Skip to content
Blue Helix Lab
Book a Call
us-remote · accepting new engagements

Senior DevOps
for startups that
can't hire one yet.

Fixed-scope infrastructure work, SOC 2 engineering, and a monthly platform retainer for seed to Series B teams. The engineer on the call is the engineer in your infrastructure.

Book a discovery callSend your AWS bill for a free teardown

Not ready for a call? Email last month's AWS invoice. Within two business days you get one page back: your three biggest overspends and the fix. No call, no pitch.

  • years prod infra
    17
    rackspace → financial data platform → studio
  • incidents handled
    400+
    on-call across 4 prod surfaces
  • soc 2 audits passed
    2
    type ii controls, end-to-end
02 - services

DevOps first. The rest follows.

routes/services.tf
  • lane_01 · primary

    DevOps & Cloud Infrastructure

    AWS and Kubernetes platforms, built from zero or rescued from a console mess. Seventeen years of it, from bare metal and OpenStack to EKS. This is the work behind Ops Baseline, Cloud Hardening, and the Platform Retainer.

    • IaC from zero: Terraform, Terragrunt, CloudFormation with Rain
    • SOC 2 engineering: IAM policy design, audit logging, vulnerability scanning, secrets
    • Kubernetes on EKS: Helm, Docker, upgrades, capacity
    • Observability from scratch: Grafana, Prometheus, Loki, OpenTelemetry, on-call design
    • CI/CD: GitHub Actions, Jenkins, CodeDeploy, blue-green deploys
    • AWS cost: reserved instances, rightsizing, scheduling, spend-anomaly detection
    • IaC guardrails: CI gates on destructive plans, blast-radius summaries, OPA policy-as-code
    • Multi-region HA: automated failover, zero-downtime upgrades
    • Cloudflare at the edge: Workers, DNS, security policies
    • Brownfield rescue: console-built AWS, Ansible, Puppet, Chef, OpenStack
  • also

    AI Enablement & Internal Tooling

    The agentic-coding rollout your engineers keep asking about, done with guardrails and measured. Plus the site or internal tool that runs on the infrastructure. Same engineer, same fixed scope.

    • Agentic coding rollout: guardrails, prompt and skill libraries, adoption measurement
    • AI-generated IaC review gates and Terragrunt module allowlists
    • Local model serving for sensitive data, LLM usage and cost tracking, MCP integrations
    • Next.js on Cloudflare Workers; CLIs and automation in Go, Python, TypeScript
03 - selected work

What got shipped.

Anonymized. Numbers are real.

  • cloud · costfinancial data platform · aws

    Cut AWS spend 20–30% - without touching application code.

    Financial data platform, 20+ services on AWS. Reserved instances, rightsizing, scheduling, and spend-anomaly detection, with the savings reallocated to product infrastructure instead of the bill. About $96K a year, every year since.

    SAVINGS / YR
    ~$96K
    BILL REDUCTION
    20–30%
    CODE CHANGES
    0
    aws spend · indexed↓ 25%
    before · 100after · 75
  • reliabilityFinancial data platform · 4 environments

    Multi-region HA with automated failover and zero-downtime upgrades

    Designed and operated the multi-region topology behind 18+ services: health-check-driven failover, and blue-green swaps so upgrades ship without downtime.

    UPTIME
    99.95%
    SERVICES
    18+
  • complianceFintech SMB · 2023→24

    SOC 2 Type II controls - full evidence trail

    IAM lockdown, vulnerability scanning, audit logging, continuous monitoring. Auditor walked away clean on first review cycle.

    AUDIT
    PASS
    FINDINGS
    0
  • platformWhite-label platform · IaC

    Client onboarding automated with Terraform, Terragrunt, and Ansible

    Every new white-label client used to be a two-to-three-week hand build. Codified the environment end to end; provisioning now takes days, repeatably.

    BEFORE
    2–3 wks
    AFTER
    3–5 days
  • observabilityFinancial data platform · 20+ services

    Observability from zero: Grafana, Prometheus, Loki, OpenTelemetry, Opsgenie

    Built the stack from scratch across 20+ services and ran the on-call rotation. Time to recovery fell from 45 minutes to under ten.

    MTTR
    45 → <10 min
    ALERT NOISE
    ↓60%
04 - engagement models

Productized scopes. No hourly surprises.

  • 7 days

    Ops Baseline

    • CI/CD pipeline
    • IaC seed
    • Monitoring stack
    • Runbooks
    fixed
  • 2–4 wks

    Cloud Hardening

    • Security audit
    • IAM lockdown
    • SOC 2 evidence
    • Audit report
    fixed
  • 2–4 wks

    Site Build

    • Next.js + edge
    • Stripe billing
    • Auth + DB
    • Deploy pipeline
    fixed
  • Ongoing

    Platform Retainer

    • Embedded DevOps
    • On-call escalation
    • Monthly review
    • Capacity planning
    monthly
  • Scoped on call

    Custom Project

    • Discovery sprint
    • Written proposal
    • Fixed deliverables
    • Handoff docs
    quote
05 - stack

The toolchain in production rotation

  • AWS
  • Cloudflare
  • OpenStack
  • Kubernetes
  • EKS
  • k3s
  • Helm
  • Docker
  • Terraform
  • Terragrunt
  • CloudFormation
  • Rain
  • Ansible
  • Puppet
  • Chef
  • OPA
  • GitHub Actions
  • Jenkins
  • CodeDeploy
  • Grafana
  • Prometheus
  • Loki
  • OpenTelemetry
  • Opsgenie
  • Aurora MySQL
  • QuestDB
  • Claude Code
  • Ollama
  • MCP
  • Next.js
  • Supabase
  • Drizzle
  • Stripe
  • Tailwind
  • shadcn/ui
  • Go
  • Python
  • TypeScript
  • Bash
06 - about

Small by design. Senior by default.

whoami.txt

Blue Helix Lab is one senior engineer, on purpose. I've spent 17 years running production infrastructure, from the Rackspace datacenter floor to leading DevOps at a financial data platform, and carried the pager through 400+ incidents along the way.

I started the studio to give funded startups the platform capability they can't hire yet. The model is simple: the person who scopes your work is the person who builds it, ships it, and answers when it breaks. No account managers, no juniors learning on your production, no hourly meter running while someone gets up to speed.

One person is also the obvious risk, so the model is built to make itself replaceable. Everything lands in your repos and your accounts, runbooks get written as we go, and if you hire a full-timer later, we onboard them and hand off clean. No knowledge hostage.

If a week of work fixes it, a week is what we'll quote.

The Engineer
blue helix lab llc
operator
founder · engagement lead
base
Central Texas · us-remote
prod_infra
17 years
path
rackspace → financial data platform → studio
incidents
400+ handled on-call
audits
2× SOC 2 Type II
contact@bluehelixlab.com
$ bhl tell-me-whats-broken

Tell us what's broken.
We'll tell you what we'd do about it.

Two ways in. A 30-minute call: no pitch, no slides, a diagnostic on the house. Or skip the call: send last month's AWS invoice and get one page back with your three biggest overspends and the fix.

Book a 30-min discovery callSend your AWS bill

or email contact@bluehelixlab.com