Robin Chan

01 Experience

Same company, three roles, one continuous trajectory: cybersecurity training into QA into infrastructure ownership.

1. DevOps Engineer

   2023–Present

   Keel Digital · HIPAA-regulated telehealth SaaS

   • Led a 14-server migration from DigitalOcean droplets to OVHcloud bare-metal (Proxmox VE): vendor analysis, Debian for a minimal patch surface, full disk images transferred over SSH so state carried over instead of a rebuild, Ansible to remediate networking post-migration. Designed a NAT gateway topology that removed public interfaces from every dev VM (dev machines need outbound access, not inbound reachability), cutting attack surface and saving ~$18,000 CAD annually.
   • Built an OpenSearch SIEM from the ground up: Fluentbit log ingestion with PII/PHI filtering applied before indexing, so scrubbed data can't leak back out through a dashboard or export; Lambda-based automated alerting; and custom Sigma rules targeting authentication and authorization threats, the stage where a compromise is still stoppable.
   • Maintain Terraform IaC across multiple AWS accounts and 26 modules (ECS, S3, IAM, KMS, RDS, VPC, SageMaker), modules over copy-pasted resources so a fix lands once and every account inherits it; built a new AWS Comprehend module from scratch with S3, KMS and IAM wired in as defaults rather than left to each caller.
   • Extended GitHub Actions CI/CD across multiple repos: Trivy scanning as a build gate that fails the image before it reaches a registry rather than flagging it after deploy, parallel multi-service builds, multi-brand matrix builds producing per-brand images from one maintained pipeline instead of a fork per brand; deploys to ECS via automated task definition updates and to dev via SSH through a bastion host, so no dev host keeps a public interface of its own.
   • Administer a self-hosted OAuth/SSO platform serving thousands of users across US/CA production: client and scope management, auth flows, delegated admin groups, and Zabbix alerting on auth failures, since every downstream service degrades the moment SSO does. Manage least-privilege IAM across 16 environments, so a leaked credential stays a one-environment incident instead of sixteen.
   • Rapid Response Team: 10+ production incidents; traced one degradation to database connection-pool exhaustion via Elastic log analysis before touching anything (a restart would have cleared the symptom and guaranteed a repeat), then coordinated remediation.
   • Deployment Team: release cycles for 40+ containerized services across US and Canadian production, biweekly so each release stays small enough to reason about, with out-of-band releases for vulnerability fixes that can't wait for the next window.
   • Contributed to the FedRAMP Moderate authorization effort: implemented controls spanning S3 encryption at rest, audit logging, network segmentation, access control and CI/CD hardening, each landed as enforced configuration rather than written policy, so the control holds whether or not anyone remembers it.
2. QA Analyst

   Co-op 2020–2022 · Full-time 2022–2023

   Keel Digital

   • Discovered and reported a critical vulnerability in the registration API before it reached production, through security-focused testing of what the endpoint would accept, not just what it was supposed to do.
   • Developed JMeter test suites for API rate limiting, RBAC enforcement and authorization boundary testing, the failure modes that pass every functional test and only surface later as incidents.
   • Added a Nessus container to the application's Docker Compose stack so scans ran from inside the network an attacker with a foothold would actually see, not an approximation from outside; monthly internal-network vulnerability scans reported to security, compliance and operations.
   • Solely responsible for artifact builds and production deployments for client onboarding and demos, multiple releases per week at peak, sustainable only by keeping builds repeatable rather than hand-assembled each time.

03 Skills