Skip to main content
Galiceau.
FREN
  • Cloud Enterprise
  • Artificial Intelligence
  • Architecture
  • Governance
+16 yearsdesigning mission-critical systems

Jocelyn Fontaine

Cloud & AI Architect

I turn complex architectures into secure, scalable, production-ready systems.

Available for freelance engagements

Get in touchView track recordDownload CVEN
  • LinkedIn
  • GitHub
  • Medium
  • Malt
Jocelyn Fontaine

Galiceau

AWS Community Builder

engagements delivered
29engagements delivered
clients served
23clients served
certifications
2certifications

« A Curious Mind is A Healthy Mind »

Trusted by

  • Solvay
  • Cegid
  • Airbus
  • Monaco Government
  • Air France-KLM
  • Roche Diagnostics
  • AXA
  • Safran
  • BPiFrance
  • Vallourec
  • Smeg
  • Orange

01

Areas of expertise

Three domains I own end to end, from design through to production.

AWS Architecture & Cloud Security

Design of critical AWS architectures: Landing Zones, identity management, transit gateway and multi-layer security for governments and major industrial groups.

  • Multi-account Landing Zones: identity baseline, Transit Gateway, Site-to-Site & Client VPN
  • End-to-end cloud security: IAM least privilege, KMS BYOK, WAF, CloudFront, Private CA
  • Enterprise SSO: Keycloak, SAML/OIDC, identity federation
  • Risk assessment and remediation on complex platforms, compliance alignment
  • High availability and disaster recovery for regulated sectors
  • IAM
  • KMS BYOK
  • Transit Gateway
  • WAF
  • CloudFront
  • Private CA
  • Keycloak

Autonomous AI Systems & Secure RAG

Production-grade RAG architectures and autonomous agents: ingestion, retrieval with document-level access control, audited LLM generation and hybrid decision loops.

  • End-to-end RAG architecture: ingestion, retrieval, generation, authentication, audit
  • Vector search with document-level permissions
  • LLM pipelines with token control, retry strategies and concurrency management
  • Autonomous agents: hybrid decision-making (deterministic veto + LLM scoring)
  • Human-in-the-loop via Telegram, complete audit trails and traceability
  • Property-based testing for system invariant validation
  • Amazon Bedrock
  • Python FastAPI
  • PostgreSQL pgvector
  • ECS Fargate
  • Hypothesis
  • Terraform

FinOps & Infrastructure-as-Code

AWS cost optimization and deployment industrialization: Terraform Enterprise, Vault Enterprise, native CI/CD and observability across multi-site platforms.

  • Cost optimization: Saving Plans, BYOL, data consumption, FinOps architecture
  • Infrastructure-as-code with Terraform Enterprise and Vault Enterprise
  • Automated orchestration and deployment across national and European sites
  • Native AWS CI/CD: CodeBuild, CodePipeline, EventBridge
  • Observability: CloudWatch, Grafana, Prometheus, Splunk, Dynatrace
  • Complex application migrations (lift-and-shift, refactoring) and 24×7 run
  • Terraform Enterprise
  • Vault Enterprise
  • CodePipeline
  • Grafana
  • Prometheus
  • GitLab

02

Selected engagements

A selection of recent, structuring engagements. The full track record lives on its own page.

Solvay

AWS Solution Architect

Current

Since November 2025

Leading AWS architectures for the group's applications and Landing Zone.

  • Definition and design of solutions for Solvay applications and Landing Zone
  • High Level Designs for AWS-hosted projects, with constant documentation review
  • AWS platform leadership alongside the Infra Lead Architect, ownership of AWS changes
  • Collaboration with and guidance of Infrastructure Cloud Engineers
  • Proposals to increase platform robustness and security
  • Collaboration with the FinOps team on cost control and reduction
  • AWS
  • Azure
  • Jenkins
  • Terraform
  • IAM
  • EC2
  • S3
  • AWS Backup

Galiceau

AI Systems Architect — Secure RAG Platform

CurrentFreelance

Since 2026

Design of a production-grade RAG platform for querying enterprise documents, with strict access control and full auditability.

  • End-to-end architecture: ingestion, retrieval, generation, authentication, audit
  • Vector search with permissions enforced at document level
  • LLM pipelines with token control, retry strategies and concurrency management
  • Secure AWS infrastructure: KMS BYOK, IAM least privilege, observability
  • Property-based testing to validate system invariants
  • Python (FastAPI, asyncio)
  • Amazon Bedrock
  • PostgreSQL pgvector
  • ECS Fargate
  • RDS
  • KMS
  • Cognito
  • Terraform
  • React/TypeScript

Galiceau

Agentic AI Systems Architect — Multi-Platform AI Agent

CurrentFreelance

Since 2026

Design and development of an autonomous AI agent generating, evaluating and publishing content on LinkedIn and X.

  • End-to-end autonomous agent: generate / evaluate / decide / act
  • Hybrid decision system: deterministic veto + LLM scoring
  • RAG-based knowledge system enforcing tone, style and constraints
  • Autonomous engagement agent: feed scanning, reply generation, strategy execution
  • Human-in-the-loop control maintained through Telegram
  • Optimization under constraints: API cost, rate limits, scheduling
  • Amazon Bedrock
  • Python
  • Terraform
  • EC2
  • Lightsail
  • S3
  • IAM
  • Hypothesis
  • Telegram Bot API
  • X API

Cegid

AWS Architect & Lead DevOps

October 2024 — October 2025

Supporting the Cloud team in implementing the group's AWS platform.

