Irving García Mendoza

IT Controls & Compliance | Information Security & Infrastructure Manager

Remote — Mexico · hola@irving.bio

Professional Summary

Information Security and Infrastructure leader with 15+ years across IT risk, security consulting, and cloud operations — currently Infrastructure & Information Security Manager at Clara, a pre-IPO LATAM fintech. Owns the IT control environment protecting financial operations across Mexico, Brazil, and Colombia: design and operation of IT General Controls (logical access, change management, security operations) over a 70-account, two-region AWS Organization with a ~USD $2.9M annual cloud and SaaS footprint. Combines hands-on cloud security and platform engineering with audit-evidence discipline (Sprinto, Prowler, Steampipe) and a governed AI automation practice — six deployed LLM agents on AWS Bedrock, read-only by default with explicitly authorized, policy-gated remediation. Earlier career delivering regulatory and information-security consulting to banks, insurers, and government on fintech frameworks and Latin-American data-protection law. Suited to building an IT controls function ahead of an IPO, not merely maintaining one.

Career Highlights

• Deployed AWS GuardDuty and centralized security alerting across 70 accounts in two regions; enforced EBS encryption by default across 54 accounts; drove fleet-wide CVE remediation including SSH elimination on 174 EC2 instances with continuous compliance monitoring.
• Executed a controlled Kafka 3.6 to 3.9 upgrade of seven Amazon MSK clusters in ~21 hours with no recorded incidents; raised ~1,950 topics to replication factor 3 with no partition unavailability; leads a right-sizing program with ~18% of fleet run-rate already verified in billing and ~50% modelled.
• Restored integrity of cloud financial reporting: built the FinOps analytics stack on CUR 2.0 (36 months of history) that exposed a ~35% cost under-reporting defect; administers an 11-product AWS Marketplace portfolio, produced the container-platform business case identifying ~31% run-rate savings, and executed an observability vendor migration contract-to-contract.
• Led and completed the migration of a full-mesh VPC Peering estate (80+ connections) to AWS Transit Gateway across two regions with atomic route cutover and instant-rollback design — zero service disruption.

Core Competencies

IT Risk & Compliance

• IT General Controls (ITGC) and IT Application Controls (ITAC) over financial data flows
• IT risk identification, control-gap assessment, remediation, and findings management
• Audit support and evidence collection for internal and external auditors
• SOX (IT component) control concepts; SOC 2, ISO 27001, PCI DSS, NIST CSF awareness
• Compliance automation (Sprinto) and continuous control monitoring (Prowler findings lake)

Information Security

• Identity lifecycle (joiner/mover/leaver) with automated deprovisioning, least privilege, segregation of duties, SSO-derived credentials replacing static secrets
• Organization-scale vulnerability/CVE remediation, encryption by default, and hardening
• Threat detection and logging: GuardDuty, CloudTrail, Security Lake, Inspector, SIEM, firewall syslog pipelines
• Posture management (Prowler) and cross-account governance (self-hosted Steampipe)
• Zero Trust access (Cloudflare WARP/Gateway), WAF, KMS encryption, secrets management, email authentication (SPF/DKIM/DMARC) at multi-domain scale

Cloud Infrastructure, Platform Engineering & Resilience

• AWS multi-account Organizations (70 accounts), SCPs, StackSets, multi-region operations
• Infrastructure as Code: CloudFormation, Terraform, Terragrunt; Python/Bash/TypeScript automation with CI validation (cfn-lint, ShellCheck, unit tests)
• Container platforms on ECS/Graviton with encrypted storage and private ingress; self-hosted developer tooling (Forgejo source control with Actions CI)
• Telemetry pipelines (CloudWatch, Firehose, Vector, OpenSearch), OpenTelemetry collector fleets, centralized alerting design (CloudWatch OAM)
• Backup/recovery and BCP/DRP controls across jurisdictions

FinOps & Vendor Management

• CUR 2.0 analytics (Athena/Glue/QuickSight), cost decomposition and anomaly root-cause analysis, Savings Plans verification, AI-spend attribution by IAM principal
• Platform business cases, AWS Marketplace subscription and vendor-contract administration

AI Platform Engineering & Automation

• Deployed LLM agents on AWS Bedrock (Anthropic Claude, OpenAI GPT) and self-hosted inference, with separate diagnostic (read-only) and authorized-remediation permission classes
• RAG architectures (Bedrock Knowledge Bases, S3 Vectors, OpenSearch); MCP server development
• Serverless automation on Cloudflare Workers (Workflows, Durable Objects, D1, AI Gateway); AI governance and spend tiering

Professional Experience

Clara — Infrastructure & Information Security Manager

Pre-IPO fintech (corporate cards & spend management), LATAM — Mexico, Brazil, Colombia · 2020 – Present

Owns the IT control environment and cloud security posture for a regulated, pre-IPO fintech operating a 70-account AWS Organization across three countries and two AWS regions.

