Ronnie Mbuthia — Platform Engineer · Cloud Infrastructure

$ whoami

Infrastructure that gets out of
the developer's way.

I'm Ronnie Mbuthia, a Platform / DevSecOps engineer based in Nairobi. Since 2016 I've built and operated the systems underneath payment networks, logistics platforms, IoT fleets, and healthcare products — the layer where a bad Tuesday becomes an outage, or doesn't.

My work sits at the intersection of platform engineering, cloud architecture, and security automation: designing AWS environments entirely as code, running multi-cluster Kubernetes with GitOps, and wiring security scanning, secrets management, and compliance checks directly into the pipeline so they're impossible to skip.

I care about developer experience as a product. At Sendy, GitOps with ArgoCD meant engineers shipped their own services without filing a ticket. At M-Gas, zero-touch pipelines took releases from ceremony to non-event. At Cellulant, caching and stream processing took payment throughput from 20 to ~200 TPS. Reliability, observability, and automation aren't features I add at the end — they're the platform.

$ ls ./skills

Stack & proficiencies

☁

Cloud

AWSAzureGCPHetznerOVH

📦

Containers

DockerKubernetesHelmEKSECS

🏗

Infrastructure as Code

TerraformCloudFormationAWS CDKAnsible

🔁

CI/CD & GitOps

GitHub ActionsGitLab CICodePipelineBitbucketJenkinsArgoCDFluxSpinnaker

📈

Monitoring & Observability

GrafanaPrometheusCloudWatchDatadogNew RelicZabbixELK

🔐

Security

IAMVaultOkta SSOSnykSonarQubeRapid7QRadarAWS WAFSecurity Hub

🌐

Networking

VyOSIPSecWireGuardVPNCloudflareNginx

⌨

Programming

PythonBashGolangJavaScriptNode.js

✅

Compliance

SOC 2GDPRHIPAAPCI-DSS

$ git log --career

Career timeline

2024 — 2025

DevSecOps Lead · The WoundPros US · healthcare

Led DevSecOps across AWS & Azure for a HIPAA-regulated healthcare platform. Embedded vulnerability scanning and pen-testing into CI/CD, rolled out Okta SSO synced with the Microsoft directory, and built a secure multi-cluster Kubernetes environment with RBAC and integrated secrets management.

▸ MTTR for security issues down 30% via automation
▸ Deployment time down 40% via IaC provisioning
▸ Data security for email/SaaS via Virtru rollout

AWS CDKTerraformKubernetesOktaSnykRapid7GrafanaELK

2023 — 2024

DevSecOps Manager · M-Gas KE/TZ · IoT energy

Managed the DevOps team; designed CI/CD with GitHub Actions and Terraform Cloud, hardened AWS with IAM, KMS, WAF and Security Hub, and delivered telco VPN integrations (Tigo, Vodacom, Airtel) for smart-meter traffic in Tanzania.

▸ Security-by-design embedded in the delivery lifecycle
▸ Cross-carrier IPSec connectivity across two countries

GitHub ActionsSpaceliftAWS KMSpfSenseWAF

2022 — 2023

Senior Reliability Engineer · Sendy KE · logistics

Bootstrapped and led the SRE resiliency team. Migrated the platform from bare metal to AWS EKS with Terraform, introduced GitOps with ArgoCD + Helm/Kustomize so developers self-serve deployments, and secured the private network with VyOS + WireGuard.

▸ Bare metal → EKS migration, 100% Terraform
▸ Daily releases via multi-pipeline GitLab CI
▸ Multi-provider redundancy for DNS & load balancing

EKSArgoCDHelmVaultDatadog APMCloudflareWireGuard

2020 — 2022

DevOps Lead · M-Gas KE · IoT energy

Built AWS infrastructure 100% as code across a multi-account Landing Zone with zero-touch release pipelines, self-healing autoscaling with CodeDeploy, and site-to-site VPNs to Safaricom and Vodacom for meter traffic. Hired and trained a team of three engineers.