  • Tech Lead and consulting advisor on AWS and DevOps topics
  • Design and implementation of the AWS Landing Zone
  • Support for migrating Cegid applications to AWS
  • Design and implementation of CI/CD chains for dedicated AWS pipelines
  • FinOps support: Saving Plans, BYOL, data consumption optimization
  • Terraform
  • AWS Cloud WAN
  • Transit Gateway
  • Direct Connect
  • IAM
  • Checkpoint Firewall
  • Azure DevOps
  • JFrog
  • Dynatrace

Monaco Government

AWS Solution Architect

Freelance

May 2022 — February 2024Monaco

Definition, design and deployment of a sovereign Data Platform for the Government of Monaco.

  • Data Platform Landing Zone: identity baseline, Transit Gateway, Site-to-Site VPN, Client VPN
  • Terraform Enterprise and Vault Enterprise architecture
  • Keycloak architecture for SSO integration (SAML & OIDC) across all core applications
  • Vault-based Public Key Infrastructure
  • AWS EC2
  • RDS
  • Route 53
  • ACM
  • KMS
  • ECS
  • Terraform
  • Vault
  • GitLab
  • Keycloak
  • SSO

Airbus

IT Architect — Physical Design Activities

Freelance

July 2012 — December 2017Saint-Martin du Touch

Five and a half years designing the physical layer of new Airbus solutions and infrastructure, aligned with functional architecture and business SLAs.

  • Led the technical design of new solutions per functional architecture and Business Service Level Requirements
  • Alignment with Airbus standard middleware (VAX/VMS, MS SQL, DB2, AIX, Websphere, Tomcat, Oracle, Windows Server)
  • Alignment with security policy and operational constraints
  • Definition of infrastructure components (IaaS, PaaS, storage, network) per Airbus standards
  • High availability infrastructure design, technical architecture workshops
  • Deployment cost estimation (hardware, software, operations, design) and architecture scenario evaluation with pros/cons analysis
  • J2EE
  • .NET
  • LDAP
  • Unix/Solaris
  • Websphere
  • Tomcat
  • Siteminder
  • Kerberos
  • Windchill
  • AIX
  • VMS
  • ESX
  • Active Directory
  • Grid Computing
See all 29 engagements

03

Technical skills

The technologies I design, secure and operate with every day.

Cloud Platforms

  • AWS EC2
  • ECS
  • EKS
  • RDS
  • S3
  • IAM
  • KMS
  • Lambda
  • API Gateway
  • CloudFront
  • WAF
  • ALB
  • Route53
  • EventBridge
  • Azure
  • GCP

Infrastructure & DevOps

  • Terraform
  • Terraform Enterprise
  • Vault Enterprise
  • GitLab
  • Azure DevOps
  • Jenkins
  • Kubernetes
  • Docker
  • Git

Security & Compliance

  • IAM
  • KMS BYOK
  • Private CA
  • WAF
  • CloudFront
  • Cognito
  • Keycloak
  • SAML/OIDC
  • SSO
  • Siteminder
  • Kerberos
  • LDAP
  • OpenLDAP

FinOps & Architecture

  • AWS FinOps
  • Cost Optimization
  • High Availability
  • Disaster Recovery
  • Landing Zone Design
  • Transit Gateway
  • Direct Connect
  • Site-to-Site VPN
  • TOGAF

AI & Data

  • Amazon Bedrock
  • PostgreSQL pgvector
  • Python (FastAPI, asyncio)
  • LLM Pipelines
  • RAG Systems
  • Hypothesis

Monitoring & Observability

  • CloudWatch
  • Splunk
  • Grafana
  • Prometheus
  • InfluxDB
  • Dynatrace
  • Centreon
  • NAGIOS
  • Graylog

Legacy & Middleware

  • J2EE 1.4-5
  • .NET
  • Websphere 5-6
  • Tomcat
  • Apache
  • Struts
  • Spring
  • Hibernate
  • Active Directory
  • Alfresco
  • Windchill
  • Foundry

04

Projects

Public GitHub repositories, sorted by stars.

secure-rag

Production-ready RAG platform on AWS — FastAPI, pgvector, Bedrock, Cognito, Terraform. One-command deployment.

  • aws
  • bedrock
  • cognito
  • fastapi

Python

ssm-forwarding

Demonstration of SSM Forwarding feature ofr DB access

  • aws
  • bash
  • database
  • hcl

HCL

cloudwatch-eks-workshop

CloudWatch observability workshop for Amazon EKS — metrics, logs, and traces

  • aws
  • cloudwatch
  • eks
  • observability
See the full GitHub profile

05

Blog

Technical articles published on Medium.

Velero For AWS EKS

Presentation 🚨 #Kubernetes is the engine of your cloud infrastructure, but what happens in case of failure, human error, or natural disaster? 😱 Is your Kubernetes data safe?…

Read article →

GitLab On AWS

PART 3: Installing GitLab and Management of Backup/Restore 💾 In the last episode, we saw how to build an evolvable GitLab architecture according to key principles, controlling…

Read article →

GitLab On AWS

PART2 : Building an Evolvable GitLab Architecture In the last episode , we talked about the dream architecture for GitLab. To build an evolvable architecture, we will simplify it…

Read article →

All articles

06

Contact

An architecture to design, a security audit, an AI platform to ship to production? Drop me a line.

Book a call

Pick a slot straight from my calendar.

or by email

jocelyn.fontaine@galiceau.fr

📍 Gaillac-Toulza (31550), France

Elsewhere