Marlon PazEmail me

Marlon
Paz

I build networks that prove their own changes, and AI that runs on your own GPUs.

Network and AI infrastructure architect in Abu Dhabi. I take plain-language intent to verified, on-device change across Cisco, Nokia, Juniper and SONiC fabrics.

Email Marlon

A leaf-spine fabric converging on a plain-language intentThe intent "stretch this mac-vrf across both leaves" enters at the top. Agents plan and controllers apply it across two spines and two leaves serving four clients. Both leaves confirm, and the service is marked verified on device.Intent, in plain languagestretch this mac-vrf across both leavesagents plan, controllers applyspine 1spine 2leaf 1leaf 2Verified on device2 of 2 leaves confirm
The reference fabric from agentic-netops. A service is reported ready only after each leaf confirms it.
  • CCIE Service Provider
  • Certified Kubernetes Administrator
  • NVIDIA-Certified Professional, Agentic AI
  • IEEE and Springer co-author
  • English, Español, Português
Portrait of Marlon Paz
San Salvador, Lisboa, Abu Dhabi

From carrier networks to agent fleets.

I started in 2014 keeping a mobile carrier's network running in San Salvador, then moved through banking and consulting estates. At Nokia in Portugal I spent five years designing IP/MPLS networks for power grids and railways, building data-centre fabrics, and automating how they are deployed and tested. Since 2024 I work in Abu Dhabi on data-centre interconnect and cloud networking for sovereign AI programmes.

Along the way the job changed. Today I build the automation itself: multivendor fabrics driven by declarative intent, agents that turn a sentence into verified change, and loops that repair drift instead of only reporting it. My rule is simple. Nothing is reported done until the device proves it.

Read the full story

  1. 2014 to 2016Telecommunications EngineerTigo, San Salvador
  2. 2016 to 2018Network & Security SpecialistCiti, San Salvador
  3. 2018 to 2019Network Consulting EngineerCisco (blue badge), Honduras
  4. 2019 to 2024IP/MPLS Network ArchitectNokia, Portugal
  5. 2024 to nowNetwork, Automation & Observability ArchitectCore42, Abu Dhabi

Work you can check.

Everything here is public: a repository, a paper or a recording. Where a number appears, its source sits next to it.

agentic-netops

Intent in plain language; AGNTCY + LangGraph agents, Kubernetes controllers, a live SONiC EVPN/VXLAN fabric, gNMI closed loop. Nothing reported deployed until verified on the device.

The recording runs six and a half minutes: a VLAN, an ip-vrf and a stretched mac-vrf provisioned from plain language, then proven with kubectl and on the SONiC leaves. The same design also runs on Nokia SR Linux, in agentic-netops-srl.

4/4 constructs converge0 unverified success reportsSource: repo, 2026-10

  • agent-observability-stack

    Token/cost/trace telemetry for agent fleets — LiteLLM + OpenTelemetry into Prometheus, Loki, Tempo, Grafana and Arize Phoenix; GPU-aware, with budget alerts.

    every LLM call tracedcost per agent, model, taskSource: repo + video walkthrough

  • agentic-ops-bench

    Model × harness benchmark on real operations tasks — AIOps, NetDevOps, HPC, inference, RAG, tool loops. The honest local-or-frontier answer, per workload.

    30B-class on 1× RTX 3090 vs hosted frontierSource: repo, dated runs

  • qmd-memory-stack

    Local, GPU-accelerated 3-tier RAG memory over GGUF embeddings plus a shared MCP gateway — agent memory that never leaves your hardware.

    ~19× query speedup (Intel Arc iGPU, Vulkan)Source: repo README

How I can help.

Seven lines of work with one thesis: automation you can audit. Each has a defined outcome, a duration and public evidence behind it.

Ways to engage

Architecture & Strategy Advisory2–3 weeks
Opportunity/decision memo — where agentic NetOps, local inference or automation pays back, sequenced, with a build-or-buy recommendation and risk notes.
Automation / Inference Readiness Assessment3–4 weeks
Technical assessment report with dated, evidence-backed findings, severity-ranked gaps, and a two-quarter remediation roadmap.
Fabric Convergence Proof-of-Value4–8 weeks
A containerlab replica of your fabric with the intent-to-CR pipeline, gNMI closed loop, and an on-device verification report — video-recorded for internal sell-through.
Implementation & Delivery3–6 months
Shipped automation or platform, runbooks, verified-on-device evidence, and a knowledge-transfer handover to your team.
AIOps & Agent-Platform Build6–12 weeks
Working event-driven operations pipeline (alert → diagnosis → guarded remediation → verified resolution) on a multi-agent platform with observability, dashboards, cost telemetry, and operating guidance.
Fractional Architect & Enablement1–2 weeks per cohort / 3–12 month retainers
Tailored EN/ES/PT curriculum and labs, plus a trained internal team; or a retained architecture allocation.

The Verified Fabric: intent in, evidence out.

