Nelson’s Technical Hands-On Experience
Head of Engineering
linkedin.com/in/nelsonjr
This is a summary of my hands-on experiencing building products, as Architect, Design Lead, Tech Lead, or Individual Contributor. To access the full resume, please access the complete version at: go.lunenetworks.com/nelson/resume
Highlights
I am a hands-on technical leader who remains deeply involved in architecture, design, and implementation. Throughout my career—from kernel device drivers to distributed cloud systems—I’ve maintained active coding contributions while scaling engineering organizations.
Current Technical Practice: Even in leadership roles (Head of Engineering, Senior Director), I actively:
- Architect critical system components and review technical designs
- Write production code for complex features and infrastructure
- Debug distributed systems issues alongside my teams
- Implement security-critical components requiring deep expertise
- Drive technical decisions through hands-on prototyping and evaluation
Depth of Technical Expertise: My experience spans the full stack and beyond:
- Low-level systems: Kernel device drivers (Windows DDK/NDIS, VxD), TPM/HSM integration, network packet filtering, ring 0-3 synchronization
- Distributed systems: 100M+ node orchestration, multi-datacenter coordination, 99.999% SLA, millions of QPS
- Cloud-native architecture: Multi-cloud (AWS/GCP/Azure/OCI), Kubernetes at scale, microservices, service mesh
- Security engineering: Cryptographic systems (elliptic curves, El Gamal), PKI infrastructure, compliance frameworks (SOC2, ISO, CIS20, PCI)
- Modern web: React/TypeScript frontends, Go/Java backends, performance optimization, Lighthouse 90+ scores
Scale of Impact: Built and operated systems processing millions of QPS, managing 12K+ cores across 10+ datacenters, serving 300M+ daily users, with infrastructure costs in the $millions that I personally optimized.
AI & ML Infrastructure
As Head of Engineering at Union.ai, I lead the development of the next-generation AI orchestration platform:
- Flyte 2.0: Architecting and reviewing the agentic-capable AI/ML workflow system
- Low-latency scheduling: Sub-second workflow starts (down from minutes)
- Multi-cluster/multi-cloud: Seamless orchestration across cloud providers
- GPU optimization: 100x workflow efficiency through advanced resource management
- Agentic execution: Task/graph execution for autonomous AI agents
At Sourcegraph, pioneered infrastructure for Cody AI assistant:
- Built scalable hosting, deployment, and monitoring for LLM integration
- Designed API layers for third-party tools (IntelliJ, VS Code)
- Architected hybrid LLM support (commercial providers + customer-owned infrastructure)
Technical Proficiency
As a full-stack Engineer, my hands-on experience spans from kernel-level device drivers to modern web applications, including IoT embedded systems (Arduino, ESP32, PlatformIO).
Programming Languages
Expert (production systems, architecture, performance optimization):
- Go: Primary language at Grab, Indeed, Sourcegraph, Union. Built high-performance APIs, Terraform providers, infrastructure tooling
- C++: Extensive use at Google, Microsoft Research. Kernel drivers, TPM integration, ChromeOS security, IoT projects
- Java: Google infrastructure, Sourcegraph backend, Android development
- Ruby: Deep experience from Google Cloud projects (Puppet, Chef)
- C#: Microsoft MBSA, Virtual Machine Manager, .NET applications
- JavaScript/TypeScript: React applications, Node.js backends, build tooling
Advanced (shipped production code, team collaboration):
- Python: Infrastructure automation, data processing, ML pipelines
- PHP: Early web development, content management systems
- Assembly: Kernel development, device drivers, performance-critical code
Proficient (working knowledge, personal projects):
- Objective-C: iOS mobile applications (Lune Networks apps)
- Shell/Bash: Advanced scripting, deployment automation
Networking & Security
Network Infrastructure (physical to SDN):
- Physical: Fiber, RJ45, T1 lines, coaxial cabling for ISP and university
- Hardware: Configured Cisco, Juniper, Arista routing equipment
- Protocols: BGP, RIP routing; TCP/IP stack implementation
- Device Drivers: Windows NDIS network drivers, link-layer encryption
- Application-level: F5 load balancers, Identity-Aware Proxy (IAP), OAuth, OIDC
Security Implementation (systems I built):
- Cryptography: Implemented elliptic curves, El Gamal, RSA, AES for military/government
- PKI: Designed ICP-Brasil national infrastructure; built X.509 CA systems
- Hardware Security: TPM integration (ChromeOS), HSM (Aladdin, Gemplus, CryptoSystems)
- Network Security: Firewall development (He@tSeeker), VPN (OpenVPN, IPSec), packet filtering
- Compliance: Architected SOC2, ISO 27001, PCI DSS, CIS20 systems
Cross-Cloud Connectivity (production systems at Sourcegraph & Union):
- Built secure customer connections using Private Service Connect (GCP), PrivateLink (AWS/Azure)
- Designed VPN infrastructure, VPC peering, Transit Gateways for multi-cloud architectures
Infrastructure as Code
- Terraform: Not just writing
.tf files—built Terraform providers in Go for Union and custom infrastructure. Implemented code generation of Terraform providers as part of Google OSS team (created and led project MagicModules)
- Configuration Management: Puppet (led GCP integration, presented at PuppetConf), Chef (ChefConf speaker), Ansible
- Cloud Automation: CloudFormation, AWS CDK, GCP Deployment Manager
Data & Storage Technologies
Open Source Contributions
Commercial OSS Strategy
At Sourcegraph and Union, where both companies compete with their own free OSS offerings, I work with Product and GTM teams to balance OSS community value with enterprise monetization strategies.
