Infrastructure and cloud security engineer, five years in, working on enterprise PKI and certificate lifecycle management.
I build automated PKI control planes, intermediate CA lifecycles, and cryptographic governance across multi-tenant enterprise environments. Most of what I enjoy sits in the unglamorous, load-bearing part of security — the systems that quietly hold everything else up, and take a lot with them when they don't.
I also run a small private cloud at home, which is where most of what I learn gets tried first.
$ cat ~/.skills
[ PKI & CRYPTOGRAPHY ]
├── X.509 lifecycle automation
├── issuing & intermediate CA rotation
├── Certificate Transparency log discovery
├── ACME (RFC 8555) · mutual TLS
└── post-quantum readiness · confidential computing
[ CLOUD & PLATFORM ]
├── Google Cloud — CAS, GKE, IAM
├── Kubernetes · Docker
├── Terraform · GitOps
└── CI/CD security automation
[ BUILDING ]
└── Go · Python · Swift · Vue · PostgreSQL| CertPilot | Open-source PKI and certificate lifecycle management. Discovery across CT logs and firewalled hosts, renewals deployed in declared waves, and issuing CAs watched on the same clock as everything they sign. Go Vue PostgreSQL gRPC |
| CertRadar | Certificate incident triage on TypeSafe's Jev decision model. Code owns expiry, chain building, SAN coverage and CAA; the model reads the ticket and judges only the certificates code matched, and asks for the CN when it cannot tell. Every request, response and cent on screen. TypeScript React Jev |
| SoundcoreBridge | Native macOS menu bar app & CLI for Soundcore headphones (ANC, EQ, battery). Reverse-engineered Bluetooth RFCOMM protocol co-engineered with Claude as a weekend hack. Swift 6 macOS IOBluetooth |
| MervinX Cloud (MXC) | A private cloud I run at home — storage, container hosting, and a WireGuard tunnel for access. Where cloud ideas get tried properly before they meet anything that matters. |
| Graphi-X | Sketch a maths problem on a canvas and get it solved. Gemini vision reads the drawing, FastAPI serves it. Runs on MXC. |
| mxc-ai-bot | Telegram bot with switchable LLM backends — Gemini, OpenAI, DeepSeek — image input and per-user model selection. |
- Your certificate inventory is exact. Your tickets are not. — splitting certificate triage between code that owns the facts and a model that reads the ticket, measured against an ordinary LLM
- An expiring certificate breaks one service. An expiring CA breaks all of them. — everyone automates leaf certificates; almost nobody has a renewal script for an issuing CA
- What Certificate Transparency tells you about your own estate — CT was built to audit CAs. It's also the cheapest inventory tool you have
- Post-quantum: the half you can fix today — signatures are a planning problem; key exchange already shipped
→ more at mervinjones.dev/blog
$ cat ~/.history | tail
2026-06 → now Engineer · Tata Consultancy Services · Frankfurt am Main
certificate pipelines over Google Cloud CAS; provisioning,
renewal and ingress binding across GKE with Terraform + GitOps
2021-10 → 2026-05 System Engineer · Tata Consultancy Services · Chennai
PKI and DevOps; Cert Hub, Google CAS, Terraform, GKE;
research into post-quantum cryptographyCEH — EC-Council · Associate Cloud Engineer — Google ·
Azure Fundamentals · SC-900 — Microsoft · Cybersecurity Essentials — Cisco ·
Databricks Fundamentals · Google Cloud badges in Vertex AI Search, Gemini
Enterprise and Apigee X
BE Electronics & Communication Engineering · K. Ramakrishnan College of Engineering