan 2018 – Aug 2019
  • Owned end-to-end ITSM operations: SLA governance, incident management, and service desk performance reporting.
  • Reduced mean-time-to-resolve (MTTR) through process redesign and introduction of escalation frameworks.
  • Served as executive-level escalation point for high-priority client incidents.
Technical Manager Jan 2012 – Jan 2018
  • Designed and managed highly complex Microsoft Server infrastructures spanning multi-site Windows Server (2000–2012) domains, Active Directory, Exchange (2003–2013), IIS, and MS SQL — including architecture, capacity planning, and lifecycle management across multiple clients.
  • Planned and operated VMware ESXi virtualisation platforms, consolidating multi-client workloads onto high-availability hosts with vSphere management and snapshot-based backup workflows.
  • Administered Linux environments (RHEL/CentOS) including iptables, Bind DNS, Apache, Squid proxy, Sendmail/Dovecot, KVM/Xen virtualisation, and MySQL.
  • Delivered server deployment and network infrastructure projects; configured managed switches, routing, and VOIP (Asterisk).
  • Maintained backup integrity across Vembu, rsync, and enterprise backup solutions; administered Symantec Endpoint security.
  • Acted as Technical Account Manager — providing proactive client engagement and acting as primary escalation authority.
IT Technologies 3 yrs 10 mos
Product Specialist Mar 2008 – Dec 2011
  • Planned, designed, customised and implemented end-to-end software and hardware solutions for clients.
  • Managed and mentored the support department; resolved escalated technical queries from frontline technicians.
  • Delivered onsite, telephonic and remote support; oversaw server provisioning, monitoring, and lifecycle maintenance.
MWeb Business 2 yrs
Network Technician 2006 – 2008
  • Specialised in Cisco routing and switching, BGP, OSPF, VPN configuration, and firewall management, delivering fully managed connectivity solutions to business and enterprise clients.
  • Designed and maintained Cisco firewall policies, site-to-site and remote-access VPN tunnels, and dynamic routing topologies (BGP/OSPF) across diverse client environments.
  • Served as the technical escalation point for managed connectivity incidents, ensuring minimal downtime for business-critical network infrastructure.
Absa Bank 4 yrs
Technical Support — Internet Access 2002 – 2006
  • Provided technical support to banking clients for internet access and email services, resolving connectivity, configuration, and browser-related issues in a high-volume financial services environment.
  • Diagnosed and resolved escalated technical queries relating to internet banking access, email client configuration, and network connectivity across diverse client environments.
  • Gained foundational exposure to enterprise banking infrastructure, security policies, and the operational standards required in regulated financial services.
Personal Projects
Homelab — k3s or RKE2 on Proxmox (IaC) 2024 – Present
  • Designed and automated a production-grade 4-node k3s or RKE2 Kubernetes cluster on Proxmox using Terraform (VM provisioning) and Ansible (configuration, k3s or RKE2 install, Cilium CNI bootstrap).
  • Implemented Cilium as CNI with kube-proxy replacement, eBGP (ASN peering), Hubble observability, and dual-stack IPv4/IPv6 throughout.
  • Full GitOps stack via ArgoCD with sync-wave ordering: Argo Workflows, Argo Events, Argo Rollouts, cert-manager, Envoy Gateway, Sealed Secrets, and CloudNativePG.
  • Blue-green blog deployments via Argo Rollouts with automated pre-promotion analysis (Playwright E2E + k6 smoke tests); Gitea push webhook triggers Kaniko build pipeline.
  • Full observability stack: Prometheus + Grafana (SSO via Keycloak), Graylog + Fluent Bit log pipeline, Uptime Kuma, and Check_MK agent DaemonSet across all nodes.
  • DevSecOps tooling: SonarQube (community branch plugin + Argo Events Gitea webhook integration), Trivy Operator continuous image scanning, OWASP ZAP security scanning, and k6 Operator load testing.
  • Self-hosted productivity stack: Keycloak OIDC provider (SSO for all apps), Vaultwarden, Joplin, Netbird WireGuard mesh VPN, Open edX LMS, and Leantime project management.
  • Storage: DirectPV (MinIO CSI, non-replicated raw disk) + local-path provisioner; CloudNativePG 3-node PostgreSQL cluster + 3-node MariaDB Galera with daily S3/MinIO backups.
Education
Postgraduate Diploma in Software Engineering
University of Liverpool
2019
Computer Technology / Computer Systems Technology
Microsoft
2013
Computer Science
Udacity
2013
Java Programming
Van Zyl & Prichard
2006
Senior Secondary Certificate (Matric)
Corronationville Senior Secondary