▸ Mean time to detect: 30 min → under 5 min
▸ AWS security score: 46% → 70%+
▸ Zero-touch deployments across all accounts

CloudFormationCodeDeployCognitoAzure ADDatadogGrafana

2020

DevOps Consultant · Grow Mobile Technology KE

Designed VPCs, IAM, and network architecture from scratch; hardened access with NACLs, security groups, MFA, and role-based access; configured autoscaling and utilization-based alerting for production workloads.

VPCIAMOpenVPNCloudWatchAuto Scaling

2016 — 2020

SysAdmin / Operations Engineer · Cellulant Pan-Africa · fintech

Ran ~40 Linux servers behind 24/7 payment products across multiple markets. Drove the move from a monolith to Dockerized microservices on EKS/ECS, built CI/CD on Jenkins & GitLab, and implemented RESTful USSD and mobile-money integrations between banks, merchants, and mobile operators.

▸ Payments throughput: 20 → ~200 TPS, ~500K QPS
▸ Turnaround time down 50% with RabbitMQ + Redis
▸ 100% issue-resolution score as escalation point

KubernetesDockerTerraformRabbitMQRedisSpring BootGitLab CI

$ kubectl get projects

Selected work

Bare Metal → EKS Migration

Sendy · SRE

Problem: Logistics platform on bare metal: slow provisioning, single-provider risk, manual deploys.
Solution: Terraform-provisioned EKS with GitOps (ArgoCD + Helm/Kustomize), external-secrets to Vault, VyOS/WireGuard-secured network.
Impact: Developers self-serve deployments daily; multi-provider DNS & LB redundancy; full Datadog APM coverage.

TerraformEKSArgoCDVaultDatadog

Zero-Touch Multi-Account Delivery

M-Gas · DevOps Lead

Problem: Manual, error-prone releases across a multi-account AWS Landing Zone for a smart-meter fleet.
Solution: CloudFormation-driven pipelines with autoscaling + CodeDeploy self-healing; Cognito + Azure AD SSO; full-code infrastructure.
Impact: Zero-touch deploys everywhere; detection 30→5 min; security score 46%→70%+.

CloudFormationCodeDeployCognitoGrafana

Payments Platform at 10× Scale

Cellulant · Ops Engineer

Problem: Monolithic payment services capped at ~20 TPS, database-bound, across multiple African markets.
Solution: Microservices in Docker on EKS/ECS; RabbitMQ stream processing + Redis caching; DB cluster load-balancing.
Impact: ~200 TPS & ~500K QPS; processing turnaround down 50%; 24/7 uptime on ~40 Linux servers.

EKS/ECSRabbitMQRedisSpring Boot

Zero-Trust Identity & SSO

The WoundPros · DevSecOps Lead

Problem: Fragmented logins across in-house healthcare apps in a HIPAA environment.
Solution: Okta SSO integrated with the Microsoft user directory for synced identities and policies; Virtru for data-centric email/SaaS security.
Impact: Single secure front door for every internal app; simpler audits; stronger compliance posture.

OktaAzureVirtruIAM

Cross-Border Telco Connectivity

M-Gas · DevSecOps

Problem: Smart-meter traffic needed private, reliable paths to five mobile carriers in Kenya & Tanzania.
Solution: Site-to-site IPSec VPNs to Safaricom, Vodacom, Tigo & Airtel; redesigned production network for multi-tenancy.
Impact: Reliable, isolated meter traffic across two countries and five carrier networks.

IPSecpfSenseVPCNetworking

Security-Gated CI/CD

The WoundPros · DevSecOps Lead

Problem: Security reviews happened after the code shipped — findings piled up, fixes were slow.
Solution: Snyk, SonarQube, Rapid7 & QRadar wired into every pipeline; automated patching with Wazuh, SSM & GuardDuty; Python/Bash compliance checks.
Impact: Security-issue MTTR down 30%; findings blocked at the gate, not discovered in prod.

