Joseph Olutimehin Toronto, ON

Cloud platform & security engineer · Toronto, ON

Cloud infrastructure. Built with a security mindset.

I'm Joseph. I build on Google Cloud with Terraform, Kubernetes, and Cloud Build, bringing experience in security engineering at Coinbase to the systems I design and operate.

Explore my work Get in touch

Google Cloud certification

Verify credential
Credential

Associate Cloud Engineer

Issuer
Google Cloud
Status
Verified
Issued
Valid through
Certification ID
0e97354c793b4d6ea3186b77d3674f48

01 / Selected work

Infrastructure in practice.

Systems I've built, the decisions behind them, and the code that makes them work.

GKE · GitOps · Terraform

Staging lab

GKE Application Platform

A private GKE platform that brings GitOps delivery, supply-chain checks, and workload security together. Infrastructure provisioned with Terraform.

  • GitOps delivery with Argo CD, Helm, and rollback by Git revert.
  • Cloud Build pipelines with image scanning, SBOMs, and provenance.
  • Prometheus alerting, with load and disruption testing.

Security controls

  • Workload Identity
  • Secret Manager
  • Default-deny network policies
  • Kyverno admission
  • Pod Security
  • Namespace RBAC
Write-up ↗ Source ↗ Test evidence ↗

Networking · IAM · Terraform

Bank Shared VPC & PSC

A banking-style, four-project Google Cloud network that brings centralized governance and private service access together. Provisioned entirely with Terraform.

  • Shared VPC with subnet-level IAM delegation.
  • Identity-based firewall rules and an internal load balancer.
  • Private Service Connect access from a partner VPC.
  • VPC Flow Logs aggregated into BigQuery.
Read the write-up ↗ Source ↗

GKE Application Platform · measured

From the platform's evidence reports

1 min 37 s

Configuration merge to healthy service

Target: within 10 minutes

GitOps evidence ↗

1 min 57 s

Git revert merge to healthy recovery

Target: within 10 minutes

GitOps evidence ↗

99.78%

Successful requests under steady load

20 req/s for 10 min · p95 56 ms

Acceptance evidence ↗

Cloud Run · Cloud Storage · Terraform

Stablecoin Whale Monitor

A Terraform-managed Google Cloud platform that indexes large USDC and USDT transfers on Ethereum mainnet into Cloud Storage, and serves them through a read-only API and a static dashboard.

  • Cloud Run Worker Pool indexer that advances a generation-guarded checkpoint only after each block range is committed.
  • Immutable NDJSON objects in private Cloud Storage, one per committed block range.
  • Approval-gated Cloud Build releases with pinned image digests and deployment smoke tests.
  • Cloud Monitoring alerts for API outages, latency, and a stalled indexer loop.

Security controls

  • Cloud Armor
  • Private buckets
  • Load-balancer-only API ingress
  • Workload-specific service accounts
  • Secret Manager
Dashboard ↗ Source ↗ Write-up ↗

System status

Paused
Resumes
Indexer
0 instances
API
Unrouted
Dashboard
Offline notice ↗

Paused until 25 Oct 2026.

02 / Experience

A foundation in security.

Download résumé (PDF)

Jun 2026 – Present

Cloud Platform Engineer

Stablecoin Whale Monitor · Self-employed

  • Designed, built, and operate a live Google Cloud platform that monitors large USDC and USDT transfers on Ethereum, evolving it from Compute Engine VMs to Cloud Run/GKE and a Terraform-managed serverless architecture.
  • Built a Cloud Run Worker Pool indexer that writes confirmed transfers as immutable objects to private Cloud Storage, a Cloud Run API that serves them from that store, Pub/Sub alerts, and a Next.js dashboard behind a global external Application Load Balancer, Cloud CDN, and Cloud Armor.
More about this role
  • Implemented approval-gated CI/CD with Cloud Build, immutable container releases, automated testing, and deployment smoke tests.
  • Applied least-privilege IAM, Secret Manager, private storage, secured ingress, and workload-specific service accounts.
  • Improved reliability through crash-safe checkpointing, idempotent processing, observability with Cloud Monitoring, and production incident troubleshooting.
Dashboard ↗ Source ↗ Write-up ↗

Feb 2025 – Jun 2026

Security Engineer

Coinbase

  • Led smart contract security reviews for the Base-Solana Bridge, the x402 payment protocol, the Base Azul network upgrade and numerous other Coinbase core projects, assessing smart contract vulnerabilities, trust boundaries, cross-chain security failures, upgradeability issues, and integration and rollout risk.
  • Built and maintained internal AI-powered smart contract auditing tooling used across the security organization to support repeatable review workflows.
More about this role
  • Conducted multiple ecosystem security reviews for protocols integrating with Base, defining remediation requirements and release gates before integration or launch.
  • Served on call for security incident response, triaging live security incidents and coordinating resolution across engineering and security teams.