It is the loop the reference system runs, and it is how I run engagements. Nothing advances without evidence.

  1. Intent

    Plain language plus constraints. Stretch this mac-vrf across both leaves is captured, scoped and checked against policy.

  2. Agents and controllers

    Agents map the intent to declarative resources. Kubernetes controllers dry-run and apply them deterministically, with rollback.

  3. Verified on device

    gNMI proves it, or it did not happen. Each node passes a verification gate before the service is called ready.

Then it keeps checking. Telemetry flows from gNMI to Prometheus and Grafana, converged services are re-verified every five minutes, and drift is repaired and reported. The same loop runs my inference work: a prompt, a routed model, and a verified cost and latency per workload.

Ask my digital twin.

An AI agent grounded in my public work. It explains how the verification, the telemetry loops or the local GPU serving work, and points back to the repository or paper.

It is not a live person and it can be wrong, so check anything important. The twin is itself a served inference app with telemetry and a human-check in front of it.

Papers, labs and a delivery method.

The open-source ledger.

My public repositories, synced from GitHub every day and grouped by line of work.

Network and fabric

  • agentic-netopsAGNTCY + LangGraph agents turn intent into CRs; Kubernetes controllers reconcile them onto a live SONiC EVPN/VXLAN fabric; gNMI telemetry closes the loop. Runs in containerlab + kind.Python3 stars
  • agentic-netops-srlAgentic NetOps on Nokia SR Linux — declarative EVPN/VXLAN fabric control plane with a guarded multi-agent intent tier.Shell3 stars
  • srl-sros-telemetry-labInteractive streaming telemetry lab — Nokia SR Linux + SR OS.Shell1 starfork
  • sros-anysec-labQuantum-safe ANYsec encryption demo on containerlab with Nokia SROS FP5 vSIMs.PHP2 starsfork
  • sros-anysec-macsec-labQuantum-safe ANYsec + MACsec lab environment.Pythonfork
  • vrnetlabContributed ISA-MS card support for vr-sros.Python1 starfork
  • certforgecertforge — a small OpenSSL CLI to generate CSRs (for signing by an internal CA) or self-signed certificates from a .cnf, with or without an existing key.Shell1 star

Agents and platforms

  • agent-observability-stackSelf-hostable observability for LLM agents + a Linux host (Intel iGPU/NPU + NVIDIA RTX 3090 eGPU aware): Prometheus + Grafana + Loki + Tempo + Arize Phoenix + OTel, OpenClaw/LiteLLM/Claude Code/RAG metrics and traces, dynamic onboarding, Telegram alerts.Python1 star
  • qmd-memory-stackLocal, GPU-accelerated RAG memory for coding agents (Claude Code + OpenClaw) — hierarchical 3-tier memory over local GGUF embeddings + an MCP server; ~19× query speedup on an Intel Arc iGPU via Vulkan. Idempotent bash installer, fail-open recall.Shell1 star
  • qmd-gatewayShared, warm, writable qmd MCP memory gateway for a multi-agent coding fleet.Shell1 star
  • kind-cilium-hubble-clusterBootstraps an observable K8s cluster from scratch with kind + Cilium + Hubble.Shell1 star
  • agent-skillsAgent skills I use every day: GPU and fleet ops, Proxmox ops/triage, local-model routing, fleet memory, spec reconciliation, spec-corpus curation.Python

Local inference

  • agentic-ops-benchModel x harness benchmark on real agentic ops tasks (AIOps, NetDevOps, HPC, inference, RAG, tool loops). Local 30B-class models on one RTX 3090 vs hosted frontier models.Python1 star
  • antares-scanFast, free first-pass security triage of a code folder with a local antares-1b (Granite-4.0) model.Shell2 stars
  • gpu_rtx_3090Safe power-cycle scripts for an RTX 3090 Thunderbolt-4 eGPU (drain/detach/rescan + systemd shutdown guard).Shell1 star

Method and delivery

  • specstride-pluginDevelopment governance for coding agents, as a Claude Code plugin: every phase reviewed by a separate critic, signed and committed.TypeScript2 stars
  • specstrideThe earlier Python Specstride orchestrator: drives an agent through Spec Kit phases behind an LLM critic gate, diagnoses stuck phases and tunes its own per-phase settings from run telemetry.Python4 stars
  • mixture-of-loopsGenerate provenance-bound, unattended Specstride pipelines from Spec Kit artifacts.Python1 star
  • trustcircleAI governance control plane: continuous AI inventory, human-authority decisions, signed evidence, ISO/IEC 42001 readiness. Provision on Compose or Kubernetes.TypeScript1 star
  • specstride-coreThe Specstride engine: loop engineering and governance for coding agents. Independent critic per phase, signed approvals, one commit per approved phase.TypeScript1 star
  • specstride-dshThe dsh host of Specstride: skills, shim, doctor and eval driver over the pinned specstride-core.TypeScript1 star
  • specstride.aiWebsite for Specstride: development governance for coding agents, a Claude Code plugin. Built as a reusable template.Astro1 star
  • specstride-exampleTry Specstride in five minutes: a tiny Spec Kit feature, implemented, tested, reviewed and committed phase by phase.
  • claude-pluginsMarlon De Paz's Claude Code plugin marketplace.Shell1 star

