[email protected]

Open to senior systems & security roles

Matt Ji

Systems & Security Engineer

Go · NixOS fleets · vulnerability data · energy infrastructure

I build infrastructure that can be rebuilt from a single commit: Go services with append-only state, NixOS fleets with their own certificate authority, and data pipelines that turn operational noise into a decision. Most of that work has been in energy — telemetry, valuation and risk across renewable portfolios worth more than $100M. The rest is vulnerability data, where CISA's KEV catalogue is the raw material.

Gutach im Breisgau, Germany · remote (CET, US-East overlap)

00 Focus

Reproducible fleets

NixOS and flakes across servers, workstations and a cloud endpoint. One commit describes the machine; a switch is the deployment.

Go services with bounded work

Server-rendered binaries and append-only event logs. No frontend build, no framework, small enough to audit in an afternoon.

Vulnerability data that ends in action

KEV as a time series and as work clusters: what is exploited now, and which patch order removes the most risk per hour spent.

01 Selected work

  1. 2023 — now
    Multi-host NixOS fleet Author and operator

    One flake for a fleet of NixOS hosts: NAS, workstations, a cloud endpoint and a remote builder, an SSH certificate authority with rotation, encrypted secrets, and a taskfile as the only interface. Every host is commissioned by registering one line.

  2. 2024 — now
    bountystash: deterministic work engine Creator

    A single Go binary that turns a request into an immutable, content-addressed specification: append-only events, keyboard-first terminal UI, curl-friendly endpoints, zero frontend dependencies.

  3. 2026
    fibtransponder Research and implementation

    A Fibonacci-radix streaming state machine for tokenization experiments: bounded per-step work over a bitstream, adjacency width as a locality selector, Zobrist seed tables, and a corpus benchmark that falsified the seed-only detector.

  4. 2016 — 2020
    Energy telemetry and valuation Lead operations, O3 Energy

    Quantitative steering of a solar portfolio above $100M: yield and valuation models that survived bank audits, mobile field data capture, and counterparty risk that institutional lenders accepted.

02 The KEV lab

Two public tools make CISA's Known Exploited Vulnerabilities catalogue legible. kev-time plots exploitation over time, so a trend is visible before a report exists. kelly-svg groups entries into clusters a team can work through, so the patch plan follows from data instead of instinct. Both are static SVG and plain HTML, built to be read on a phone during an incident.

kev-time · kelly-svg

03 Stack

Systems and concurrency7
  • Go
  • channels and state machines
  • PostgreSQL
  • Redis
  • gRPC and REST
  • Kafka
  • Python
Declarative infrastructure7
  • NixOS
  • Nix flakes
  • SSH certificate authority
  • SOPS and age
  • Tailscale
  • ZFS and btrfs
  • systemd
Domain6
  • asset valuation
  • solar telemetry reconciliation
  • risk models
  • bank audit reporting
  • KEV and CVSS
  • Typst

04 Work with me

I am looking for a senior or lead role where infrastructure and security meet: platform engineering, site reliability, or vulnerability operations. Remote with a CET base, or Freiburg and the Upper Rhine on site.

  • US citizen with German permanent residence — no sponsorship, no relocation needed
  • English native, German C1
  • Go, Python, PostgreSQL, NixOS — comfortable owning a service end to end
  • Available on short notice
[email protected]