Jan 2023 – Jan 2025

Independent Security Researcher

Independent · Code4rena, Cantina, Sherlock, Immunefi, Codehawks, QuillAudits

  • Completed 30+ smart contract security reviews, identifying 50 High- and Medium-severity vulnerabilities validated and accepted by protocol teams.
  • Reviewed a broad mix of DeFi and interoperability protocols including AMMs, lending markets, stablecoins, vaults, bridges and omnichain infrastructure, applying threat modeling and secure-SDLC analysis.

Oct 2023 – Apr 2024

Developer Advocate

INTMAX

  • Contributed to zero-knowledge developer documentation for a ZK rollup, covering protocol concepts, integration guides and onboarding material for external teams building on the network.
  • Drove protocol education and developer onboarding through technical presentations at Google DevFest Lagos and Africa Tech Summit in Nairobi.

Sep 2022 – Jun 2023

Software Engineer (Smart Contract)

Astraverse

  • Built a Gaming and Fashion protocol on Ethereum, writing and testing all smart contracts.
  • Designed and deployed ERC-1155 token contracts for the marketplace platform.
More about this role
  • Built Node.js and TypeScript APIs, integrating backend services with deployed contracts via Ethers.js and Wagmi, and handled integration with the frontend team.

May 2022 – Sep 2022

Software Engineer

Collect Waves

  • Built NFT and marketplace contracts with ERC-20 token integration, and the API services supporting them.
  • Delivered the full application stack around the contracts: a frontend connected to on-chain state, and Node.js and TypeScript REST APIs for off-chain data.

03 / Toolkit

Tools of the trade.

Google Cloud

  • Compute Engine
  • Cloud Run
  • GKE
  • Cloud Storage
  • Cloud SQL
  • Pub/Sub
  • Artifact Registry
  • Cloud CDN
  • Cloud Armor
  • IAM
  • VPC

IaC, CI/CD & automation

  • Terraform
  • Cloud Build
  • GitHub Actions
  • Docker
  • Kubernetes
  • Helm
  • Kustomize
  • GitOps
  • Argo CD
  • Linux
  • gcloud CLI

Languages

  • TypeScript
  • JavaScript (Node.js)
  • Python
  • Rust
  • Solidity
  • Bash

Networking

  • VPC design
  • Subnetting
  • Firewall rules
  • DNS
  • Cloud NAT
  • Load balancing
  • Gateway API
  • TLS & certificates

Security

  • IAM least privilege
  • Service accounts
  • Workload Identity
  • Kubernetes RBAC
  • Secrets management
  • Network segmentation
  • Network policies
  • Pod Security
  • Container security
  • Kyverno
  • Trivy
  • Threat modeling
  • Secure SDLC

Observability

  • Cloud Monitoring
  • Prometheus
  • PromQL
  • Cloud Logging
  • Structured logging
  • Uptime checks
  • SLO & alerting design

Web & backend

  • Express
  • NestJS
  • FastAPI
  • Next.js
  • React
  • Redis

04 / Writing

Engineering notes.

Google Cloud, infrastructure, and lessons from building and operating.

05 / About

An engineer's perspective.

Before shifting to full-time cloud work, I spent four years in blockchain security and smart contract development, most recently at Coinbase, where I audited bridges, payment protocols, and network upgrades securing billions of dollars.

That experience shapes how I approach cloud architecture: minimal IAM permissions, private-by-default networking, and observability in place before the first production incident.

I'm based in Toronto, with a background in mathematics and experience helping developers understand and build on complex protocols.

Education

B.Sc. Mathematics

Institution
Federal University of Agriculture, Abeokuta, Nigeria
Years
2018–2022

Speaking & developer education

DeFi Security SummitSpeaker, representing the Coinbase Security team.

Google DevFest Lagos & Africa Tech Summit NairobiProtocol education and developer onboarding.

2023–2024

Let's connect

Let's build something reliable.

Hiring for cloud infrastructure? I'd like to hear from you.

[email protected] LinkedIn Résumé (PDF)