Applied agents

  • video-to-deckTurn videos into Marp slide decks (PPTX/PDF/HTML). Local whisper + OCR + optional VLM captions build an evidence bundle; a fresh agent per video writes the deck. Structural content becomes Mermaid diagrams. Pluggable agent, CUDA-accelerated, CPU-portable.Python2 stars
  • kedinAn AI agent (managed via Telegram, orchestrated by OpenClaw) that ghost-writes LinkedIn posts in your voice with UML/architecture diagrams. Public, dummy-data demo of the digital-twin career-agent pattern.JavaScript1 star
  • havanHavan - an autonomous flight-deal hunting AI agent. Managed from Telegram, orchestrated by OpenClaw: searches Google Flights / Skyscanner / OTAs for the cheapest fare with good timing and returns a ranked shortlist with booking links. Public, dummy-data demo.1 star
  • kanbanPersistent kanban board — Hono API + Next.js + SQLite + Claude AI + Telegram bot integration.Shell1 star
  • dubyAI investment-analysis agent — monitors Telegram channels for trading signals, enriches them with live market data, and delivers position-sized analysis via a dashboard and Telegram bot.Python1 star

See every repository on GitHub

Certified across the stack.

Multivendor is the offer, not an add-on: Cisco, Nokia, Juniper, SONiC, loadbalancer.org, NVIDIA, Red Hat.

Each badge opens its public verification page. The full list is on Credly.

Asked, answered.

Do you actually build, or only advise?

Both, but the bias is building. The reference evidence is shipped and runnable — working multi-agent intent-to-fabric code with verified convergence on a live containerlab fabric (agentic-netops), deployed observability stacks, published research. Advisory engagements exist, but every recommendation is anchored to something built and demonstrable.

Can you work with our vendor X?

Yes — multivendor is the core of the practice, not an add-on. Public work spans Cisco IOS-XR/NX-OS, Nokia SR Linux and SR OS, and SONiC, with hands-on labs for Nokia ANYsec/MACsec security and streaming telemetry (sros-anysec-lab). Certifications across Cisco, Nokia, Kubernetes and NVIDIA back that range; Juniper and Red Hat estates are equally in scope.

How do you handle confidentiality?

Your environments, topology and business context stay yours. Public repo names and anonymized capability categories are the only evidence ever referenced — no client names, architectures, screenshots or details are published or cited. Confidentiality terms are set in the engagement contract before work starts.

What does an engagement look like?

A short scoping conversation, then a bounded discovery phase mapping your fabric, tooling and constraints; then delivery with defined constructs and a verification bar — every change proven on the device before it is reported done; then handover with runbooks, code, and optionally training for your team.

Local models vs. cloud — what fits us?

It depends on your data sensitivity, latency and cost profile — and it is measurable, not philosophical. Structured benchmarks of local 30B-class models against hosted frontier models on real ops tasks (agentic-ops-bench) mean the decision is made on your workloads with real numbers, plus routing and policy so both can coexist.

How do you price?

Fixed-scope phases with a defined deliverable and verification bar per phase, priced up front; ongoing advisory or platform work on retainer. You always know what a phase costs and what "done" means before it starts — and "done" is on-device verified, not a status report.

Who controls the automation if agents are in the loop?

The same way the public reference build does — agents propose, controllers reconcile, telemetry verifies, and drift is repaired automatically, with guarded control planes so agent actions are bounded and auditable. Nothing is reported deployed until verified on the device; that rule is the product (agentic-netops).

Can you train our team, not just deliver?

Yes. Training and enablement are a standing line of the practice, grounded in university mentoring that produced two peer-reviewed publications and in authored course material. Handover includes working sessions so your engineers can operate and extend what is built.

Do you actually work on quantum?

Applied quantum-safe networking — hands-on, public and verifiable: Nokia ANYsec (post-quantum-resistant, line-rate encryption for data-center fabrics), MACsec and Nokia NGE, exercised in public containerlab labs on Nokia SR OS FP5 vSIMs (sros-anysec-lab, sros-anysec-macsec-lab, building on the srl-labs originals) and presented as a quantum-safe ANYsec demonstration at MPLS SD & AI Net World 2024 — demo video. In depth: how post-quantum cryptography and keying change network design and operations, line-rate encryption inside EVPN/VXLAN fabrics, performance/latency trade-offs, and staged multi-vendor migration. Quantum-computing research itself (qubits, algorithms, hardware) is not the practice — making your fabric resistant to it is.

One email starts it.

Scope a proof-of-value on your fabric, an assessment or a fractional engagement. Or just ask a hard question.

Email Marlon

marlon.paz@ieee.org. I reply within two working days, from Abu Dhabi, UAE, in English, Español or Português.