live system map production is a design constraint

JesseTamburino

BUILD → INNOVATE → CREATE → SECURE → ITERATE → DESTROY↻Principal DevOps engineer. I build the platforms products stand on: Kubernetes, Terraform, GovCloud, and the AI tooling around them.

Let's talkRead the log

the short version

Ten years across commercial cloud, GovCloud and DoD IL4. I take the system nobody wants to own and make it boring, fast, and provable.

Company uptime, raised to five-nines

BlackBag Technologies

User downtime during weekly releases

Cellebrite, first SaaS product

QA and dev test time, via a global secure file share

BlackBag Technologies

Sales order booking time

BlackBag Technologies

Technology budget owned, with 10% operating savings a year

BlackBag Technologies

Domains on Cloudflare Workers, run by one engineer and a fleet of agents

Personal infrastructure

what I own

Five layers, one person who can hold all of them.

Edge and network

Traffic arrives hostile. It should leave your VPC boring.

  • Cloudflare across the Anchore account: DNS, WAF and rate limiting, Workers routes, Access and IP policies.
  • Tunnels for GitLab, its registry, and the object store, with no public origin.
  • Led the IPv6 migration of production: VPC and ALB dual-stack, plus in-production buckets imported into Terraform state.
CloudflareTunnelWAFTransit gatewayVPCIPv6Route 53
Case study: tunnels, no public origin
visitor CLOUDFLARE EDGE WAF + rate limit Access policy Workers tunnel PRIVATE VPC ALBdual-stack servicesno public IP PostgresRedis / S3

Kubernetes platform

Clusters that upgrade on a Tuesday and nobody notices.

  • Upgraded EKS from 1.33 through 1.35 across several environments: Bottlerocket nodes, Karpenter pools, add-on syncs.
  • Stood up a GitLab platform cluster with Flux GitOps, staged from CRDs to the GitLab operator to runners.
  • Day-to-day incident response across multiple clusters: limits, ingress, network policy, RBAC hygiene.
EKSKarpenterFluxHelmBottlerocketGitLab OperatorPrometheus
Case study: GitOps GitLab platform
Git repodesired state Flux EKS CLUSTER control planeadd-ons pinned, upgrade 1.33 to 1.35 nodeBottlerocket nodeBottlerocket nextnode Karpenter adds capacity on demand GitLaboperator Runneroperator

Delivery

If a human has to remember a step, the pipeline is unfinished.

  • Built the Virtual Appliance Builder from scratch: a Golden AMI factory with validation and parallel upgrade testing.
  • Multi-account AMI promotion to a release account, then across commercial regions and both GovCloud regions.
  • A shared Terraform module library across AWS and Cloudflare, plus multi-arch ARM64 builds for the enterprise product.
PackerTerraformGitHub ActionsGitLab CIDockerECRTerragrunt
Case study: the Golden AMI factory
Packerbuild validateparallel upg. releaseaccount us regions GovCloud GovCloud Terraform modules: provider, app, DNS, tunnel, EKS

Security and compliance

Controls as code, evidence on demand, auditors who leave bored.

  • Maintained NIST 800-53r5 and prepared an SEC program for ATO. Architected a DoD IL4 data warehouse.
  • Worked pen tests and audits with C5ISR (U.S. Army DEVCOM), then closed the ATO findings.
  • Led SOC 2, StateRAMP, and FedRAMP initiatives; PCI-DSS, GDPR and CCPA before that.
NIST 800-53ATOFedRAMPSOC 2IL4CyberArkCASP+Security+
Case study: SEC + DoD compliance
POLICY: NIST 800-53r5 / FedRAMP / SOC 2 BASELINE: Terraform + hardened images GATES: CI scanning, review, secrets in a vault EVIDENCE audit trailspen-test fixesATO package

AI tooling

The interesting part is giving models a safe, useful surface.

  • Prototyped MCP servers for Anchore Enterprise and support bundles: found the opportunity myself, demoed it before any roadmap item.
  • Built AI test-agent pipelines on AWS Bedrock that write and run tests.
  • Off hours: an autonomous agent fleet that runs dozens of production sites with budgets, gates and kill switches.
MCPAWS BedrockClaudeAgent orchestrationFastAPIPythonGo
Case study: MCP servers + test agents
LLM clientasks in English MCP MCP server typed toolsread-only bydefault productdata supportbundles agents write and run tests on Bedrock

career, as a changelog

Release log

v5.0 / now

Principal DevOps Engineer

Anchore. Sep 2024 to present.

