Costs were climbing faster than usage and nobody owned the number, so every team assumed someone else was watching it. I took the problem, instrumented spend down to the service level, and worked through the biggest offenders one at a time until the trend line bent and stayed bent.

Replayed the write-ahead log and reconciled balances; zero customer-visible discrepancies.

Access had grown organically until nobody could say who could reach what, which is a bad thing to discover in the middle of an incident. I tightened it end to end — least privilege by default, rotation that actually happens, and an audit trail we could answer real questions with.

Sharded the pipeline and tuned batching; throughput held at 3k events/sec at steady state.

One legacy service was behind most of our incidents, and everyone had quietly learned to route around it rather than fix it. I led the decomposition with no maintenance window — carved the risky parts out behind a proxy, moved traffic in slices, and kept a rollback available at every step.

p99 fell from 1400ms to 1050ms — a 25% cut sustained through peak traffic.