Cellebrite's first SaaS product, secure from day one

Three roles in just over a year: integrate an acquisition, architect the company’s first SaaS product, then run it. Weekly releases ended up with 85% less user downtime.

client
Cellebrite
role
DevOps Engineer, SaaS Architect, SaaS Ops Manager
when
2021 to 2022
drawn by
Jesse Tamburino
POST-ACQUISITION INTEGRATION01BlackBagacquired companyCellebrite AWSfirst GovCloud accountsIdentity + policyOkta SSO, roles, policiesFIRST SAAS PRODUCTCI/CDsecurity features,linters, controls02Deployweekly releases,revamped03Usersdowntime -85%SecurityMFA · pen-test review · DR/BC plans · incident drillsOPERATE04DatadogPagerDutyStatus.ioCOMPLIANCE + TEAM05SOC 2StateRAMPFedRAMPSRE team: hired + mentored
Integrate, secure, release, operate.Hover a step below to find it on the sheet. Scroll sideways on small screens.
-85%release downtime
3compliance programs
1stGovCloud accounts

the problem

A forensics company going SaaS for the first time, mid-acquisition, on its way to a NASDAQ listing. The product needed security at every phase, an operations foundation, and a compliance path, all at once.

Constraints

  • BlackBag's infrastructure and products had to be folded into Cellebrite's, without stopping either.
  • Government customers meant GovCloud and a FedRAMP and StateRAMP path from the start.
  • Weekly releases were costing users downtime.
  • There was no SRE team yet.

Stack

AWSAWS GovCloudOktaJenkinsTerraformAnsibleDatadogPagerDutySOC 2FedRAMP

how it is built

  1. 01

    Integrate

    Led post-acquisition integration of BlackBag's infrastructure. Set up Cellebrite's first AWS GovCloud accounts, and many after; integrated Okta SSO and established roles and policies.

  2. 02

    Secure the pipeline

    Directed the CI/CD build-out and, with SRE and development, added security features, linters and controls.

  3. 03

    Fix the release

    Revamped deployments, cutting user downtime 85% during weekly releases.

  4. 04

    Operate

    Integrated monitoring with Datadog, PagerDuty and Status.io; wrote DR/BC plans and runbooks; ran mock incident response training.

  5. 05

    Comply and staff

    Headed SOC 2, StateRAMP and FedRAMP initiatives. Established, interviewed for and mentored the SRE team.

calls I made

Why it looks like this.

01

Security is a phase gate, not a phase

MFA, pen-test review and pipeline controls went in while the product was being built, which is cheaper than retrofitting them before an audit.

02

Downtime is a deploy problem

The 85% came from changing how releases deploy, not from asking users to tolerate a maintenance window.

03

Hire the team you will hand it to

Building the SRE team and its roadmap was part of the architecture work, not something after it.

Want the longer version, with the parts that went wrong?

Ask me about it