JSjavsanpae

Open to a good conversation

Javier
Sánchez Páez

Security Engineer / Supply chain / CI/CD & cloud

I work on the security of how software is built and shipped: supply chain, pipeline permissions and cloud, on workloads distributed all around the globe, each with its own regulatory requirements.

Download my CV Get in touch LinkedIn GitHub

Málaga, Spain · Working remotely with teams in the US and Europe

  • ~100kmonthly users across the workloads I manage
  • −70%vulnerabilities per project, most of them supply-chain ones
  • 100%of projects onboarded with active SAST, DAST and SCA controls
  • <5 minlongest outage since a planned 3 h migration, after fixing our pipelines

About

Security where software is built and shipped

Portrait of Javier Sánchez Páez
Málaga, Spain

I'm Javier, a security engineer at Waters. I handle microservices, infrastructure deployments, security analysis (SAST, SCA and DAST), internet-facing assets (WAFs and ALBs) and any process that needs a technical cybersecurity point of view, for about 50 repositories and 10 production services.

My work sits where security meets delivery:

  • Supply chain: what enters our builds, and who can publish it.
  • Pipelines: what a CI job is allowed to do, and where it is allowed to run.
  • Regulated, multi-region delivery: the same platform worldwide, each region with its own regulatory requirements.

I like simple solutions that fit the real needs of the product and the team, and I also care about solutions that stay maintainable in the long term and can grow later without a rework to expand them. I try to keep technical debt low. I use AI mostly for code review and automation. I also enjoy talking about where IT is going and sharing experiences, and I had the chance to mentor a trainee on my team.

Experience

Where I have worked

  1. – PresentRemote

    Security Engineer

    Waters Biosciences

    A worldwide diagnostics and life sciences company. I handle microservices, infrastructure deployments, security analysis, internet-facing assets and anything that needs a technical cybersecurity view: about 50 repositories and 10 production services deployed worldwide.

    • Supply chain: a self-hosted Artifactory with a 7-day quarantine for new packages.
    • CI/CD: least-privilege pipelines, with production only deployable from the main branch.
    • Edge security: managing WAFs, ALBs and internet-facing assets.
    • Delivery: one platform across regions, within each one's regulatory requirements and network limits.
    • AppSec: SAST, SCA and DAST controls over about 400 assets (repositories, container images, clusters and code components), cutting vulnerabilities per project by 70% on average. I also write hardening guides and reusable scripts, and use AI for code review and automation.
    More detail in selected work →
  2. – Málaga, Spain

    DevSecOps Engineer

    Santander Corporate & Investment Banking

    Cloud-native workloads in the bank's internal tech division: 4 regions and about 20 repositories.

    • Improved resiliency, security and performance of production Kubernetes/OpenShift clusters.
    • Built observability with Grafana, Prometheus and the ELK Stack.
    • Ran chaos and load experiments: flooding APIs with requests to tune the infrastructure and see how applications reacted.
    • Integrated automated security scanning into CI/CD with ArgoCD and GitHub Actions.
    • Followed the AWS Well-Architected Framework on AWS and Azure.
  3. – Málaga, Spain

    Site Reliability Engineer

    Derivco

    An iGaming platform used as the backend by betting operators, serving hundreds of thousands of players. The SRE team supported users at product level (promotions, prizes) and at technical level.

    • Migrated critical large-scale databases and servers to the cloud, reducing recovery time and reaching three-nines availability.
    • Ran database migrations, deployments and CI/CD, with Blue/Green and Canary releases.
    • Automated report generation, database backups and infrastructure provisioning.
    • Added health checks and observability (Grafana, Prometheus) to improve SLA/SLO performance.
    • On-call rotations, with a focus on keeping production stable and preventing incidents.
  4. – Granada, Spain

    DevOps Engineer Internship

    Kyndryl

    NetDevOps work on infrastructure, automation and monitoring.

    • Deployed on-premise (RKE2, kubeadm) and cloud (AKS, IBM Cloud) Kubernetes clusters.
    • Managed Helm charts and Kustomize templates; used Ansible, Terraform and GitHub Actions; applied GitOps.
    • Found inefficient processes and cut deployment time by 40%.
    • Automated networking tasks and workflows with Bash and Python, and monitored assets with Grafana and Prometheus.
  5. – Antequera, Spain

    System Administrator Internship

    Junta de Andalucía

Selected work

Some things I have worked on

Waters · Supply chain

Safer dependencies

Most of the vulnerabilities we found came from dependencies. I pushed for a self-hosted Artifactory instead of direct npm access: a 7-day quarantine for new packages, two-factor authentication and npm blocked at the source.

Waters · Zero trust

Least privilege for CI/CD

CI roles were broader than any job needs. Pipelines now get only what they need, policy changes go through a dedicated management account, production deploys only from the main branch, and EKS authentication moved from ConfigMaps to the EKS API.

Waters · Regulated delivery

Deploying to clusters in China

There is no direct connection to the upstream registries, and deployment cycles follow local regulation. Assets go through OpenVPN, and a Terraform step in CircleCI copies the upstream images into the regional ECR.