Production-ready solutions across Anchore products.

  • Built the Virtual Appliance Builder: an end-to-end Golden AMI factory with multi-account promotion through GovCloud.
  • Deployed a Flux-managed GitLab platform on Kubernetes behind Cloudflare tunnels; upgraded EKS 1.33 to 1.35.
  • Built the usage-tracking pipeline on Firehose and S3, led the IPv6 migration, delivered ARM64 builds.
  • Prototyped MCP servers for LLM-native querying of product data; built Bedrock test agents.
  • Standing infrastructure and release contact for Platform, UI, Backend and QA.
v4.0

InfraSec Tech Lead, then Manager

TrussWorks. May 2022 to Aug 2024.

Secure infrastructure for the DoD, then the U.S. SEC.

  • Architected AWS IaC for the SEC on Fargate and RDS; held NIST 800-53r5 compliance and prepared the ATO.
  • Built a custom data warehouse environment for the DoD at IL4; worked C5ISR pen tests and audits.
  • Moved DNS from Route 53 to a more resilient, compliant provider; wrote Python automation.
  • Managed and mentored InfraSec engineers; supported scoping and RFI responses.
v3.0

DevOps Engineer, SaaS Architect, SaaS Operations Manager

Cellebrite. Jan 2021 to Aug 2022.

The first SaaS product, with security at every phase.

  • Cut user downtime 85% during weekly releases by reworking deployments.
  • Stood up the first AWS GovCloud accounts after the BlackBag acquisition; built and mentored the SRE team.
  • Ran SOC 2, StateRAMP and FedRAMP initiatives; integrated Okta SSO, Datadog, PagerDuty.
  • Migrated ERP, CRM, JIRA, O365, Slack and more during the integration.
v2.0

Director of Technology and Operations

BlackBag Technologies. Nov 2018 to Jan 2021.

Moved a forensics company to cloud and brought new capability to market.

  • Raised uptime from 88.3% to five-nines; moved the company from on-prem to a secure cloud.
  • Built a clustered AWS proof of concept for FBI forensics ingestion.
  • Created an industry-first cloud training platform on virtual macOS hosts.
  • Owned a $1M budget with 10% year-over-year savings; led developers, infrastructure and web teams.
v1.0

IT Manager

BlackBag Technologies. Jan 2016 to Nov 2018.

Founded the IT team and the company's first cloud footprint.

  • Architected secure AWS and migrated on-prem servers and databases.
  • Automated scanning and pen testing; reached PCI-DSS and NIST 800 compliance.
  • Guided GDPR and CCPA compliance across business units.

B.S. Computer Science, University of the People. CompTIA CASP+ and Security+. InfraGard member since 2018.

no one asked me to build these

After hours.

Remote Command

A browser artillery game, shipped end to end alone. PixiJS, GSAP, Vite and Howler on Cloudflare Workers, with Playwright tests, gitleaks and semgrep in CI, and portal builds for CrazyGames, Poki, Y8, Kongregate and Itch.io.

PixiJSGSAPWorkersPlaywright
Play it

0xRoulette

Roulette backtesting for people who would rather write a Lua strategy than place a bet. Includes a built-in Lua IDE running against simulated wheel outcomes.

ReactViteLua
Open it

The fleet

44 sites on Cloudflare Workers, kept alive by autonomous agent roles on a scheduler, with a custom API telemetry collector, Grafana dashboards, and a FastAPI/SQLite site tracker.

WorkersGrafanaFastAPIAgents
Read the case

AI_Team

A portable agent orchestration platform that drives multi-step software work without step-by-step direction.

AgentsOrchestration

R4

A native Rust GUI for a software-defined radio, with real-time signal visualization on an egui immediate-mode UI.

RusteguiSDR

brain dumps with receipts

Field notes

open to the right role

Let's build something that never pages you at 3am.

Email JesseLinkedInGitHubcontact@infrainnovator.com