Andre Kanmegne

Apprentice who shipped 3 production automations and brought application-deployment autonomy to the France team — spanning automation, solution architecture, ITSM/IAM and cloud migration.

• Developer Deployment Autonomy (France): Took ownership of the German HQ deployment platform and established that capability for the France team — letting French developers build and deploy their own solutions with minimal dependency on central engineering.
• Claims-Invoice Automation (−70%): Python pipeline that ingests, validates and processes claims-invoice batches, with data-quality rules catching inconsistencies before downstream finance systems — cut the cycle ~70% and removed recurring manual QC for the Finance team (approach extended to other workflows).
• Legacy Data Reconciliation: Single-file, repeatable pipeline replacing the manual re-keying of fixed-width mainframe coinsurance extracts (multiple record types, legacy encoding, French locale) — applies the coinsurance/commission/tax logic and produces an audit-ready Excel accounting/claims workbook matching the Finance template.
• Claims-Email Archival Automation (production, 24/7): Python automation replacing the manual drag-and-drop of Outlook emails into the correct claim dossier in the electronic archive (GED): claim-number detection, resolution against a ~36k-entry reference table (hot-reloaded), de-duplication, document import, then confirmation or quarantine with a full audit trail — runs unattended on a Windows VM (Task Scheduler, offline/air-gapped, self-healing) with a tracking dashboard.
• Solution Architecture & AI Transformation: As architect of a custom solution, ran a Software/Solution Evaluation Process (SEP: build-vs-buy, technology/vendor comparison against defined criteria) and scoped an AI-integration prototype for the ITSM platform to improve support and knowledge management; coordinated IT across France and Germany and produced documentation.
• Business Applications & ITSM: Administered and supported 8+ critical enterprise applications (Claims, Underwriting, Finance, HR); operated two-tier ITSM — GLPI (French front-line) and ServiceNow (group escalation) — and contributed to their evolution.
• IT Support & IAM: N1/N2 support for several hundred French users (GLPI) with N3/N4 escalation (ServiceNow); managed business roles and access (IAM) and full onboarding/offboarding, coordinating with HR and the central German teams.
• Cloud & Modern Workplace: Contributed to the modern-workplace/cloud programme (Windows 365, Intune) — testing, validation, user adoption — and supported the lift-and-shift migration of on-premises VMs to Azure IaaS (Azure Migrate) and applications to Azure.

• ETL Pipelines: Built data scraping and extraction pipelines (Python, BeautifulSoup) to automate business intelligence gathering, saving several hours of manual work per week.
• Frontend Refactor: Refactored UI across a hybrid stack (React, TypeScript, Laravel) and applied rendering and asset optimizations to improve Core Web Vitals scores.

State-recognised Bac+5 (RNCP Level 7) covering fullstack development, DevOps, cloud infrastructure, software architecture, and enterprise systems. Core modules: React, Node.js, Next.js, Docker, Kubernetes, GitHub Actions, Azure, Software Architecture, Agile/Scrum, AI & Data Science, Application Security.

My RNCP39583 certification product (a distinct product that runs on the platform, separate from the insurance IS): Retrieva automates DORA (EU 2022/2554) third-party ICT-risk compliance for financial entities — gap analysis of vendor documentation, LLM-scored questionnaires, a compliance copilot, 24-hour monitoring alerts, and EBA Article 28(3) Register of Information export.

• DORA gap analysis: upload vendor docs (PDF/DOCX/XLSX) → semantic chunking → Qdrant → an LLM classifies coverage per DORA article (covered / partial / missing).
• Compliance AI copilot: intent-classified RAG over your documentation + DORA articles, with reranking, context compression and answer validation.
• Vendor questionnaires auto-generated and LLM-scored; 24-hour BullMQ monitoring alerts (certification expiry, contract renewal, overdue annual reviews).
• One-click EBA Register of Information export — a 4-sheet DORA Article 28(3) XLSX workbook (RT.01.01 → RT.04.01).
• Multi-tenant SaaS: workspace isolation, JWT + refresh tokens, RBAC (owner/admin/member/viewer) and LLM output guardrails.

Technologies: Next.js 16 / React 19, Express 5 / Node 20, LangChain, LiteLLM gateway, Qdrant, PostgreSQL, Redis / BullMQ, Socket.io, Kargo (2-image), Docker / Kubernetes

The system-of-record for insurance contracts in the ktayl-solution IS. It owns the policy lifecycle and exposes it as a governed REST API that other domains (underwriting, billing) call to issue and activate real policies.

• Full contract lifecycle (creation → activation → suspension → termination) with coverages and premium tracking, backed by PostgreSQL with SQL migrations.
• Versioned REST API (OpenAPI) consumed machine-to-machine: the underwriting domain obtains an Authentik client-credentials `policy:write` token and creates/submits/activates policies in the live service.
• Event publishing on NATS (policy bound/activated) so downstream domains react without coupling.

