The two public ones are MIT-licensed and running in places I will never hear about,
which is the outcome I was hoping for.
Your password is the private key, so there is no key file to
lose.
Argon2id turns a passphrase into a keypair, which also means there is no server
in the middle to trust. Hybrid X25519 + ML-KEM-1024 for post-quantum cover,
XChaCha20-Poly1305 for the payload. Ships as a CLI, a Go library, WASM, a
browser app and a GitHub Action.
Go
Post-quantum
WASM
Secrets you can git commit on purpose.
Secure Local Vault keeps encrypted secrets beside the code they belong to, with
no secret store to run. Envelope encryption and key-wrapping for team sharing,
ephemeral injection into CI, Kubernetes-native, pluggable AWS / Azure / GCP KMS
backends. Presented at Black Hat Arsenal twice.
Go
Kubernetes
CI/CD
Internal platform and security work, described at the level of what each piece does
and why.
Security into the pipeline
2023 – 2024 · Security Engineering
Container image scanning gated before deployment across production
Kubernetes, rather than reported after it. SAST adopted across five product lines,
with findings synced into the normal issue tracker, so vulnerabilities joined
ordinary engineering work instead of a separate security backlog nobody grooms.
Secret scanning in the build, plus fixes to the validation framework to kill the
false positives that teach people to ignore alerts. A distroless image initiative to
shrink what's in production in the first place.
Also wrote the security function's annual operating plan and the quarterly roadmap
cadence the team then ran on for three years. That part was unglamorous, and it is
the reason any of the rest of it shipped.
Running security engineering
Architect → Senior Engineering Manager
Architected a company-wide Zero Trust access gateway that retired
scattered SSH keys, per-cluster access requests and client-side credential config:
SSH brokered with nothing configured on the client, Kubernetes access via OIDC, SSO
for internal users.
Wrote the org's policy restricting long-lived IAM credentials to a narrow approved
set, with enforcement and an exception path that people could actually use.
Established quarterly privileged-access reviews. Built the security metrics
dashboard leadership reports from, and ran the cloud risk register through to
closure.
SLV came out of this work, was adopted across the company, and is
recognized well beyond the team that built it.
Standing up a platform function
Now · Platform Engineering
Defined the charter, structure and operating plan for a new central function: ~10
engineers across cloud infrastructure, CI/CD, identity, cost, observability, API
gateway and AI infrastructure. Originated and specified roughly twenty platform
initiatives. I wrote each design, then handed delivery to an owning engineer and kept
the outcome.
The one I'd show you first
A centralized identity token exchange service, so internal
services stopped each writing their own token validation. KMS-backed signing
key, mutual-TLS gateway, audience validation at both the provider and the
target, short-lived tokens scoped per target, and a named-rule,
block-by-default policy engine. Extended with a GitOps group-identity layer:
membership as version-controlled YAML, owner approval enforced in the pipeline,
resolved to token claims at deploy time.
Alongside it: a scoped token broker issuing short-lived
repo-scoped credentials in place of long-lived personal access tokens;
self-service Kubernetes access and certificate lifecycle
management; a self-service developer portal replacing
manual ticketing for access, certificates, on-call and approvals; CI
consolidated onto one autoscaling system, extended to GPU runners; a
managed → self-hosted API gateway migration across dev,
pre-production and production; and per-team monitoring stacks folded into
one governed observability platform, with monitoring-of-monitoring
and 90 days of undownsampled retention.
Founded and led the cloud cost optimization program across a large
multi-cloud estate, reaching six figures of verified savings in a single month and
reporting to executives monthly. Underneath it sits a multi-cloud cost dashboard
with forward run-rate, storage tiering automation, reservation automation, idle
detection with owner-approved auto-stop, and per-workload Kubernetes cost
attribution.
The function now owns unified AI infrastructure: one internal API
fronting dedicated hardware, managed cloud models and direct providers, so consumers
never change endpoints while cheap capacity carries baseline load and the cloud
absorbs surges. Per-team budgets, quota enforcement and spend attribution sit on top
of it.
Two documents I'm fond of
A GitOps maturity assessment and whitepaper, surveying every
product line against a target standard and naming the gaps blocking rollout.
The other is "The 10 Commandments of Engineering," the
principles document the wider org is held to. Ten of them, covering everything
from designing before building to reviewing code properly.