IT General Controls — Logical Access

• Operates the engineering identity lifecycle — 80+ documented offboardings enforcing timely revocation, least privilege, and segregation of duties across AWS, Okta/Auth0, and SaaS; built an automated offboarding relay on Cloudflare Workers that deprovisions password manager, BI, and Zero Trust access on ticket events, isolating rather than deleting identities to preserve audit trails.
• Led an organization-wide IAM Identity Center security audit (65 accounts, 165 SSO users, 52 permission sets), remediating dormant users, over-privileged assignments, and offboarding gaps; runs a recurring credential-hygiene program (87 user/key remediations, organization-wide credential reporting).
• Replaced static OpenSearch administrator passwords with IAM Identity Center–derived SigV4 credentials; provisions Bedrock API keys per principal with cost-attribution tags, making previously unattributable AI spend auditable.
• Migrated 240 users from legacy OpenVPN to Cloudflare Zero Trust (WARP/Gateway) via a phased, MDM-driven rollout across three countries, then decommissioned the VPN estate; hardened WARP split-tunnel baselines and introduced dedicated egress IPs.

IT General Controls — Change & Configuration Management

• Governs infrastructure change through an auditable ticketed workflow — 570+ completed infrastructure and security tickets and 47 projects led through a staged pipeline (change approval, functionality test, proof of success, rollback verification).
• Built and operates the team’s self-hosted source-control and CI platform (Forgejo with Actions runners on ECS/Graviton; KMS-encrypted storage, private TLS ingress gated by Zero Trust) hosting 25+ infrastructure repositories; administers the organization’s infrastructure GitHub organization with CI validation (cfn-lint, ShellCheck, unit tests).
• Builds hardened Amazon Linux 2023 golden AMIs (EC2 Image Builder, Graviton) on a quarterly cadence for all accounts and regions; directed lifecycle programs spanning DocumentDB engine upgrades (7 clusters), OpenSearch engine upgrades, EOL Lambda runtime remediation (78 functions, with a 1,283-function follow-on program scoped), ElastiCache service updates (10 of 11 replication groups), and launch template standardization.

Security Operations & Vulnerability Management

• Led the organization-wide AWS GuardDuty deployment — 70 accounts, two regions, delegated administration, StackSet auto-enrollment, KMS-encrypted publishing — with centralized EventBridge alerting of high-severity findings to Slack and an LLM-annotated daily digest.
• Enforced EBS encryption by default across 54 accounts (107 account-region pairs); drove fleet-wide remediation: critical CVEs patched across all accounts, SSH disabled on 174 EC2 instances and baked into 57 ECS launch templates, vulnerable kernel module removed across 13 accounts via SSM, followed by continuous SSH compliance monitoring with daily organization-wide reporting.
• Built a Prowler findings lake: an event-driven, cross-account Fargate pipeline streaming OCSF security findings into OpenSearch (726K findings ingested with zero bulk errors, checksum-verified) with posture dashboards for continuous control monitoring.
• Ran the email anti-spoofing program: 31 corporate domains audited, authentication driven to 96% compliance across 18 AWS SES sending domains (SPF hard-fail, DKIM, DMARC enforcement).
• Conducted an organization-wide WAFv2 effectiveness review (21 Web ACLs protecting 65 load balancers), contributed to the 66-account WAFv2 baseline standard, and operates container-image scanning with automated triage to Slack.

Network Segmentation & Resilience

• Led and completed the VPC Peering to AWS Transit Gateway migration (80+ connections, multi-region, cross-account) with atomic route cutover and instant-rollback design.
• Redesigned 6 partner site-to-site IPSec VPNs across 6 accounts from static routing to BGP dynamic routing with hardened cryptography (IKEv2-only) and automatic failover, validated on a staging canary before production cutover; led the vendor-facing provider migration across Brazil, Mexico, and Colombia environments with Spanish-language runbooks.
• Manages backup/recovery and BCP/DRP controls (AWS Backup, snapshot policies, cross-account backup account) across multiple operating jurisdictions.