Technologies: Go 1.25, PostgreSQL (CNPG), NATS, Authentik (OIDC client-credentials), OpenAPI, Docker, ArgoCD/Kargo (GitOps)

Multi-provider LLM routing and enterprise governance platform built on LiteLLM on Kubernetes. Unified 8 cloud and local providers (Groq, OpenAI, Gemini, DeepSeek, Mistral, Anthropic Claude, HuggingFace featherless-ai via router.huggingface.co, and local Ollama) behind a single API endpoint with intelligent fallback routing (Ollama→Groq→DeepSeek), Presidio PII/DLP scrubbing, 3-tier department key governance with per-dept budget caps and model allowlists, circuit breaker protection, Valkey prompt cache, and full Langfuse LLMOps tracing. Cost visibility delivered via a Grafana dashboard reading LiteLLM's PostgreSQL usage tables. Includes Langfuse v3.201.1 with ClickHouse analytics backend and Authentik OIDC SSO, plus an NVIDIA NIM tier (nemotron-70b, llama-8b, deepseek-r1).

• 8-provider routing: Groq, OpenAI, Gemini, DeepSeek, Mistral, Anthropic Claude, HuggingFace featherless-ai, Ollama — single LiteLLM endpoint
• Intelligent fallback chain: Ollama → Groq → DeepSeek — automatic failover on provider unavailability
• Presidio PII/DLP guardrail — pre-call PII masking with financial-context entity allow-list (years, locations, URLs excluded)
• 3-tier department key governance: per-dept budget caps, model allowlists, and usage quotas
• Circuit breaker (cooldown=60s, allowed_fails=3) + Valkey prompt cache (exact-match, 600s TTL) — resilience and cost optimisation
• Langfuse LLMOps (v3.201.1 + ClickHouse + Valkey + Authentik OIDC) + Grafana cost dashboard via PostgreSQL SQL

Technologies: LiteLLM (AI Gateway), Presidio (PII/DLP), Valkey (prompt cache), Langfuse v3.201.1 (LLMOps), ClickHouse (Langfuse analytics), Grafana (cost dashboard), PostgreSQL (usage data), Ollama (local inference), Python, Kubernetes (k3s), Authentik (OIDC/SSO), GitHub Actions

Built a full multilingual RAG pipeline for French insurance document retrieval across three custom-built repos. minicloud-markitdown-proxy (FastAPI): routes documents by type — PDF/images to Docling OCR, Office/HTML to MarkItDown in-pod — exposing a Docling-compatible API surface. minicloud-rag-ingest (FastAPI): full ingestion pipeline in one HTTP endpoint — convert → structure-aware heading chunk (French insurance regex) → bge-m3 1024-dim embed → pgvector HNSW INSERT. minicloud-postgresql-noavx512: custom PostgreSQL image with pgvector's vector.so rebuilt without -mavx512f/bw/vl/dq to fix a SIGILL crash on i7-8565U/i7-10510U CPUs caused by AVX-512 EVEX instructions in pgvector 0.8.4. Hybrid search layer: BM25 with French Snowball stemmer + NLTK stop-words injected via init container patching rank_bm25/utils.py at pod start. Cross-encoder re-ranking (ms-marco-MiniLM-L-6-v2) filters to top-3.

• minicloud-markitdown-proxy: PDF/images → Docling OCR, Office/HTML → MarkItDown in-pod (Docling-compatible API)
• minicloud-rag-ingest: single HTTP endpoint — convert → chunk → bge-m3 embed → pgvector HNSW INSERT
• minicloud-postgresql-noavx512: vector.so rebuilt without AVX-512 — fixed SIGILL on i7-8565U/i7-10510U (pgvector 0.8.4 SIMD bug)
• French BM25: NLTK Snowball stemmer + insurance stop-words patched into rank_bm25 via Kubernetes init container
• Hybrid retrieval: bge-m3 1024-dim vector + BM25 + cross-encoder re-ranking (ms-marco-MiniLM-L-6-v2, top-3)
• Supply chain: Dockerfile + GitHub Actions CI + cosign keyless signing on both microservices
• Generation step routed through Enterprise AI Gateway (LiteLLM) — RAG retrieval + cloud/local model selection in one pipeline

Technologies: Python, FastAPI, PostgreSQL + pgvector (custom noavx512 build, C / Makefile), bge-m3 (Ollama), Docling (OCR/PDF), MarkItDown, rank_bm25 + NLTK (French BM25), ms-marco-MiniLM-L-6-v2 (cross-encoder), Docker, GitHub Actions, cosign, Kubernetes init containers

Turn the operational systems of the ktayl-solution IS into decision-ready analytics: ingest live source databases, model them with dbt, and expose a curated data product in Metabase — a real vertical slice, not a generic connector framework.

• Ingestion from live source DBs into `raw` (full-refresh COPY), then a dbt medallion (staging → marts) with tested models.
• Data product `policy_portfolio`: joins policy + underwriting by policy_number, computing GWP (authoritative rated premium, falling back to an annualised proxy) and TIV.
• Secret-free, idempotent Metabase provisioner (Python) that creates the analytics data source + cards + dashboard.

