Bogdan Rădulescu

Principal Architect · Cloud, Infrastructure & Security

Summary

Bogdan Radulescu

I design, secure and operate platforms for businesses where a transaction has real consequences: payments, real-estate settlement, transaction risk, telecoms regulation, high volume gaming and privacy software. Sixteen years of that, and twenty years in open source.

I built a PCI DSS compliant datacenter in Poland for a European payment service provider. I owned the security and infrastructure architecture behind spectrum auctions run by national regulators in nine countries, where bids are legally binding and going down inside a timed round is a legal problem, not a missed SLA.

I have also run cloud strategy in both directions. I've put clients on AWS, then years later moved them off it onto private cloud when cost and data sovereignty changed the calculation. Many architects have written a cloud exit plan. I have carried some out.

Lately I built Fono, a private on-premise voice and LLM inference stack in Rust, and published my own quantisation work next to it. So when a conversation turns to AI platforms I can talk about latency budgets, GPU sizing and cost per token from having built the inference layer myself.

Selected Highlights

Capabilities

Architecture & Design
Solution, platform and security architecture. Target-state roadmaps, migration planning and decision records. Non-functional requirements and trade-offs, HA/DR (RTO/RPO), cloud exit strategy and concentration risk, third-party risk, design authority and architecture review. Advisory to executives, mentoring and training.
Regulatory Context
Delivered under PCI DSS, GDPR. Delivered into PSD2 payment services, TRID/RESPA consumer disclosure, national telecom regulation. Working knowledge DORA, NIS2, ISO 27001, EU AI Act.
Security & Zero Trust
Threat modellingSegmentation (CDE scoping, netfilter, nftables)Zero trust (Cloudflare Access, JWT SSO)VPN (WireGuard, IPsec, OpenVPN)Identity (IAM, least privilege, segregation of duties)Secrets (key management, rotation)HardeningAudit loggingVulnerability management
Cloud & Infrastructure
AWS (EC2, VPC, EKS, ECS, RDS, S3, CloudFront, Route 53, IAM, Secrets Manager, CloudFormation)Private cloud (Proxmox, OpenStack)AzureGCPHosting (Scaleway, Linode, Digital Ocean)Hybrid & repatriationDatacenter design & build
Platform & Delivery
Kubernetes (Helm, ArgoCD, GitOps)Infrastructure as code (Terraform, OpenTofu)Configuration management (Ansible, SaltStack, Puppet)CI/CD (GitHub Actions, GitLab CI, Jenkins, TeamCity)DockerSupply-chain security
Data & Event-Driven
Streaming & event-driven patternsReal-time alertingDatabases (PostgreSQL, MySQL, MongoDB, Redis, Vertica, Oracle)Data lake integrationFine-grained access controlReplication & failover (PITR backups)Query tuning & indexingRetention & data minimisation
AI & GenAI Platform
Private inference (llama.cpp, KV-cache snapshotting)Model optimisation (quantisation, imatrix calibration)Capacity (GPU sizing, latency budget, cost per token)Speech (Whisper STT, TTS pipelines)MCP tool callingData sovereignty
Observability & Cost
Monitoring (Prometheus, Grafana, Loki, OpenTelemetry)SLI/SLO definitionCapacity planningPerformance tuningProfiling (to direct optimisation)Incident responsePostmortems & runbooksFinOps (TCO, right-sizing, build vs buy)Cost visibility (tagging, allocation, forecasting)
Linux & Systems
Linux (NimbleX own distro, systemd hardening, kernel patching)Networking (routing, LVM, RAID)Embedded Linux on x86 & ARMServices (NGINX, Apache, Varnish, Postfix)Languages (Rust, Bash, PHP, Node.js)

Work Experience

Principal Architect & Consultant NimbleX, International

Independent practice

Independent architecture practice serving six industries across Europe, the Middle East and Africa. Engagements are typically multi-year and span target-state design, security architecture, cloud strategy, migration execution and the operational reality afterwards. I advise developers, engineering leadership and executives, and I stay hands-on, so my cost, latency and failure-mode estimates come from measurement rather than assumption.

  1. PayU Payments & Financial Services 1 year

    Designed and delivered a PCI DSS compliant datacenter build in Poland for a regulated payment service provider. Owned the infrastructure and network architecture: cardholder data environment scoping and segmentation, access control and segregation of duties, key and secrets management, hardened build standards, and the logging and audit evidence required for assessment.

  2. Specure Regulatory Systems & Internet Infrastructure 10 years

    Security and infrastructure architect across both product lines, sold to national regulators.

    Spectrum auctions. Bids are legally binding, so the design had to hold bid integrity, non-repudiation and an audit trail a court can reconstruct, and stay available through timed rounds on fixed dates. Delivered in nine jurisdictions, including UKE (Poland) and Traficom (Finland), in SMRA and Combinatorial Clock formats. Mechanism design sat with Specure; I owned the infrastructure beneath it.

    Measurement platform (nettest). Moved it onto AWS, then onto private cloud years later as cost and data sovereignty shifted.