SnykSonarQubeGuardDutyPython

$ terraform graph

Live architecture

Real systems I've designed and run. Hover any node — watch requests move.

$ curl -s grafana/api/health

Observability, always on

A live simulation of the dashboards I build — because if it isn't monitored, it's already down.

prod-eks-platform · last 5m auto-refresh 5s ↻

CPU %

Memory %

p95 latency (ms)

Error rate %

Traffic — requests/sec

Deploy frequency

0

MTTR

0

Availability

0

$ cat .github/workflows/security.yml

Security that ships
with the code.

Security isn't a gate at the end of the pipeline — it's a control at every stage of it. This is where the checks actually run.

plan
Threat modelling and security-by-design folded into delivery, not bolted on after.
code
SonarQube static analysis on every pull request, with quality and security gates that block merges.
build
Snyk dependency and container image scanning wired into CI — vulnerable builds fail fast.
deploy
Terraform-provisioned infrastructure with least-privilege IAM and Kubernetes RBAC enforced by GitOps.
run
AWS Security Hub, WAF and Rapid7 watching production continuously, feeding straight into alerting.

🛡

Shift-left scanning

Vulnerability scanning embedded directly in CI/CD so issues surface at the pull request, where they're cheapest to fix — not in a quarterly report.

0 faster MTTR on security issues

SnykSonarQubeRapid7

🔑

Secrets & key management

Credentials live in Vault and are pulled at runtime via external-secrets, with AWS KMS for encryption. Nothing static in a repo, an image, or an env file.

zero long-lived credentials in source

Vaultexternal-secretsAWS KMS

🪪

Zero-trust identity

Okta SSO synced with the corporate directory, least-privilege IAM, and namespace-scoped Kubernetes RBAC — every request authenticated, nothing trusted by network position.

SSO + RBAC across multi-cluster estates

Okta SSOIAMKubernetes RBACVirtru

📋

Compliance as code

Regulated workloads across healthcare, payments and energy — controls expressed as infrastructure code and audited continuously rather than reconstructed before an audit.

AWS security score 0 → 0

SOC 2HIPAAPCI-DSSGDPRSecurity Hub

$ ssh ronnie@portfolio

Talk to the terminal

ronnie@platform: ~

ronnie@platform:~$

$ cat education.log

Education & credentials

B.Sc.

Computer Science

Kenyatta University · 2010 — 2014

CERT

Mobile Software Development & Entrepreneurship

Emobilis Mobile Training Academy · 2014

A+

CompTIA A+ — Hardware & Software Essentials

Computer Pride, Nairobi · 2010

$ docker ps --all

Daily drivers

$ prometheus --query career_totals

By the numbers

0years of experience

0production deployments

0cloud providers

0Kubernetes clusters managed

0automation scripts & modules

0Linux servers on 24/7 duty

0payment throughput scaled

0MTTR reduction via automation

$ ldapsearch references

References

Leaders I've built with — full contact details on the resume, available on request.

JG

John Gillespie

CTO · M-Gas Ltd

Worked together on M-Gas's AWS Landing Zone, zero-touch pipelines, and telco connectivity.

BM

Brian Muita

VP of Engineering · Sendy Ltd

Worked together on the bare-metal → EKS migration and the SRE resiliency team.

FW

Festus Were

DevOps Tech Lead · Cellulant Ltd

Worked together on pan-African payments infrastructure and the microservices migration.

CM

Chris Mwangi

Managing Director · Grow Mobile Technology

Worked together on cloud architecture and network security consulting.

$ echo "let's build"

Ship something reliable
together.

Open to platform engineering, SRE, and DevSecOps roles — remote or Nairobi.

[email protected] GitHub ↗ LinkedIn ↗ Download Resume ↓

Nairobi, Kenya · UTC+3 · +254 726 264139