Technologies: dbt, PostgreSQL (CNPG), Python, SQL, Metabase, CloudNativePG, ArgoCD (CronJobs/ESO/netpols)

The delivery layer: every cluster resource is declared in Git and reconciled by ArgoCD (app-of-apps). Kargo promotes one immutable artifact dev→prod behind a CODEOWNERS gate, and ArgoCD deploys it — no manual kubectl in production.

• ArgoCD app-of-apps: minicloud-gitops is the single source of truth (apps/ Applications, helm-values/ overrides, services/ manifests); AppProject with locked sourceRepos.
• Two-environment standard (dev + prod) with git-gated auto-sync; prod moves only via a CODEOWNERS-reviewed, GPG-signed PR.
• Kargo multi-stage promotion: CI builds & proves one immutable image, Kargo opens the dev→prod promotion PR, ArgoCD deploys it — CI never touches the cluster.
• Helm golden path: each service is a thin wrapper chart depending on a shared library chart — one Helm render, one ArgoCD source.
• Supply chain on every custom image: Trivy CRITICAL exit-1, Cosign keyless signing (GitHub OIDC → Sigstore Fulcio), syft CycloneDX SBOM as OCI referrers, GPG-signed bump commits.

Technologies: ArgoCD (app-of-apps), Kargo, Helm, Kustomize, GitHub Actions, Cosign, syft (SBOM), Trivy, OPA Gatekeeper, AppProject RBAC

The compute foundation of the platform: a self-hosted 6-node k3s cluster running on repurposed ThinkPad laptops plus a MacBook Pro, provisioned as infrastructure-as-code and hardened to CIS benchmarks. This is the infrastructure layer everything else runs on.

• Everything-as-code lifecycle: MAAS commissions the ThinkPad hardware → OpenTofu owns machine state → Ansible bootstraps k3s — a node is reproducible from bare metal, not a hand-configured pet.
• Cilium eBPF chosen over flannel for identity-aware, default-deny network policy + Hubble flow observability across the fleet; MetalLB serves LoadBalancer IPs on bare metal.
• Longhorn replicated block storage + Velero/CNPG backups to off-cluster MinIO — DB-layer failover + point-in-time recovery on commodity disks, where storage is the thing that actually fails.
• CIS-hardened kubelet, AES-CBC-256 secrets encryption at rest, k3s audit logging, UFW default-deny + SSH hardening on every node.
• Zero-downtime lifecycle: system-upgrade-controller rolls k3s upgrades across all nodes via Plans — cordon-only (Longhorn-safe), no manual SSH.

Technologies: k3s (Kubernetes), MAAS, OpenTofu, Ansible, Cilium eBPF, Hubble, MetalLB, Longhorn, Velero + MinIO, Tailscale, kube-bench (CIS)

The collaboration layer of the ktayl-solution IS: a complete self-hosted digital workplace (mail, chat, video, files, e-sign) replacing Microsoft 365 / Google Workspace, assembled from open-source apps on the Kubernetes + GitOps platform and unified behind Authentik SSO + MFA.

• Mail: Stalwart (JMAP/IMAP/SMTP) relaying outbound through Amazon SES with aligned SPF/DKIM/DMARC; inbound via an SES→S3→SQS→bridge pipeline.
• Collaboration suite: Matrix/Element chat, Jitsi video, Nextcloud + OnlyOffice for files and in-browser office editing, Docuseal e-signature — each GitOps-delivered, TLS-terminated and backed up.
• Identity as the perimeter: Authentik OIDC SSO + TOTP in front of every app; browser-first BYOD / zero-trust access over Tailscale + Cloudflare Tunnel, no managed endpoints.
• Cross-app automation: n8n and Temporal orchestrate workplace processes.

Technologies: Authentik (OIDC/SSO), Stalwart Mail + SES, Matrix / Element, Jitsi Meet, Nextcloud / OnlyOffice, Docuseal, n8n, Temporal, cert-manager / TLS, Kubernetes / GitOps

The ERP + HR system of record for the ktayl-solution IS: ERPNext/Frappe on MariaDB, configured for French insurance accounting and extended with custom code where the off-the-shelf product stops short.

• French insurance accounting: the 845-account PCG 2025 chart + TSCA tax templates (9/13/33%) configured in ERPNext/Frappe on MariaDB.
• Factur-X e-invoicing PoC (Minimum profile) — CII XML generation validated by 5 assertions.
• Custom payroll extension: French DSN declaration + SEPA transfer generation, unit-tested (108 tests, ~76% coverage).
• HR is the IS source of truth; GitOps-delivered, SSO-gated (Authentik), secrets via ESO/Vault, backed up.

Technologies: ERPNext / Frappe, MariaDB, Python, Authentik (OIDC/SSO), Factur-X, ESO / Vault, Kubernetes / GitOps