Data Platform Controls & Operations

• Executed a controlled Kafka 3.6 to 3.9 upgrade of seven Amazon MSK clusters in ~21 hours with no recorded incidents under an AWS forced-upgrade window, after removing 104 abandoned topics (7,600 to 5,912 partition replicas) to unblock configuration changes and avoid broker additions.
• Raised ~1,950 topics across 7 clusters to replication factor 3 (~400 GiB migrated under throttling with no partition unavailability), disabled unclean leader election fleet-wide, and established topic standards with a daily replication-invariant audit; responded to an AWS Health high-risk event on a production payments cluster.
• Leads the MSK fleet right-sizing program (~18% of run-rate verified in billing, ~50% modelled); re-architected Kafka observability onto Amazon Managed Prometheus and Grafana.
• Raised OpenSearch lifecycle (ISM) coverage from 18.5% to 98.6% across a 1,703-index security-logging cluster; remediated write-saturation and shard-distribution incidents on production search clusters.
• Supports data-integrity controls over financial pipelines: AWS DMS change-data-capture (13 replication instances, 213 tasks) with latency alerting, encryption at rest/in transit, centralized database audit logging (pgaudit) for BI workloads, and access controls over an estate of 86 Aurora PostgreSQL clusters, DocumentDB, OpenSearch, MSK, Databricks, MWAA (Airflow), and QuickSight.

Observability & Telemetry Pipelines

• Executed the observability vendor migration contract-to-contract; operates an OpenTelemetry collector fleet across EC2 and ECS hosts and centralized cross-account CloudWatch observability spanning 64 accounts; is developing an organization-wide alerting standard on CloudWatch OAM.
• Built event-driven log pipelines on Vector: Kafka broker and connector logs from 4 accounts and 2 regions centralized via Firehose with 396-day retention; firewall syslog over TLS with dual sinks; a custom exporter filling inotify and file-descriptor monitoring gaps fleet-wide. Investigated and documented telemetry incidents with remediation evidence.

AI Platform Engineering

• Designed and operates six LLM agents (AWS Bedrock — Anthropic Claude and OpenAI GPT — plus a self-hosted inference endpoint) serving infrastructure operations over Slack and an internal chat platform — conversational diagnostics, incident management, FinOps reporting — under a layered least-privilege model: IAM boundaries with cross-account roles, unit-tested pre-execution guard hooks, toolset restriction, and prompt contracts. Diagnostic agents are read-only; remediation is limited to explicitly authorized, gated actions verified by negative testing.
• Built an autonomous Kafka operations agent that receives authenticated CloudWatch alarms through a signature-validating gateway, triages, and remediates through registry-gated actions with dry-run, throttling, and post-action verification (human approval retained for unclean leader election); it patched a vulnerable internal service unattended in ~6.5 minutes and was hardened with a maintenance-window gate after an alarm-storm incident.
• Built an LLM-driven support-intake bot on Cloudflare Workers (Workflows, Durable Objects, D1, AI Gateway) converting Slack requests into structured, tracked tickets with a claim-and-escalation lifecycle (174 tickets routed to seven engineers in one quarter); decommissioned a 42-workflow n8n automation server by replacing it with a unit-tested TypeScript event gateway.
• Deployed a self-hosted agent memory platform on ECS; designed a compliance-documentation RAG architecture (Bedrock Knowledge Bases on S3 Vectors); delivered an executive AI-advisor proof of concept for company leadership; governs organization Bedrock access and AI spend through inventory audits, per-principal attribution, and model-tiering analysis.

FinOps, Vendor & Audit Governance

• Stewards the ~USD $2.9M annual cloud and SaaS footprint: built the CUR 2.0 analytics stack (36-month backfill) and a QuickSight dashboard with row-level security; exposed a ~35% under-reporting defect in Athena cost data; verified Savings Plans utilization at 97%; removed dormant resources (94 Lambda functions across 12 accounts, orphaned connectors, unused Elastic IPs).
• Replaced the primary cross-account inventory SaaS with a self-hosted Steampipe platform (66 accounts, cached inventory tables, VPN-only TLS access) that underpins audits and agents, retaining the commercial service as fallback.
• Administers the AWS Marketplace subscription portfolio (11 products — Databricks, Auth0/Okta, Red Hat OpenShift, LaunchDarkly, Splunk, Fortinet, Turbot, and observability platforms) including renewals, private offers, and a contract-to-contract observability vendor migration; produced the ROSA-versus-EKS business case identifying ~31% run-rate savings.
• Generates audit and control evidence via Sprinto; built and delivered a compliance knowledge base consolidating control documentation as a single source of truth.

Grow Mobility — Chief Security Officer & Infrastructure Manager

• Established and led the information-security function: web and mobile (iOS/Android) application security audits, API hardening, and infrastructure, database, and cloud security assessments.
• Built and administered the AWS environment with cloud-wide monitoring (New Relic).
• Designed and operated a data-lake platform (AWS Redshift, Glue, Athena) processing ~35 TB across 29 SQL databases and 270 DynamoDB tables for near-real-time analytics.