Waters · Terraform

Infrastructure code a team can share

Stateless plans let several people work in the same account without overwriting each other. Lock files moved from DynamoDB to S3, and plans are blocked while an apply runs, so nobody reads changes that are not real.

Waters · Reliability

Making migrations uneventful

A Knative and Kubernetes migration needed a planned 3-hour outage: Knative was 8 releases behind and many pipelines were broken. We fixed them and added safeguards against downtime, and no outage has lasted more than 5 minutes since.

Personal · Platform

A homelab to practise

A single-node Kubernetes cluster at home with GitOps, encrypted storage, backups and a hardened public entry point, all defined as code.

See how it works →

Skills

Tools I reach for

Security

  • Artifactory
  • WAF
  • Snyk
  • SonarQube
  • IriusRisk
  • Sysdig
  • Kyverno
  • DAST
  • Cybeats
  • Fortify
  • Falco
  • Trivy

Platform & cloud

  • Kubernetes
  • AWS
  • GCP
  • GitHub Actions
  • OpenShift
  • Azure
  • Terraform
  • ArgoCD
  • CircleCI
  • ALB
  • EKS
  • Knative
  • OpenVPN
  • Helm
  • Ansible

Observability & code

  • Python
  • Datadog
  • Grafana
  • Prometheus
  • ELK Stack
  • Bash

Concepts

  • SBOM
  • CI/CD
  • Observability
  • Hardening
  • Secret management
  • Threat modeling
  • OWASP
  • GRC
  • FinOps
  • Chaos Engineering
  • SSDLC
  • GitOps

Highlighted tools are the ones I use most.

Certifications & education

Certifications and what is next

Certified

CKA

Certified Kubernetes Administrator. Installation, networking, scheduling, security, storage and troubleshooting.

The Linux Foundation · May 2025
Certified

Enterprise Chaos Engineering

Designing and running chaos experiments to build more resilient systems.

Jul 2025
Languages

Spanish & English

Spanish native. English at C2 (proficient) level in reading and listening, certified by EFSET, with bilingual education in English.

EF SET

Roadmap

  • AWS Security Specialty
  • Terraform Associate
  • CKS
  • AWS DevOps Engineer Professional

Networked Computer Systems Administration

Associate degree · Granada, Spain · Jun 2023 · GPA 8.5/10 · bilingual education in English. Final project: automated networking with IaC and GitOps (open source).

View the project →

Cisco CCNA 1 & 2

Cisco Networking Academy · networking fundamentals, switching and routing

Sharing

Sharing what I learn

Talk & workshop · May 2023

Introduction to Kubernetes at GDSC Granada

A talk and hands-on workshop for Google Developer Student Clubs Granada. Slides, Dockerfile and Kubernetes manifests are public so attendees could follow along and try it themselves. I would like to give more of these, so if you run a meetup, a class or a team session, get in touch.

Slides and examples →
Article · Medium · Mar 2025

Proxmox VE without a wired connection

A step-by-step guide to installing and running Proxmox on a mini PC that only has Wi-Fi, by borrowing a laptop's connection during setup. Messy, fun, and I learned a lot.

Read the article →
Mentoring

Talking and learning from others

I mentored a trainee on my team at Waters, and I enjoy talking about the state of IT and swapping experiences with colleagues and friends.

Side project

This page runs on my own cluster

A single-node Kubernetes homelab where I practise what I do at work: everything is code in one git repository and changes go through git. It hosts my photos, files, home automation and this site.

  1. Visitorasks for about.javsanpae.com
  2. Cloud VPShardened, HAProxy passes TLS through
  3. WireGuard tunnelmy home dials out, no open ports at home
  4. Public gatewayEnvoy Gateway, Gateway API routes
  5. This pagea small nginx pod

Platform as code

  • k0s on Debian, prepared with Ansible
  • One Helm chart per component, versions pinned
  • Argo CD applies it from git, in sync waves
  • Secrets live in git only as Sealed Secrets
  • Wildcard TLS from cert-manager (DNS-01)

Storage and backups

  • OpenEBS ZFS volumes on two encrypted pools
  • Daily Kopia backups, one cloud repository per pool
  • A second copy on a local disk, never blocking the cloud one
  • CloudNativePG for Postgres, one role and database per app

Network & operations

  • Private by default: WireGuard VPN for admin tools
  • Only chosen apps are public, and never admin interfaces
  • MetalLB and AdGuard Home for local DNS and ad blocking
  • Prometheus and Grafana, with alerts via Telegram
  • Documented runbooks for backup, restore and recovery

Runs

  • Immich
  • Nextcloud
  • Home Assistant
  • AdGuard Home
  • Minecraft (Crafty)
  • Sure
  • BentoPDF
  • Grafana

Outside work

What keeps me going

  • MusicBass and guitar for 10 years. From rock and alternative to hip-hop.
  • Video gamesAction games with deep stories, since the PlayStation 2.
  • CarsDriving, motorsport and car meets.
  • GymTech means a lot of sitting, so I try to train regularly.
  • HikingOutdoors to reconnect with nature.
  • TravellingNew places and new people.

Contact

Want to know more, or just say hi?

Send me an email or a message on LinkedIn, or invite me to give a talk. I'd be happy to hear from you.

javsanpae@gmail.com LinkedIn GitHub