Kyle Berry
Austin, TX kyle@kyleberry.com linkedin.com/in/kylefberry github.com/kyleberry

I’m an engineering manager with 14 years in infrastructure and cloud operations, currently leading infrastructure at a device management and security company. I own the cloud security foundations of our AWS platform, including IAM, secrets and encryption, the WAF and CDN edge, and the logging that feeds our SIEM. I’ve led infrastructure through 3 consecutive years of SOC 2 Type II and ISO 27001 audits with zero exceptions, and I’m known for making ownership clear across teams and building guardrails that let engineers ship quickly without trading away security.

Experience
Iru (formerly Kandji) · Miami, FL (remote)
Engineering Manager, Infrastructure · Dec 2023-Present
Lead Infrastructure Engineer · Jul 2021-Dec 2023
Security & Compliance
  • Owned infrastructure’s scope of the SOC 2 Type II, ISO 27001, and ISO 45001 audits for 3 consecutive years, covering 45-55 controls annually. Gathered all infrastructure evidence, represented infrastructure in auditor sessions, and partnered with GRC to close every cycle with zero exceptions.
  • Supported the GRC team on customer security questionnaires, providing the cloud and infrastructure security responses.
  • As lead engineer, helped build the AWS security telemetry pipeline (CloudTrail, GuardDuty, Security Hub, and VPC Flow Logs) feeding the Security team’s Panther SIEM and Datadog. My team still owns and operates it.
  • Built our edge security layer with the team during my time as lead engineer, including the Fastly CDN, Signal Sciences WAF (now Fastly Next-Gen WAF), and automated TLS certificate management. We still run all three.
  • Run immutable, idempotent infrastructure in private subnets behind VPN, with no public SSH. New AMIs roll out as soon as AWS ships Amazon Linux updates, keeping OS-level vulnerabilities patched on a regular cadence.
  • Led the deployment of Wiz, Snyk, and Panther across a 40+ account AWS environment, and added Trivy scanning to the self-hosted Harbor container registry.
  • Owned and remediated a large raw CVE backlog and mapped each finding to its owning team. The Security team adopted that routing for ongoing vulnerability management.
  • Delivered a dedicated OpenBao Transit encryption cluster protecting customer data and device secrets for 1M+ managed devices. Authored the architecture RFC and operational SOP, and guided the design of namespace isolation and rate limiting.
  • Manage IAM and SSO integration across 40+ AWS accounts.
Leadership & Operations
  • Manage a distributed team of 5-6 senior/staff engineers; established structured technical interviewing loops, career ladders, and promoted 2 engineers (including Staff promotion).
  • Currently building a new SRE function, starting with the hire of a Staff SRE to lead it.
  • Serve as the tier-4 manager escalation on a 24/7 on-call rotation for major incidents. Acted as incident commander for several Sev 1 and Sev 2 incidents and represented infrastructure in incident response, including security incidents.
  • Led a cross-functional working group that designed the company-wide incident management process, including severity and priority definitions, on-call schedules, and paging standards.
  • Own quarterly planning and OKRs for infrastructure, tied to company-wide initiatives such as new product launches. Gather requirements from development teams in company-wide planning and reserve capacity for unplanned requests from internal customers.
  • Meet regularly with the CTO and CFO on infrastructure strategy, vendors, and cost, and partner with Finance on budgeting.
  • Own roughly $10M in annual infrastructure spend and contracts, including $7-8M in AWS. Manage vendor relationships and negotiations with AWS, Datadog, Codefresh, and Fastly.
  • Led multiple AWS cost optimization efforts, including one initiative that reduced cloud spend by 40%. Kept costs low while the company continued to grow.
  • Kept the infrastructure team stable through multiple major company reorganizations while standardizing tooling, practices, and operational procedures across engineering.
Weedmaps · Irvine, CA (remote)
Lead, Senior DevOps Engineer · Aug 2016-Jul 2021
  • Designed least-privilege IAM across 16 purpose-segmented AWS accounts, scoping access by role, permission, and account, and codified it all in Terraform.
  • Led the migration from CloudFront to Fastly. Helped roll out the Signal Sciences WAF and tune its rules, and worked with PerimeterX bot protection.
  • Built and maintained a 100% AWS platform using Terraform, and led major Terraform version upgrades spanning thousands of resources.
  • Led the migration off Rancher 1.6, an end-of-life orchestrator, onto EKS, and decomposed an Ansible-managed monolith into microservices along the way.
  • Led a dedicated DevOps squad of 3 engineers as acting team lead, owning priorities, technical direction, and delivery.
  • Migrated CI/CD from self-hosted CircleCI to Codefresh and Argo CD, moving to GitOps so every deploy traced back to a Git commit and engineers no longer needed direct cluster access.
  • Cut on-call paging to fewer than one page per week by consolidating logging, metrics, and alerting onto Datadog and PagerDuty and rewriting noisy alerts around real user impact.
  • Migrated hundreds of domains to Route53 as part of the move to a fully AWS-managed platform.
Bigcommerce · San Francisco, CA
Systems Engineer II · Jul 2015-Aug 2016
Production Operations Engineer · Jun 2013-Jul 2015
  • Operated infrastructure within an 800-server bare-metal PCI cardholder data environment. Supported annual PCI DSS audits, including in-person auditor interviews, and handled daily compliance tasks.
  • Maintained a large server fleet with Puppet and Ansible, and was the primary engineer on an Ansible-managed analytics service.
  • Supported Ruby and PHP application deployments and maintained a large Elasticsearch cluster.
Rackspace Managed Hosting · Austin, TX
Linux Systems Administrator · Feb 2012-Jun 2013
  • Supported dedicated RHEL/CentOS servers and OpenStack hybrid cloud environments for a diverse customer base, working directly with data center and networking teams.
Personal Infrastructure
  • Run an IaC-managed homelab (Proxmox, OPNsense) with a self-hosted Forgejo git forge and CI. It uses Checkov and tfsec for IaC scanning, secrets scanning, Renovate for dependency updates, and OIDC federation to AWS instead of long-lived keys.
Skills
Security
SOC 2 Type II ISO 27001 PCI DSS IAM & SSO OIDC Federation Vault / OpenBao Wiz Snyk Panther GuardDuty Security Hub CloudTrail Trivy Fastly Next-Gen WAF Checkov tfsec
Platform
AWS Terraform Kubernetes (EKS) Docker Harbor GitHub Actions Forgejo Datadog PagerDuty Fastly Linux
Leadership
Team Building & Hiring Incident Command Quarterly Planning & OKRs Vendor & Contract Management Cost Optimization Technical Strategy