  3. Zniper Real-Time Transaction Risk & Betting 5 years

    Architected the infrastructure for a streaming and big-data platform serving operators in high-transaction industries. Use cases include notifying risk teams of suspicious card transactions, alerting on unusual purchase behaviour and wallet value, and warning on capacity thresholds, correlating live streams with historical data under fine-grained access control. The same patterns apply to fraud detection, AML monitoring and payment risk alerting.

  4. TitleCapture / Netsheet Real-Estate Settlement Fintech 5+ years

    Architected and built the AWS infrastructure for a multi-tenant US real-estate settlement platform used by 1500+ title agencies, whose closing-cost and net-sheet output feeds lenders' Loan Estimates, a regulated consumer disclosure. Modernised the CI/CD pipelines, added security controls and tuned performance across the platform.

  5. eRepublik Labs Gaming 16 years

    Sixteen years of platform ownership across several technology generations, and my longest client relationship. Grew the estate from a few physical hosts with little automation to ~200 cloud instances across multiple projects and environments, fully automated. Introduced continuous integration to support a reliable QA and release process, configuration management for repeatable provisioning, and monitoring throughout. Advised developers on scalability and introduced profiling to direct optimisation.

  6. Kape Technologies Privacy Software & Advertising 2 years

    Built and ran consumer privacy infrastructure for an LSE-listed security software group (CyberGhost VPN, Crossrider). Operated a large server fleet across many jurisdictions and designed to data minimisation and no-log constraints, where a logging decision is a privacy commitment rather than an operational preference. Very high traffic volumes with big scalability swing in infrastructure shaped the architecture throughout.

Fusion Appliances Ltd. Bucharest/Romania

Co-founder

Co-founded a networking appliance company to address the need for high-performance devices that are quick to set up. Owned the Linux firmware for three products, the relationship with the Chinese hardware manufacturer, and parts of commercial and administrative operations.
The appliances ran a heavily patched kernel handling routing, network buffers and CPU scheduling differently from stock, and were designed to be fully resistant to power loss. Achieved a three-month time to market, with the first units working as specified from the first release.

CloudHero Bucharest/Romania

Co-founder

A platform for deploying applications across any cloud provider, letting teams stand up scalable environments in minutes and deploy or roll back at will. I owned product, talking to users and developers, and implemented parts of the underlying platform.

Avantaj Consulting Bucharest/Romania

Linux Trainer

Designed the curriculum against LPI objectives, prepared and delivered lectures with accompanying laboratory sessions, and devised the assessments used to evaluate students.

Earlier roles Romania / USA

Linux developer, database administrator, technical editor

Energy Onix (Freelance/USA, 2007–2010). Lead developer for three Linux-based professional audio streaming products, building a custom distribution on earlier NimbleX work with a patched kernel and hand-picked userspace to minimise latency and guarantee stability; automated unit deployment and test cases to remove human error.
Romanian Soft Company (2008–2009). Outsourced to Petrom, maintaining the Oracle rail traffic control database and the application governing the national petroleum transport process. Mission critical: any downtime delayed the transport of hundreds of tons of product.
InfoARIS (Freelance, 2007–2008). Deployment and analysis of test and production servers for a state project, CMS customisation, security testing, contractual documentation and end-user training for CSSPP personnel.
Softpedia (2005–2006). Founded the site's Linux section, writing reviews and how-tos across the ecosystem.

How I Work

Open Source & Technical Leadership

Twenty years of open-source work, still shipping.

Fono
A private, on-premise voice and LLM inference stack. Architecture includes a modular design for diffieren functionality, KV-cache snapshotting for prefix-invariant reuse, LRU memory budgeting, MCP tool calling, an OpenAI-compatible gateway, a Wyoming server and, among others, a public roadmap.
NimbleX
My own Linux live distribution, released in 2005 and bootable from CD, USB or network. Reviewed as one of the fastest-booting live systems of its day, it was the only one to fit a full KDE desktop into 200 MB, and the first one to have a web builder generate custom images in a browser.
nettest
Rust implementation of regulator-grade network measurement (RMBT protocol) over TCP, WebSocket and TLS, with hardened systemd units and cross-platform CI.
Model quantisation
Asymmetric GGUF quantisations on Hugging Face: routed experts pushed to ~2 bits while attention, router and embeddings stay near-lossless, so a 35B model is a third smaller than the uniform 4-bit build and stays within a point of it on a coding benchmark. Method and limits published.
Upstream contributions
Linux kernel, Buildroot, llama.cpp, whisper-rs, sherpa-onnx, ESPHome, htop, home-assistant/core, slackbuilds and others
Other projects
odoo-auth-cloudflare-access. Zero-trust SSO through Cloudflare Access JWT verification. ro-grid. Romanian power grid data.

Full portfolio: github.com/bogdanr

Selected Writing

Education

University "Politehnica" Bucharest

MBA, 2009 – 2010

University "Politehnica" Bucharest

BSc, Materials Science, 2004 – 2008

Certifications

Kubernetes (LFS258)

Dec 2025

Learning How to Learn

Feb 2023

SaltStack Certified Engineer

Apr 2016

AWS Business Professional · AWS Technical Professional

Sep 2014

Digital Analytics

Oct 2013

M102: MongoDB for DBAs

Jun 2013

Linux Systems Administrator

Jun 2010

Languages

Romanian Native  ·  English Full professional proficiency

Interests