Command-line tool built at Myant to monitor SSL/TLS certificate expiry across all production applications and validate Apple PUSH notification certificates to prevent silent outages from expired certs. Outputs days-to-expiry per cert and fires alerts at configurable thresholds.
Designed and maintained the complete mobile CI/CD infrastructure at Myant: Firebase, App Store Connect, TestFlight, and Google Play Console. Automated certificate provisioning, code signing, and release cycles end-to-end across dev, staging, and production environments.
Developed the CrossTab pivot table feature for the SAP BI mobile app, used by millions globally. Engineered custom data structures and rendering algorithms achieving lag-free scrolling on datasets exceeding 10 million rows. Integrated Dynamics security framework enhancements.
At Darkmatter LLC, benchmarked 90+ SAST tools, triaged 400+ issues in two weeks, and achieved a zero-issue security baseline. Authored a 200-page internal iOS security guide and demonstrated mitigation POCs validated by TVLabs. Covers FIPS 140-3 and NIST 800-53 controls.
Redesigned the CD pipeline at Darkmatter, automating localization workflows and key release processes. Significantly reduced release cycle overhead while enforcing cryptographic compliance and secure signing key management across environments.
Provided L2/L3 production support for enterprise applications in FDA and HIPAA regulated environments, ensuring stability, compliance, and release readiness. Managed the full mobile DevOps lifecycle for iOS and Android. Owned CSR creation and SSL/TLS certificate management across multiple applications, including expiry monitoring, rotation, and prevention of production outages.
Performed enterprise security issue triaging using the Synopsys Security Orchestration Platform (SSOP), reviewing Coverity findings, prioritizing issues, and coordinating remediation. Collaborated with senior engineers during high-severity assessments. Won the internal Triage-a-thon competition, recognized for the highest volume of resolved issues with strong accuracy under time pressure.
Supported enterprise iOS application development and production issue triage. Benchmarked 90+ SAST tools and triaged 400+ issues in two weeks achieving a zero-issue security baseline. Redesigned the CD pipeline and automated localization and key release processes. Authored a 200-page iOS security guide and demonstrated mitigation POCs validated by TVLabs.
Developed the CrossTab pivot table feature for the SAP BI mobile application, used by millions of users globally. Optimized rendering with custom data structures and algorithms, achieving lag-free scrolling for datasets exceeding 10 million rows. Integrated Dynamics security framework enhancements and addressed data protection vulnerabilities.
Certificate expiry is one of those production failures that feels embarrassing in retrospect. The system didn't break, it just quietly stopped working because nobody remembered to renew a cert. During my time at Myant, I owned SSL/TLS certificate management across multiple enterprise applications. Here's what I learned.
The most dangerous thing about expired certificates is how invisible they are until they aren't. Services go down, users get cryptic errors, and the on-call engineer spends the first 30 minutes ruling out code changes before someone finally runs openssl x509 -in cert.pem -noout -dates and sees it expired at 2AM. I saw this often enough that I built a CLI tool to scan every certificate we owned and report days-to-expiry in one shot — across standard TLS, mutual TLS, and Apple PUSH certs.
Apple PUSH certificates for iOS apps live outside your standard PKI, have their own lifecycle, and expire silently — your app keeps functioning fine until one day all push notifications just stop. Regenerating them requires revoking, re-creating through App Store Connect, and redeploying signed builds. The lesson: PUSH certs need their own monitoring track, completely separate from your HTTPS chain. My tool added a dedicated check using openssl s_client against Apple's APNS gateway alongside standard x.509 validation. One command, full visibility.
Manual renewal processes break the moment the person who owns them goes on leave. The right pattern: automated discovery of all certificate fingerprints in your environment, a scheduled cron check that fires alerts at 60, 30, and 7 days to expiry, and a rotation runbook that has been tested, not just written. Once you have automated visibility, certificate expiry stops being a crisis and becomes a routine task picked up in the next sprint. The engineering time saved from that first prevented outage pays for the tooling three times over.
There's a common view in DevOps circles that ITIL is bureaucratic overhead, something large enterprises invented to slow engineers down. Having worked in ITIL-aligned environments across financial services and health-tech, I'd push back on that. The discipline ITIL enforces is exactly what separates a 20-minute P1 resolution from a 4-hour war room with seven people and no clear owner.
At its core, ITIL enforces three habits that matter most during incidents: classification (is this an incident, a problem, or a change request?), escalation (who owns this right now?), and documentation (what did we try, what happened, what was root cause?). Without these habits, every major incident becomes ad-hoc firefighting where five engineers are pulling logs in parallel, nobody knows who's communicating to stakeholders, and the post-mortem two days later is mostly reconstruction from memory.
L1 handles known issues and first-contact triage. L2 handles application-level investigation and reproduction. L3 involves platform, architecture, or vendor escalation. This tiering exists not to add process but to protect engineering focus. When I operated at L3 at Myant, the L2 filter meant I only received incidents that genuinely required deep investigation — not password resets, not known bugs with documented workarounds. The SLA pressure at each tier keeps the signal clean and the response proportionate.
The best teams I've seen treat ITIL principles as guardrails, not approval gates. You can have CI/CD pipelines deploying ten times a day and still maintain disciplined change advisory for high-risk releases, thorough post-incident reviews, and structured problem records that prevent recurrence. The velocity of DevOps is not in conflict with the accountability of ITIL. One moves fast; the other ensures you learn from when you moved too fast and something broke. Both matter.