Infrastructure Build & Maintenance

Two jobs that are usually confused#

Building infrastructure is a project with an end date. Maintaining it is a standing responsibility with no end date, and it is the one that gets dropped — because it produces no visible output until the day it does, catastrophically.

Patches slip. Certificates expire on a Saturday. A database fills its disk. Backups have been failing silently for five months. None of this requires sophistication to prevent; it requires someone whose job it is.

What maintenance means concretely#

Patching to a schedule. Critical CVEs inside 30 days as a standing target, with an out-of-band path for anything actively exploited. Non-production first, then supervised production windows.

Restore tests, quarterly, with a written result. Not "backups are configured" — an actual restore into a clean environment, validated and timed. The timing matters because it is your real RTO.

Drift detection. Someone will eventually change something in a console at 2am during an incident. That is fine, as long as the drift is detected and either codified or reverted rather than becoming permanent undocumented state.

Capacity ahead of demand. Reviewed against growth, not discovered when a disk fills. Headroom is cheaper than an incident.

Greenfield: get the boundaries right#

If you are starting fresh, the decisions that are expensive to reverse are the structural ones — how accounts are separated, how networks are segmented, how identity flows, where logs go, and how cost is attributed. Compute choices can be changed later. These cannot, cheaply.