Major Open Source Projects
Google Cloud Platform: Led GCP integration for Terraform, Puppet, Chef, and Ansible
- Published to Puppet Forge and Chef Supermarket
- Presented at PuppetConf (2015, 2016, 2017) and ChefConf (2016)
- Enabled 100% GCP service coverage through popular DevOps tools
Kubernetes: Contributed to early Kubernetes development at Google (worked with Joe Beda)
Security: Fixed critical TPM vulnerability in openCryptoki affecting all Linux distributions
ezDFS: Created open-source distributed file system (2018-2023)
- Alternative to GlusterFS/Ceph with integrated Kerberos/LDAP encryption
- NFSv4 serving for security-conscious deployments
Innovation & Patents
I have 15 patents filed, many filed worldwide. From those:
- 6 are networking and cloud related:
US 8161475 B2, US 8635331 B2, US 20110161391, US 8806480 B2, US 9223596 B1, and WO 2017217988 A1
- 2 are cloud related:
US 9223596 B1 and WO 2017217988 A1.
Full patent list, and links to the USPTO attestations and grants, available in the detailed resume (patent & publications.)
Hands-On System Architecture
Massive-Scale Distributed Systems
Google - Infrastructure Virtualization (“Zerg”) (2014-2018)
Role: Architect & Technical Lead
- Designed and implemented from scratch: 100M+ node orchestration system
- Architecture: Multi-datacenter coordination across 10+ locations
- Scale: 12,000+ cores, 1B+ test executions in 12 months
- SLA: 99.999% reliability with 24x7x365 operations
- Technologies: C++, Java, distributed systems, custom schedulers
- Impact: Became foundational infrastructure for Firebase Test Lab and Google internal DevInfra
For Googlers: go/zerg
Indeed - Cloud Migration & Platform Modernization (2020-2023)
Role: Senior Director, hands-on architect
- Led technical design of Indeed’s first major AWS cloud migration
- Architected modern web stack (zero downtime migration):
- React + Webpack federated modules
- Go microservices backend
- Brotli compression, CDN optimization
- Lighthouse score: 90+ (3G network responsive)
- Scale: 300M+ unique daily visitors, multi-billion dollar revenue platform
- Performance: Order of magnitude improvement in reliability, observability
- Built: Push-on-green deployment system, dramatically reducing release cycles
Union - Next-Gen AI Orchestration (2024-Present)
Role: Head of Engineering, architect & code reviewer
- Architecting Union 2.0 low-latency workflow engine
- Technical design: Multi-cluster, multi-cloud orchestration
- Performance: Workflow starts reduced from minutes to sub-second
- Storage: ScyllaDB for durability, in-memory sharded queuing
- Impact: Enables 100x more workflows at same cost through GPU optimization
Low-Level Systems Programming
Microsoft - Security & Virtualization (2002-2010)
- Built from scratch: Virtual Server Deployment Manager (VSDM), foundation for System Center VMM
- Architected: Microsoft Baseline Security Analyzer 2.0 (MBSA)
- Technologies: C#, Managed C++, .NET, Windows internals
- Patents: Filed 8+ patents in virtualization and cloud management
Modulo - National Election Security (1997-2001)
- Architected: Security system for Brazil’s Presidential Elections
- Developed: Kernel device drivers for network encryption
- Windows DDK (NDIS network drivers)
- Ring 0-3 synchronization, system call interception
- Transparent encryption for military/financial sectors
- Implemented: Elliptic curve and El Gamal cryptography for military
- Designed: ICP-Brasil PKI, national financial transaction infrastructure
Lune Networks & Consulting (1993-2002)
- Built: Network-level VxD device drivers for Internet kiosk security
- Implemented: BSD-based firewall appliance for ISP (InfoLink)
- Developed: X.509 Certificate Authority, secure version control systems
- Hardware: HSM integration (Aladdin, Gemplus), smartcard development
Cloud Migration & Multi-Cloud Architecture
Hands-on experience leading datacenter-to-cloud migrations and building multi-cloud production systems:
AWS (Grab, Indeed, Sourcegraph, Union):
- Indeed: Pioneered company’s first major cloud migration
- Grab: Unified data platform serving millions of QPS
- Cost optimization: Delivered $millions in annual savings
Google Cloud Platform (Google, Sourcegraph, Union):
- Built GCP support for Spinnaker (Netflix partnership)
- Multi-cloud connectivity between GCP and AWS
Microsoft Azure (Grab, Union): Multi-cloud data governance, PrivateLink
Oracle OCI (Union): Kubernetes deployments, enterprise integrations
Neo clouds (Union): GPU providers, custom cloud integrations
Kubernetes Expertise
Early Kubernetes Development
Google (2014-2016): Contributed to initial Kubernetes development working with Joe Beda (K8s co-creator) on the GCE team.