Advanced Solutions 2H Mexico — Solutions & Services Manager

• Designed and implemented client information-security solutions; managed medium- and long-term network re-engineering programs establishing foundations for control, administration, and performance-monitoring technologies.
• Evaluated and integrated security technologies: UTM appliances (ASIC/FPGA), on-the-fly and pre-boot encryption, token/software authentication, and SIEM/event-correlation platforms (ArcSight, NetIQ/Attachmate, Enterasys).
• Performed controlled real-attack product evaluations and contracted penetration testing.

Independent Information Security & Regulatory Consultant

• Delivered infrastructure and information-security consulting to financial-sector and government clients, including Banjército (banking), ANA Seguros (insurance), Alsis Funds, Solutrust (fiduciary services), Secretaría de Relaciones Exteriores, Secretaría del Trabajo y Previsión Social, SEDESOL/DICONSA, SKY/Novavisión, Universidad Latina (UNILA), Grupo THEOS, ITERA, McAfee, and Fortinet.
• Advised on fintech regulatory frameworks and Latin-American data-protection law (Mexico, Brazil, Chile, Colombia, Peru).
• Specialized in database query-filtering and record-transfer controls, network-anomaly detection, data-loss prevention (DLP), and IPv6 hardening for DNS, DHCP, and mail services.

Early Career — Systems Administration

• Universidad y Escuela Internacional, S.C. — Designed Active Directory with ACL-based segregation across administrative, academic, and student populations; administered ISA Server clusters with content filtering; integrated SUSE Linux and Informix/ADABAS-D systems.
• EJE Technologies, S.A. de C.V. — Remote administration of email, web hosting, and monitoring (Nagios/Cacti) on FreeBSD across SPARC and Intel x86 architectures.

Technical Skills

• Cloud & Platforms: AWS (Organizations, IAM/Identity Center, EC2/Graviton, VPC/Transit Gateway, RDS/Aurora PostgreSQL, DocumentDB, S3, MSK/Kafka, OpenSearch, DMS, ECS/EKS, Lambda, MWAA/Airflow, CloudFront, API Gateway, Kinesis Data Firehose, Athena/Glue, QuickSight, Bedrock, Image Builder, Transfer Family), Red Hat OpenShift (ROSA), Databricks, Cloudflare (DNS at scale, Zero Trust, Workers)
• Security & Compliance: GuardDuty, CloudTrail, Security Lake, Inspector, AWS Config, KMS, Secrets Manager, WAF (AWS / Fortinet), Cloudflare Zero Trust, Okta/Auth0, Prowler (OCSF), Sprinto, Steampipe/Turbot, SIEM/event correlation, vulnerability management, hardening, SPF/DKIM/DMARC, network forensics (Wireshark/tshark), penetration-testing tooling
• AI & Automation: AWS Bedrock (Anthropic Claude, OpenAI GPT, cross-region inference profiles), self-hosted inference (llama.cpp), LLM agent architecture and security (guard hooks, gated remediation, signed webhook chains), RAG (Bedrock Knowledge Bases, S3 Vectors, pgvector), MCP server development, Cloudflare Workers (Workflows, Durable Objects, D1, KV, AI Gateway), n8n
• Resilience & Data: AWS Backup, snapshot/lifecycle policies, BCP/DRP, DMS/CDC data integrity, Kafka replication and MinISR standards, Kafka version upgrades, encryption at rest & in transit
• Observability: OpenTelemetry Collector, Vector, Tsuga, Dynatrace, Splunk, Amazon Managed Prometheus, Managed Grafana, CloudWatch (cross-account OAM, Container Insights), OpenSearch Dashboards and Alerting, pgBadger
• Developer Platforms & IaC: Forgejo with Actions CI, GitHub (organization administration, Actions), CloudFormation (StackSets), Terraform, Terragrunt, cfn-lint, ShellCheck, Python (pytest, boto3), Bash, TypeScript/Node.js (Hono, vitest), PowerShell, Ruby, Git
• Frameworks (working knowledge): SOX (IT component) / ITGC / ITAC, SOC 2, ISO 27001, PCI DSS, NIST CSF, LGPD / LATAM data-protection law

Certifications & Professional Development

• In progress: CISA, CRISC, ISO 27001 Lead Implementer/Auditor
• Contributor to b:Secure information-security magazine
• Speaker at industry events including b:Secure Conference and the Congreso de Seguridad y Software Libre

Languages

• Spanish — Native
• English — Professional working proficiency (B2+)

Education

• Business Administration

Additional

• Open source: maintains a fork of an MCP diagram-rendering server with protocol-handshake and container fixes, delivered through pull requests with CI.
• Independent work in financial markets: development of technical indicators (TradingView) and an algorithmic trading bot for automated order execution (Python, CCXT, Deribit).