Boutique Practice · Operating Model
Engineering consultancy, not advisory theater.
Oxolyth exists because critical infrastructure deserves engineers, not account managers. We partner directly with the teams building and operating critical systems.
Practice Leadership
Principal Cloud & Security Architect
Danylo Hrytskyi
Lead Architect & Founder · Ukraine / Remote
Cloud & Security Architect with hands-on experience designing, securing, and operating production environments across Google Cloud Platform and AWS. Currently serving as the primary GCP security architect for a major national bank, architecting cloud security from the ground up across all enterprise environments.
Specialized in DevSecOps, secure-by-design cloud architecture, Kubernetes platforms (GKE & EKS), and deterministic Infrastructure as Code. Master of Computer Engineering from Taras Shevchenko National University of Kyiv.
Verified Credentials
5× Google Cloud Certified
- ✓GCP Professional Cloud Architect
- ✓GCP Professional Cloud Security Engineer
- ✓GCP Professional SecOps Engineer
- ✓GCP Professional Cloud DevOps Engineer
- ✓GCP Associate Cloud Engineer
Multi-Cloud: AWS & GCP Enterprise
Education: M.S. Computer Engineering
Focus: Banking Security & DevSecOps
Field Engagements
Selected Architectural Case Studies
Representative engineering teardowns across banking-grade cloud security, multi-cloud platform automation, and Kubernetes cost reduction.
Banking-Grade Cloud Security & Organization Landing Zone
The Challenge
A major national banking institution required a secure-by-design cloud security architecture to migrate sensitive financial workloads to GCP under strict regulatory and audit mandates.
Architectural Solution
Engineered hierarchical GCP Organization landing zones, multi-region VPC Service Controls, least-privilege IAM matrices, and automated continuous compliance telemetry.
Verified Outcomes
- →100% regulatory audit compliance across banking workloads
- →Zero long-lived service account keys in production environments
- →Deterministic Terraform landing zones with automated drift detection
Multi-Cloud DevSecOps & Terraform Infrastructure Platform
The Challenge
A high-growth engineering organization faced deployment bottlenecks, manual release overhead, and configuration drift across multi-cloud environments.
Architectural Solution
Designed modular Terraform/OpenTofu architecture with CI/CD plan-and-apply pipelines, OPA Conftest policy enforcement, and containerized Cloud Run / Kubernetes platforms.
Verified Outcomes
- →70% reduction in manual release effort and deployment cycle time
- →100% reproducible environments across staging and production
- →Zero unreviewed or un-audited infrastructure changes in production
Production Kubernetes Hardening & FinOps Capital Recovery
The Challenge
Over-provisioned multi-tenant Kubernetes clusters with loose pod network isolation and escalating monthly cloud compute expenditures.
Architectural Solution
Implemented dynamic node autoscaling, Workload Identity federation, Cilium eBPF network security policies, and ARM/Graviton instance pool migrations.
Verified Outcomes
- →31% median reduction in monthly cloud compute expenditure
- →Zero container security incidents with kernel-level eBPF isolation
- →Sub-minute node scale-out latency for high-throughput traffic spikes
Foundational Values
What We Believe
Engineering Over Advisory
We write code, review architectures, and sit in war rooms. We don't produce high-level strategy decks or maturity matrices. Deliverables compile and deploy.
Depth Over Breadth
Fewer engagements, deeper technical involvement. Every project is staffed with principal engineers — not junior analysts supervised by a partner who appears only at kickoff.
Complete Transparency by Default
You receive direct access to all work as it happens — Git repositories, CI/CD pipelines, architectural decision records (ADRs). When we leave, your team owns 100% of everything.
Vendor Independence
We do not resell vendor licenses or accept referral commissions. Our architecture recommendations are based strictly on engineering merit and workload constraints.
Operating Model
The Senior Network Model
We assemble specialized teams for each engagement from our verified network of principal practitioners. Every team member has deep domain expertise in the specific problem being solved.
Scoping
Fixed deliverables and timelines agreed before work begins.
Embedding
Practitioners join your repo, standups, and deploy pipelines.
Ownership
Runbooks, docs, and clean handoff. You own all IP and artifacts.
Qualification
What We Look For
We only take on work where we can deliver measurable engineering outcomes. If we aren't the best fit, we will tell you directly.
Clear Technical Challenge
We engage where the problem is engineering, not organizational bureaucracy. If it can be defined in terms of systems, scale, and constraints, we can solve it.
Collaborative Engineering Team
We embed alongside your existing engineers — not replace them. The best architectures come from teams that pair-program, challenge assumptions, and build together.
Willingness to Own the Solution
We build systems your team operates long after we leave. That requires an appetite for knowledge transfer, runbooks, and automated testing.
Problems Worth Solving Properly
Some problems warrant quick temporary patches. Others demand solid engineering from the ground up. We take on the latter — where cutting corners creates compounding operational risk.
The right engagement starts with the right conversation.
Our first call is technical, not commercial. Tell us about your systems and what you are trying to achieve.