Chris Wage

Self-directed infrastructure and security work, shipping open-source tooling via heavily LLM-assisted development – directing architecture, reviewing output, and debugging the results.

• Built agentpen, a Linux confinement wrapper for LLM coding agents (bubblewrap, network namespaces, nftables, seccomp) – run an agent against an untrusted repo without exposing credentials or the wider system.
• Built and shipped WhoAreWe, an Android app for pairwise TOTP identity verification between family members – a countermeasure for voice-cloning scams.
• Run a NixOS-based homelab as a production environment: declarative infrastructure-as-code, self-hosted services, monitoring, and backups/DR, including a self-hosted git forge with GitHub as mirror.
• Daily practitioner of agentic development workflows (Claude Code et al.), with an emphasis on sandboxing, review discipline, and secure adoption.

Handled identity and access management for GitHub’s workforce, coordinating closely with HR, Legal, IT, and incident response teams.

• Managed the company-wide entitlements platform and maintained security across countless internal and external services.
• Pushed for disaster recovery on identity (LDAP) infrastructure that had been neglected for years, built an interim backup, and got management buy-in. The formalized DR plan was eventually built after I left, based on this groundwork.
• Built custom ruby tooling (a JIT LDAP provisioner for temporary access, chatops integrations, etc) to make day-to-day security operations less painful.
• Built tarball-based deployment paths for critical tooling, eliminating a circular dependency on GitHub’s own availability during outages.
• Migrated ~8 years of accumulated security operations code and docs during a major reorg, mostly without anyone noticing.
• Moved 100+ repositories from legacy Jenkins to GitHub Actions.
• Coordinated employee offboarding with HR and Legal, and was on the critical path for incident response – emergency access revocation, secrets rotation, urgent action.

Led SRE/devops and a small Data Services team for a non-profit CRM SaaS platform on GCP, during an acquisition-period stretch with limited investment in production engineering.

• Executed a long-deferred major Postgres version upgrade on production.
• Stood up on-call rotation and public status page where neither existed.
• Automated the Data Services team’s manual import and sanitization work, eliminating recurring error-prone manual work.

Modernized infrastructure and cleaned up security for an Alibaba-backed e-commerce platform with a small team spread across the US and Romania.

• Migrated the production stack from leased bare metal to Alibaba Cloud, introducing terraform and modernizing configuration management throughout, despite limitations of both terraform and alibabacloud. Shut down the on-premises datacenter afterward, materially reducing infrastructure spend.
• Fixed critical security gaps left by previous operations: unsegmented network tunnels between offices and production, unauthenticated database access, passwordless root credentials scattered around the environment.
• Replaced a flaky hardware SSL VPN with OpenVPN, bringing VPN management into infrastructure-as-code and letting the distributed team self-serve access.
• Built properly segmented VPCs for production, development, and intranet – network isolation that simply hadn’t existed before.
• Pivoted from what i was originally hired to do (security-focused mandate) to the infrastructure overhaul the company actually needed (helping fix, modernize and secure things from basically all angles)

Eleven years as COO of CentreSource, a web and application development agency (30-50 employees, ~$3-5M revenue) – P&L, financial reporting, contracts, forecasting, and a small operations team. Built the agency’s web development practice through PHP/Rails/early-mobile shifts, and built and profitably ran a managed anti-spam/email-filtering product on the side.

Before that, sole systems engineer at Education Networks of America, a state-wide K-12 network (250,000+ computers, one million users): migrated 60,000+ email accounts off a DEC Alpha OpenVMS system to a Linux stack solo, designed redundant anycast DNS for nearly 500 domains with automated validation so network engineers could self-serve changes, and automated router configuration management – version control for infrastructure before that was a term of art.