Production Kubernetes Deployments
Grab (2018-2020) - VM-to-Kubernetes Migration
- Led company-wide transition from VMs to Kubernetes
- Deployed: EKS, OpenShift, Heptio across production infrastructure
- Pushed EKS limits: Regular collaboration with Amazon EKS team at Seattle HQ
- Troubleshot issues side-by-side with Amazon Engineers
- Early access to pre-release features for ride-hailing scale
- Hired: Joe Beda’s company (Heptio) as consultant for migration
Indeed (2020-2023) - Cloud Migration
- Architected datacenter-to-cloud migration with Kubernetes foundation
- Transitioned from bare metal VMs to containerized microservices
- Scale: Platform serving 300M+ daily users
Sourcegraph (2023-2024) - Developer Experience
- Designed “self-serve” Kubernetes installation system
- Built package-manager-like deployment for Sourcegraph product line
- One-click customer deployments on their Kubernetes clusters
Union (2024-Present) - Multi-Cloud K8s
- Implementing Terraform providers (in Go) for Union Kubernetes management
- Working with Amazon on CDK integration
- Managing K8s across GCP (GKE), AWS (EKS), Azure (AKS), Oracle (OCI)
- Leading Operational Excellence for Kubernetes-based product delivery
Modern Web Development
Frontend Technologies & Architecture
Production systems I built:
- React + TypeScript: Enterprise applications at Indeed, Sourcegraph, Union
- Build Tools: Webpack (federated modules), Vite, Rollup, Bazel
- UI Frameworks: MUI 5, Tailwind CSS
- State Management: Redux, Context API, custom solutions
Full-Stack Integration
- Backend Integration: Seamless API design with Go, Node.js, Java backends
- GraphQL: Schema design and optimization
- REST APIs: High-performance endpoint design
- Real-time: WebSocket integration for live updates
Mobile Development
Native Mobile Applications
Lune Networks - Sports Training Apps (2010-2014)
- Built: Native iOS (iPhone, iPad, iPod) and Android applications
- Technologies: Objective-C, Java/Android SDK, Jetpack Compose
- Video Processing: Optimized training footage for device-specific playback
- Backend: Server-side coordination, DRM, payment processing
- Distribution: Shipped to App Store and Google Play
Current Projects
- IoT Development: C++ (Arduino, PlatformIO), ESP32 embedded systems
- Android: Jetpack Compose for personal projects
Research & Innovation
Microsoft Research (2007-2010)
eXtreme Computing Group - Foundational work for Azure
- Co-developed technologies that became Microsoft Azure and SQL Azure
- Architected: Trident Scientific Workflow system (with University of Washington)
- Workflow versioning and reproducible experiments
- Published in IEEE, ResearchGate, derivative Ph.D. theses
- Contributed: DryadLINQ distributed computing framework
Academic Contributions
- Award: Software of the Year (Brazil Education Ministry) for health systems
- Publications: IEEE, Microsoft Research, technical conferences
- Patents: 15 issued patents in virtualization, cloud, distributed systems
Security & Compliance
20+ years hands-on security experience, CISSP certified (formerly held).
Recent Security Architecture
- Union: SOC2 compliance, cross-cloud security perimeter (PrivateLink, PSC, VPN)
- Sourcegraph: SOC2 infrastructure certification, SSO integration
- Indeed: CIS20 certification, built “Compliance Dog” system that replaced LogicGate
- Grab: ISO 27001, PCI compliance, Security Council member
Historical Security Engineering
- ChromeOS: TPM full-disk encryption, verified boot
- GCE: Network packet filtering for export control compliance
- ICP-Brasil: Designed national PKI for financial transactions
- Presidential Elections: Security architecture for Brazil’s voting system
For comprehensive security experience, see: go.lunenetworks.com/resume/nelson/security
Additional Technical Experience
Networking Infrastructure
- Physical Networking: Designed and installed fiber, RJ45, T1 lines for ISP and university
- NOC Operations: Led Network Operating Centers at UFRJ, InfoLink, CETEM
- Routing: BGP, RIP for autonomous system networking
- SDN: Software-defined networking for latency-sensitive workloads
Development Practices
- Testing: Unit, integration, e2e testing frameworks
- Accessibility: WCAG compliance, a11y tooling
- Documentation: Technical writing, API documentation, architecture decision records
- Code Review: Established review practices across multiple organizations
- Mentorship: Technical leadership through hands-on collaboration
Complete Resume
This technical hands-on resume highlights architecture, design, and implementation work. For the complete career history including leadership and business impact:
