Armakuni Contact us
← All case studies

The vendor that ran their cloud was shutting it down.
The date was fixed, and it wasn't theirs.

A global executive search firm's whole cloud platform was built and run by a vendor, and that vendor was retiring its systems in December 2025. We moved every system onto AWS infrastructure the firm owns before the deadline hit, then built what the firm had never had, including AI candidate search, automatic profile updates, a live interview AI agent, a ranking engine that can't fail silently, and an AI agent that works like a recruiter.

Before

None of the systems the firm ran day to day belonged to the firm.

Recruiters still had to do the work by hand.

After
~20tenant stacks moved before the vendor's December 2025 shutdown, which passed without disruption, as the firm reports

None of the systems the firm ran day to day belonged to the firm

This firm places C-suite and board-level candidates, so candidate intelligence is the product itself. Recruiters need to find the right experience, understand it in context, and keep the record current as conversations move forward.

Underneath that product, every application, network connection, security policy and deployment pipeline ran through a vendor's proprietary systems. Then the vendor announced it was retiring them: no code access or support after August 2025, and shutdown in December 2025. Every application faced an outage on a known date, and the firm had no way to rebuild what it couldn't see.

Recruiters still had to do the work by hand

The information recruiters needed was spread across more than 5,000 resumes, spreadsheets, shared files and recruiting-system exports. Recruiters drafted job descriptions by hand, wrote every outreach email and typed details from calls and emails into the CRM, field by field. Interviews depended on whatever notes the recruiter had prepared that morning.

The machine-learning system that ranked candidates broke intermittently, with no alerts. When data stopped flowing, rankings were built on stale information, and nobody knew. New ranking models went live without being compared against the ones they replaced. And leadership's questions, such as margin by client or pipeline by sector, waited on a BI specialist, with data leaving AWS to be reported on elsewhere.

The foundation work had to happen first

The order mattered here, because nothing could be built safely on a platform that was about to disappear, so the first job was making the firm independent before the deadline. Every AI capability after that could be built on infrastructure the firm controlled.

How we built it

5 decisions, in the order we made them. Each one says what we did and why, with what it did drawn beside it.

  1. We rebuilt the cloud foundation before touching the product
  2. A funded discovery that benchmarked Bedrock models on recruiting tasks
  3. An AI agent that asks about the role before it looks for anyone
  4. We took over the ranking system from contractors
  5. Answers for leadership, from data that stays in AWS

We rebuilt the cloud foundation before touching the product

Built withKubernetesCodePipelineCDK
Vendor's cloudTheir own AWS Landing zoneLanding zonePipelinesPipelinesKubernetes setupKubernetes setup the shutdown passed without disruption
The engineering

Where source files weren't available, our engineers mapped how the existing network actually behaved before rebuilding its connections and controls. The foundation work covered the cloud accounts, network, deployment pipelines and Kubernetes operations:

  • AWS Landing Zone Accelerator replaced the proprietary multi-account setup, with a hub-and-spoke network architecture and infrastructure-as-code templates.
  • AWS CodePipeline and CodeBuild replaced vendor-managed releases across about 20 tenant application stacks and multiple environments, with version control, monitoring and rollback logic.
  • Reusable AWS CDK constructs brought Kubernetes scaling, upgrades and environment configuration under the firm's own control.
  • Validation covered connectivity, security policy, pipeline behavior, failover and rollback scenarios, and runbooks and hands-on handover gave the firm's operations team what it needed to run the environment.

The cloud foundation and the deployment tooling now sit with the firm's own team, and the December 2025 shutdown passed without disruption, as the firm reports. Because the deadline was fixed, the work that removed the risk went first and everything else waited for it.

A funded discovery that benchmarked Bedrock models on recruiting tasks

Built withBedrockOpenSearchTranscribeEKSRDSSecrets Manager
The AI Ranked, with reasonsProfiles enrichedInterview questions
The engineering

A three-to-four-week discovery assessment, fully funded by AWS, ranked use cases by business value and readiness, reviewed the candidate data and its privacy requirements, and benchmarked Bedrock models on recruiting tasks such as drafting job descriptions, summarizing candidates and writing outreach.

A six-to-eight-week proof of value then connected three capabilities to the existing platform, on the firm's real data:

  • Candidate profiles are represented semantically and indexed in Amazon OpenSearch, which lets a recruiter search by meaning. A job description comes back as a ranked list, and each match carries a written explanation of fit, so the recruiter has a reason to look at it.
  • Transcripts, emails, and documents all feed into an enrichment pipeline that keeps profiles current on their own. Bedrock extracts structured fields such as role, skills, and experience, and an integration writes them straight back into the CRM.
  • During an interview itself, Amazon Transcribe Streaming sends the live transcript to Bedrock, and the application shows suggested follow-up questions while the conversation is still happening.

The deployment design runs application containers on Amazon EKS in private subnets across two Availability Zones, with OpenSearch and Amazon RDS for search and operational data, and Secrets Manager, the delivery pipeline and AWS monitoring services alongside. Because it's built on the same platform architecture as production, what was proved can move straight into production.

An AI agent that asks about the role before it looks for anyone

Built withBedrockAgentCore
The recruiter asks for a searchThe AI agent asks back firstThen it searchesCandidates returned
The engineering

Search a database and you get whatever matches the keywords, which is rarely what the hiring manager meant; a good recruiter asks questions first. The agentic platform brings both together in one connected workflow, so a hiring manager can clarify the requirement and refine the results in the same conversation.

  • An AI agent asks the clarifying questions, keeps the conversation's context inside the client boundary, and turns the discussion into structured search parameters.
  • Candidate discovery calls the existing database and recommendation services, and returns a reasoned shortlist to refine.
  • For senior searches, research AI agents look at relevant public information. The output keeps external research separate from internal CRM information, so the source of every statement stays visible.
  • Through the platform's integrations, the workflow can generate job descriptions, draft outreach, and start candidate-contact processes.

Amazon Bedrock supplies the models and the AI-agent layer, and the production design uses Bedrock AgentCore for hosting and tool integration. The AI sits alongside the firm's existing recruiter workflows rather than replacing them.

Why: with internal and external information kept apart, a recruiter can always see which facts came from the firm's own records and which came from the web.

We took over the ranking system from contractors

PipelinesData qualityModel performance Team caught before recruiters notice
The engineering

Contractors had kept the ranking system running, without one owner, runbooks or alerts. We took responsibility for it through an ongoing engineering team with a shared backlog and weekly releases, covering India and U.S. working hours:

  • Health checks and alerts cover pipeline failures, data quality, model performance and connectivity, which means an engineer sees a problem well before a recruiter notices anything wrong.
  • Every new model version is evaluated against the current production model, with regression tests, staged rollout and automatic rollback in the release path.
  • Dashboards bring pipeline reliability and model metrics together with processing volume and cost, so leadership can see the whole engine for the first time.
  • Interview outcomes feed back into later ranking improvements, along with LLM reasoning for profile matching and scoring for cultural and organizational fit.

Answers for leadership, from data that stays in AWS

Built withS3QuickSight
A question from leadership Answered inside AWS from their own data
The engineering

Finance, recruiting, spreadsheet and search-activity data came together in one analytics model, using Amazon S3 and AWS transformation services, and the data no longer leaves AWS to be reported on. Amazon QuickSight supplies executive, finance and operations dashboards, with email subscriptions for key metrics. QuickSight Q is configured with the firm's own vocabulary and example questions, so leadership can ask about margins, revenue and pipeline in plain language, without commissioning a report for each answer.

What we'd tell another CTO

1Every AI feature here came after the platform belonged to the firm, because none of it would have held up on infrastructure the firm didn't control.
2When the code isn't available to read, you map how the system actually behaves instead. Here, the team rebuilt the network from observed behavior because the vendor's source files weren't available.
3A ranking model should never ship without being compared against the one it replaces, because before the ML operations work went in, a worse model could have sat in production for months without anyone noticing.

What else changed

  • Releases under its own control across about 20 tenant application stacks, with rollback.
  • AI candidate search with written reasons, automatic profile enrichment into the CRM and a live interview AI agent, proved on the firm's own data.
  • The agentic recruiting platform runs on Bedrock and AgentCore, where it clarifies the request, searches for candidates, researches them, and drafts the output.
  • A ranking engine with alerts, model comparison, staged rollout and automatic rollback.
  • Self-service analytics for the CEO and the board, with all business data inside AWS.
  • Six pieces of work, all from one AWS-funded discovery: an assessment of three to four weeks, an infrastructure move of 18 to 20 weeks, a six-to-eight-week proof of value, and ongoing ML and agentic engineering teams.

What comes next

The agentic platform then extended into more high-volume search workflows, fit scoring, interview-outcome feedback loops running in production, recruiter-facing analytics, and client-facing views inside the firm's platform.

How we'd do it today

This project came before our current offers. Here's how we'd approach the same work now.

The cloud move would follow our Move to AWS method, with AWS Transform's AI agents mapping which servers talk to which and ours reading the config files, jobs and connection strings the network can't show, so workloads that depend on each other move together in one wave, onto foundations built first as code with AWS Control Tower and AWS Organizations. For the research AI agents that read the open web, AK AI Factory's rule would apply: no AI agent holds candidate data, reads untrusted text and can send data out at once, so each gets its own identity in AgentCore Identity, only the tools its job needs and Cedar policies at the gateway, deny by default and checked on every tool call. The ranking engine would be gated on a golden set of past searches with the shortlists recruiters actually chose.

After the move, the firm would get the whole managed service from one team, across the India and U.S. hours its releases already span. AK Run's live map would cover the tenant stacks, the ranking engine and the analytics, with its AI agents taking the first look at every alert for a named engineer to confirm. A ranking bug would be fixed in the code, with a test, through the firm's own pipeline, where we open the pull request and its approver ships it. Patches, upgrades and certificates on the new AWS foundation would run to a calendar, and the research AI agents would sit on one register, every model call through Agent ControlPlane's gate and every step on a trace, so the firm can say on any day what each AI agent did and what it cost.

Have a problem like this one?

A free workshop: a few hours with the architects who'd do the work, on your own systems. No cost.

Book a free workshop