Censys

• One of two founding SREs responsible for the reliability of the entire company’s infrastructure — supporting ~50 engineers across a ~130-person company. Established the site reliability practice at Censys, introduced its first SLAs and SLOs, and shaped standards, tooling, and culture as the organization grew.
• Helped grow the SRE team from two engineers to eight, participating in the hiring, vetting, and onboarding of every engineer on the team — 50+ interviews over the tenure, including for the team’s own management — while sustaining one of the team’s highest code-review loads (950+ reviews across 10+ repositories), a primary channel for mentoring as the team scaled.
• Architected two platform generations at Censys: the FedRAMP-oriented Gen 3, then the multi-year “Gen 4 Platform” initiative as co-architect — a ground-up redesign of Censys’s infrastructure on GCP and GKE that consolidated a sprawl of weakly separated clusters and environments into 8 clusters with firm dev/staging/prod boundaries, built around a hub-and-spoke network topology with clear network contracts and GitOps delivery via ArgoCD, custom Helm charts, and Helmfile. Personally scaffolded the entire Gen 4 Terragrunt tree and retired Gen 3 outright; ~80% of the company’s hundreds of microservices now run on Gen 4.
• Championed a shift-left, self-service infrastructure model born of necessity: with two engineers and no bandwidth to white-glove requests, designed the platform so Terragrunt performs belt-and-suspenders base provisioning while nearly all other infrastructure — hundreds to thousands of managed resources — is delivered to 10–15 product teams through Crossplane (including a custom Crossplane provider I authored to manage Temporal.io namespaces as first-class Kubernetes resources). Before this model, Censys had no true dev environment and inconsistent deployments; today a developer goes from scratch to a deployed application, with all supporting infrastructure and automatic validation, in under 15 minutes.
• Led the Gen 4 service-migration effort from the front: personally re-platformed more services than any other engineer — migrations spanning Spanner, Pub/Sub, IAM, Cloud SQL, and CI rework — and made the process repeatable for every team by building dedicated migration tooling (scripts and a Claude Code skill) plus platform patterns and adapters for DNS and load-balancer infrastructure that smooth a service’s path onto Gen 4.
• Primary architect of the company-wide observability platform: a comprehensive Grafana LGTM stack ingesting ~28M active series at ~550K samples/sec and ~1.5 TB of logs per day, with Prometheus and Alloy at the edge feeding Mimir, Loki, Tempo, and Pyroscope, plus eBPF-based auto-instrumentation via Beyla. Scaled the stack from initial bootstrap to fully distributed, multi-tenant operation, consolidated log collection from Promtail to Alloy across datacenters and clusters, and refactored the company’s alerting to sharply improve signal-to-noise for on-call engineers.
• Drove service-mesh adoption end-to-end: evaluated, deployed, and operationalized Linkerd across effectively every cluster — Gen 4 and legacy alike — then led the migration of high-egress services onto the mesh. Owned the move to Linkerd Enterprise with HAZL in a multi-cluster environment, from solution investigation and trial evaluation with Buoyant through contract negotiation and implementation, cutting cross-AZ network transit fees by ~$300k per year.
• Built the organization’s JIT-access operator in Go — prototyped solo in three days, then productionized across every Gen 4 cluster — which, together with GCP Privileged Access Manager, eliminated all standing production access. By design, the platform’s paved roads (GitOps delivery, self-service observability, progressive delivery, Crossplane abstractions) mean engineers rarely need elevated access at all. Also drove a cluster-wide Kyverno policy platform, including CEL-based policy migration and supply-chain image validation.
• Authored a DynamicQuota Kubernetes operator in Go that computes total live cluster capacity and creates or updates ResourceQuotas as a percentage of it, rather than requiring static resource limits.
• Own the CI/CD platform: stood up GitHub Actions self-hosted runner scale-sets, published org-wide reusable per-runtime workflows, and led the vendor evaluation and migration to Blacksmith hosted runners — with 50–90% build-time improvements on services migrated so far. Designed a dynamic-dispatch CI architecture to consolidate hundreds of hand-authored workflows down to fewer than 30, and built a Kargo-based progressive-delivery pipeline (Argo Rollouts, Gateway API, Linkerd) now handling real production promotions in limited availability.
• Drove cloud cost optimization: led the adoption and implementation of GKE Compute Classes (priority-based instance selection), diagnosed and corrected a mischaracterized data-cluster spend trend, and delivered right-sizing recommendations for 22 services — measures saving on the order of $30k per month, independent of the service-mesh transit savings.
• Built Censys’s ML infrastructure from the ground up — predominantly on GCP/GKE, with bare metal on the roadmap — partnering directly with the ML team on a tight timeline. Stood up custom GKE Compute Classes targeting GCP GPU and TPU accelerators, tailored networking and permission boundaries to the environment’s unique cross-cutting requirements, and optimized workloads (including stabilizing LiteLLM) for reliable operation.
• Run Kubernetes on bare metal in the colo with Talos Linux managed via Omni, engineering a sophisticated multi-CNI network stack — Multus fronting Cilium and SR-IOV — to meet demanding high-performance networking requirements. Wrote a mutating admission webhook that assigns pods an SR-IOV interface via weighted-random selection from a pool of NetworkAttachmentDefinitions, balancing utilization across interfaces and preventing IP exhaustion.
• Operate a colo footprint spanning two datacenters — connected to the GCP footprint via Cloud Interconnect — anchored by a 200+ node Elasticsearch cluster holding ~500 TB of data across ~50 bare-metal hosts, managed through Ansible (AWX) with dynamic inventory sourced from an extensively customized NetBox deployment.
• Designed and executed a fleet-wide Elasticsearch storage-encryption migration — replacing mdadm RAID with LUKS + Tang encryption and per-JVM NVMe mounts — performed live against the production cluster with zero data loss, driven by SOC 2 compliance, scaling needs, and best practices. Included debugging boot failures down to the dracut and firmware level on Tyan chassis hardware.
• Self-initiated a NetBox–Censys integration (“netboxer”): a full NetBox plugin surfacing ASM/CVE risk directly on device and VM pages with a triage workflow, designed and built solo in five days to close the gap between security tooling and infrastructure inventory. Now in internal use, with the goal of open-sourcing it.