Kumokage GmbH · Zürich, Switzerland
Secure, resilient cloud platforms.
AWS-first cloud architecture, information security and AI systems: designed, built and proven by the architect who owns them.
What we do
Principal-led cloud engineering, AWS first.
Landing zones & governance
Multi-account AWS foundations with Control Tower, Organizations and SCPs, IAM Identity Center federated with Microsoft Entra ID or Google Workspace, guardrails as code in Terraform or CDK.
Information security & compliance
Network perimeters with Transit Gateway, Network Firewall, CloudFront, WAF and Shield Advanced; Security Hub remediation; KMS and Secrets Manager; immutable S3 Object Lock archives; email authentication; incident response.
Platforms & resilience
Production EKS and ECS platforms with GitOps and Karpenter, Aurora and Valkey data tiers, multi-region disaster recovery designed as code and validated in live failover drills.
AI systems
Governed agentic platforms on Amazon Bedrock AgentCore: RAG with cited sources, agents that review merge requests and recommend while people change production, credential-less OIDC delivery.
Leadership & enablement
Fractional principal-architect mandates, project leadership, and hands-on workshops for engineering teams.
Track record of our founder, 2023–2026
7
production zones of live game titles moved from Cloudflare to CloudFront, WAFv2 and Shield Advanced, on budget
11
AWS accounts with credential-less OIDC deploy roles for an agentic developer platform
≈51%
licensing cost cut by a 7-year immutable email-compliance archive (about USD 12k a year)
10
email domains hardened with SPF, DKIM and DMARC after a brand-impersonation attack
Multi-region disaster recovery for EKS, Aurora and Valkey built as one parameter-driven workflow and validated in a live failover drill.
Selected engagements led by our founder
Current clients are described, not named. Work before October 2026 was delivered through Aspect Solutions Unipessoal Lda or as an employee or contractor of the firms named.
Mar 2026 – present
AWS platform engineering, edge migration & disaster recovery
Global mobile & web gaming publisher · via a consulting partner
Owns the Terraform platform behind three live titles (six EKS and eleven Aurora clusters). Moved seven production zones from Cloudflare to CloudFront, Route 53, ACM, WAFv2 and Shield Advanced on budget, including Origin Shield tuning with estimated savings of about USD 6.4k a month. One Terraform-managed DR platform for EKS, Aurora, Valkey and CI hosts, validated in a live failover drill; multi-region AWS Backup with vault lock; Amazon MQ upgrades; a 12-exercise CloudFront/WAF workshop for 12 engineers.
Terraform · EKS · Aurora · CloudFront · WAFv2 · Shield Advanced · Valkey · AWS Backup · Amazon MQ
Jul 2025 – present
AI-native internal developer platform
Global semiconductor & IoT technology company · via a UK staffing partner
Principal architecture and hands-on delivery of a production generative-AI developer platform on Amazon Bedrock AgentCore: multi-agent orchestration, serverless APIs and event-driven services. DEV/TEST/PROD delivery with Python CDK and GitLab OIDC across eleven AWS accounts; Cognito and Entra ID federation; least-privilege IAM and security remediation; governance across 23 repositories and 7 generated applications; SVN-to-GitLab modernisation.
Bedrock AgentCore · Lambda · EventBridge · DynamoDB · AWS CDK · GitLab OIDC · Cognito · Entra ID
Aug 2023 – present
Cloud platform, compliance archive & security operations
FCA-regulated fintech group
Control Tower landing zone with Security Hub and Google Workspace SSO into IAM Identity Center; GitLab OIDC CI/CD; ECS microservices streaming real-time market data; AppSync GraphQL; Managed Grafana. Immutable 7-year email archive on S3 Object Lock (218k messages from 97 dormant identities) that cut licensing about 51%. Led the response to a P1 brand-impersonation attack, hardened SPF/DKIM/DMARC on ten domains, migrated Microsoft 365 to Google Workspace.
Control Tower · IAM Identity Center · ECS · AppSync · S3 Object Lock · KMS · Managed Grafana · Route 53
Jan 2024 – Dec 2025
Landing zone & multi-tenant Kubernetes
Gas infrastructure operator (critical infrastructure) · via ReeVo Cloud & Cyber Security
Control Tower, Security Hub and IAM Identity Center federated with Entra ID; hub-and-spoke Transit Gateway with Direct Connect and VPN failover; Network Firewall with Suricata; multi-tenant EKS with ArgoCD GitOps and Karpenter; private NLB to API Gateway to CloudFront delivery with WAF, Cognito and KMS.
EKS · ArgoCD · Karpenter · Transit Gateway · Direct Connect · Network Firewall · Terraform
Feb 2023 – Jan 2024
Enterprise landing zones & data protection
European institution (via PwC Luxembourg) · Volkswagen Digital Solutions
Institution-wide backup strategy on AWS Backup aligned to the AWS Data Protection Reference Architecture; automated firewall threat lists; remediation of exposed resources from Security Hub and Config findings; secure accounts inside the MAN-compliant Group landing zone with Step Functions provisioning.
AWS Backup · Network Firewall · Security Hub · Config · StackSets · CDK · Step Functions
How we engage
- Assess:
- a fixed-price review of security, landing zone or DR readiness, with a prioritised plan.
- Build:
- fixed-scope delivery of landing zones, migrations, DR, CI/CD or AI platforms.
- Run:
- a monthly architecture retainer, an accountable architect for your AWS estate.
- Workshops:
- hands-on sessions for engineering teams.
How we work
- Everything as code (Terraform, CDK), peer-reviewed and plan-gated.
- Changes through your change management.
- Least privilege and no static credentials by default.
- Resilience proven with drills, not assumed.
- Documentation and knowledge transfer included.
Founder
Raffaele Sollecito
Founder & Managing Director · Principal Cloud Solutions Architect
Raffaele leads every Kumokage engagement as the accountable architect. He has more than ten years in software engineering, seven of them on AWS: as an independent principal architect, a cloud architect for a European institution through PwC Luxembourg, a cloud solutions architect at Volkswagen Digital Solutions, a solutions architect at ITnet and an AWS DevOps engineer at Tantosvago.
AWS certifications
- AWS Certified Solutions Architect – Professional
- AWS Certified Security – Specialty
- AWS Certified Solutions Architect – Associate
- AWS Certified Cloud Practitioner
AWS programme roles
- AWS Certification Subject Matter Expert – Associatecontributes to AWS Certification exam development
- AWS Partner: Technical Accredited
The name
雲 kumo is the cloud, 影 kage its shadow. Powerful infrastructure, quiet operations.
Contact
Talk to the architect, not a sales team.
Tell us about your AWS estate and what has to stay up. You will hear back from the architect who would do the work.
Working languages: English and Italian. Serving clients in Switzerland and across Europe.