Head of DevOps, SRE & Security (DevSecOps)
Group CTO for 145 people across six countries, and still hands on. Payment rails for a central bank, an AI agent platform on three clouds, ten A100s on bare metal, and two certifications that passed audit.
- 99.999%on Bakong, the National Bank of Cambodia's payment system
- 0 findingsin the ISO 27001 surveillance audit; SOC 2 Type II passed twice
- 145 peopleacross six countries, reporting to the chief executive
Timeline
What I have run
Eight areas, one standard of evidence
Leadership
145 people · 6 countriesGroup CTO · Head of DevOps, SRE & Security
Leadership
145 people · 6 countries- The whole organisation reported to me, with offices in Japan, Russia, Switzerland, Montenegro, Thailand and Dubai. I reported to the chief executive.
- Built the technical organisation first: 37 direct reports at peak, 12 DevOps, 6 security, 19 QA.
- At Everworker: greenfield, no tooling, process or headcount. Built a security team of 4.
Payments & CBDC
99.999%Bakong · CBDC pilots
Payments & CBDC
99.999%- Reliability and security for Bakong, the National Bank of Cambodia's payment system, written in Java on Hyperledger Iroha.
- More than $150B settled in 2024, about 330% of Cambodia's GDP, and 1.3 billion payments in 2025, as published by the NBC.
- CBDC pilots across the group. Contributor to Central Banking's "CBDC Partner of the Year", 2020.
Platform & AI
300+ apps · 99% IaCAWS · Azure · GCP · bare metal
Platform & AI
300+ apps · 99% IaC- An AI agent platform on three clouds, shipped as SaaS and self-hosted in customers' own accounts.
- AWS Marketplace listing with Helm charts for three clouds, shipped alone after being told it needed paid partners. AWS Marketplace
- 10 × NVIDIA A100 on bare metal at Moro Hub, Dubai (Tier III), after one forgotten GPU instance burned thousands of dollars in two days.
- 300+ applications, 700+ repositories, 6 GitHub organisations. Build times down 40%, cost down 30%+.
Reliability
MTTR −60%SRE practice founded from nothing
Reliability
MTTR −60%- Embedded SRE for 20+ stream-aligned teams across 4 regions: SLIs, SLOs, error budgets, incident command, blameless review.
- SLA moved from 99% to 99.99%. Automated backup and DR for 5 mission-critical systems, with the restores actually run.
- On-call people can live in: a daily rota, a backup on every shift, a runbook and a metric for every alert.
Security & assurance
0 surveillance findingsISO 27001 · SOC 2 Type II · NIST CSF
Security & assurance
0 surveillance findings- ISO/IEC 27001:2022: closed the initial audit's 5 minor non-conformities, then passed Surveillance Year 1 with zero findings. Trust Center
- SOC 2 Type II passed two years running, scope widened to Privacy and Availability. Ran the NIST CSF programme on customer demand.
- Secure SDLC across 100+ developers: STRIDE and VAST threat models, CVSS and EPSS scoring, Security Champions. Exposure windows down 70%.
- Independent penetration test: 12 findings (1 high, 6 medium, 5 low) triaged; the key ones became DAST regression checks, so they stay tested.
Products
2 products · 2 × 12 peopleowned end to end
Products
2 products · 2 × 12 people- A payment system for Caribbean islands, with its own team of 12.
- A loyalty-points system for a large ecosystem, with its own team of 12.
Web3
same gates as paymentsPolkadot · Klaytn · SORA
Web3
same gates as payments- Web3 Foundation grants, Polkadot-ecosystem development, Klaytn and the SORA ecosystem, on the same pipelines and security gates as the payment systems.
- Spoke at Next-Generation Payments 2023 and at fintech conferences in Bangkok.
Incident reviews
From incident response, audits and client platform work. Each one ended in a control, not a patch.
Source-code exfiltration and extortion attempt
87,000 events analysed
- Detected
Anomalous repository activity.
- Investigated
Forensics across an 87,000-event audit export. The credential's reach was re-tested, not assumed.
- Fixed
Containment and credential reset, then organisation-wide access rebuilt as Pulumi IaC so manual grants cannot come back.
A credential rotation the monitoring could not see
0 data lost · fixed same day
- Detected
On a client platform, the managed database rotated its master password on schedule and the application lost its database connection overnight. No alert fired.
- Investigated
The app read the password once, at deploy. A review of the alerting found every rule blind in its own way: the process stayed up, error thresholds sat above what this traffic could reach even at total failure, and the pool alert blamed slow queries.
- Fixed
Same day: the app moved to a least-privilege role with a password the team owns, and a deploy now fails if that credential cannot log in. New alerts on an empty pool, the health endpoint, a connection floor and a missing backup. No data was lost.
Webhooks failing on one request in four
fixed upstream for every user
- Detected
On a client platform, webhook 500s, signature mismatches and CSRF errors hit about a quarter of POST requests after an upstream image changed underneath the pinned release.
- Investigated
Chunked request bodies reached the app empty: it reads the body by Content-Length, and a chunked request has none. The 500s were logged nowhere, because the framework's default logging swallowed them with debug off.
- Fixed
Request buffering became the default in the open-source deployment tool, the app de-chunks at the WSGI layer, webhooks never answer 5xx, and errors land in structured logs.
Connection refused, 14 seconds at a time
0 of 7,254 probes failed
- Detected
End users of a client platform reported refused connections on port 443. The cloud autoscaler had evicted the edge proxy 37 times that day, against 0 to 8 a day before.
- Investigated
The proxy drained for 10 seconds; the load balancer needed about 24 to drop the node. Reproduced with a half-second probe: a 14-second window in which about half of new connections failed.
- Fixed
Drain longer than the health check, proxies spread hard across hosts, and both settings added to the open-source tool. 0 failures in 7,254 probes across rollouts.
A release process with a skippable step
deploys now all-or-nothing
- Detected
On a client platform, production ran 20 to 30 minutes without its background-task processor while uptime stayed green: the worker had not been deployed, so nothing could alarm.
- Investigated
The release relied on two separate manual steps, web then worker, and nothing checked that both had run. Pre-merge checks and admission control were ruled out: git was correct, and the worker was never submitted.
- Fixed
Split services now deploy as one ordered workflow that goes red unless both halves succeed, and the standalone worker deploy was removed. Parity alerts stay as the backstop.
Alerting nobody trusted
89% false → 0
- Detected
232 CloudTrail alarm fires in 14 days, about 89% false positive.
- Fixed
8 detectors beyond the CIS baseline with per-detector exclusions: single-digit daily fires, zero false positives in the first window, a runbook for every alert.
The watchdog that stopped watching
stuck runs now self-clear
- Detected
A client's dead-man's switch had quietly stopped: for 4.5 days every scheduled run ended cancelled.
- Investigated
One run that the CI platform left queued held its concurrency group forever. Timeouts do not apply before a job starts, so each later run waited and was then cancelled. It recurred within a day.
- Fixed
Short scheduled workflows now cancel the run in progress, so a stuck run is replaced by the next one instead of blocking it.
A bill up 52% at 4% CPU
11 pinned nodes → 5-9 on demand
- Detected
A cost review on a client platform: the forecast up 52% in a month, with 18 nodes running at about 4% CPU.
- Investigated
The deployment tool's default disruption budget left single-replica services zero allowed evictions, so the autoscaler could never drain a node. Every new white-label pinned another one.
- Fixed
A budget that allows one eviction, swept across 13 repositories. Production went from 11 pinned nodes to 5-9 on demand, staging from 7 to 3. The upstream default flip was held back: too much accumulated change for a payments production.
An ISMS that claimed tools the company did not have
29 policies verified
- Detected
29 inherited AI-drafted policies citing MDM, EDR and directory services that did not exist.
- Fixed
Verification of every named tool and role made mandatory before approval. AI drafts, evidence decides.