Joseph Olutimehin

Cloud engineer · Toronto, Canada

Cloud infrastructure.
Built with a security mindset.

I'm Joseph. I build on Google Cloud with Terraform, Kubernetes, and Cloud Build, bringing experience in security engineering at Coinbase to the systems I design and operate.

Explore my work Get in touch

Google Cloud certification

Associate Cloud Engineer

Issued 27 July 2026 · Valid through 27 July 2029

Certification ID

0e97354c793b4d6ea3186b77d3674f48

Verify credential ↗

01 / Selected work

Infrastructure in practice.

Systems I've built, the decisions behind them, and the code that makes them work.

GKE · GitOps · Terraform

GKE Application Platform

A Kubernetes application platform that deploys services through reviewed configuration changes, with secure defaults, automated delivery, monitoring, and Git-based recovery.

  • Private GKE infrastructure managed with Terraform, with Gateway API and managed HTTPS.
  • Cloud Build tests and scans container images; Argo CD deploys approved image digests through Helm.
  • Workload Identity, rotating Secret Manager secrets, network isolation, and Kyverno admission policies.
  • Prometheus monitoring and email alerts, with validated autoscaling, rollback, and disruption recovery.

Recorded lab tests achieved 99.78% successful responses at 20 requests per second with 56 ms p95 latency; Git rollback completed in under two minutes.

Write-up ↗ Source ↗ Test evidence ↗

Networking · IAM · Terraform

Bank Shared VPC & PSC

A banking-style, four-project Google Cloud network that brings centralized governance and private service access together. Provisioned entirely with Terraform.

  • Shared VPC with subnet-level IAM delegation.
  • Identity-based firewall rules and an internal load balancer.
  • Private Service Connect access from a partner VPC.
  • VPC Flow Logs aggregated into BigQuery.
Read the write-up ↗ Source ↗

02 / Experience

A foundation in security.

Download résumé (PDF) ↗

Jun 2026 - Present

Cloud Platform Engineer

Stablecoin Whale Monitor · Self-employed

  • Designed, built, and operate a live Google Cloud platform that monitors large USDC and USDT transfers on Ethereum, evolving it from Compute Engine VMs to Cloud Run/GKE and a Terraform-managed serverless architecture.
  • Built a Cloud Run Worker Pool indexer that writes confirmed transfers as immutable objects to private Cloud Storage, a Cloud Run API that serves them from that store, Pub/Sub alerts, and a Next.js dashboard behind a global external Application Load Balancer, Cloud CDN, and Cloud Armor.
More about this role
  • Implemented approval-gated CI/CD with Cloud Build, immutable container releases, automated testing, and deployment smoke tests.
  • Applied least-privilege IAM, Secret Manager, private storage, secured ingress, and workload-specific service accounts.
  • Improved reliability through crash-safe checkpointing, idempotent processing, observability with Cloud Monitoring, and production incident troubleshooting.
Live project ↗ Source ↗ Write-up ↗

Feb 2025 - Jun 2026

Security Engineer

Coinbase

  • Led smart contract security reviews for the Base-Solana Bridge, the x402 payment protocol, the Base Azul network upgrade and numerous other Coinbase core projects, assessing smart contract vulnerabilities, trust boundaries, cross-chain security failures, upgradeability issues, and integration and rollout risk.
  • Built and maintained internal AI-powered smart contract auditing tooling used across the security organisation to support repeatable review workflows.
More about this role
  • Conducted multiple ecosystem security reviews for protocols integrating with Base, flagged multiple issues, and provided vulnerability fixes.
  • Served on call for security incident response, triaging live security incidents and coordinating resolution across engineering and security teams.

Jan 2023 - Jan 2025

Independent Security Researcher

Independent · Code4rena, Cantina, Sherlock, Immunefi, Codehawks, QuillAudits

  • Completed 30+ smart contract security reviews, identifying 50 High- and Medium-severity vulnerabilities validated and accepted by protocol teams.
  • Reviewed a broad mix of DeFi and interoperability protocols including AMMs, lending markets, stablecoins, vaults, bridges and omnichain infrastructure, applying threat modelling and secure-SDLC analysis.

Oct 2023 - Apr 2024

Developer Advocate

INTMAX

  • Contributed to zero-knowledge developer documentation for a ZK rollup, covering protocol concepts, integration guides and onboarding material for external teams building on the network.
  • Drove protocol education and developer onboarding through technical presentations at Google DevFest Lagos and Africa Tech Summit in Nairobi.

Sep 2022 - Jun 2023

Software Engineer (Smart Contract)

Astraverse

  • Built a Gaming and Fashion protocol on Ethereum, writing and testing all smart contracts.
  • Designed and deployed ERC-1155 token contracts for the marketplace platform.
More about this role
  • Built Node.js and TypeScript APIs, integrating backend services with deployed contracts via Ethers.js and Wagmi, and handled integration with the frontend team.

May 2022 - Sep 2022

Software Engineer (Blockchain)

Collect Waves

  • Built NFT and marketplace contracts with ERC-20 token integration, and the API services supporting them.
  • Delivered the full application stack around the contracts: a frontend connected to on-chain state, and Node.js and TypeScript REST APIs for off-chain data.

03 / Toolkit

Tools of the trade.

Google Cloud

  • Compute Engine
  • Cloud Run
  • GKE
  • Cloud Storage
  • Cloud SQL
  • Pub/Sub
  • Artifact Registry
  • Cloud CDN
  • Cloud Armor
  • IAM
  • VPC

IaC, CI/CD & automation

  • Terraform
  • Cloud Build
  • GitHub Actions
  • Docker
  • Kubernetes
  • Helm
  • Kustomize
  • Argo CD
  • Linux
  • gcloud CLI

Languages

  • TypeScript
  • JavaScript (Node.js)
  • Python
  • Rust
  • Solidity
  • Bash

Networking

  • VPC design
  • Subnetting
  • Firewall rules
  • DNS
  • Cloud NAT
  • Load balancing
  • Gateway API
  • TLS & certificates

Security

  • IAM least privilege
  • Service accounts
  • Workload Identity
  • Secrets management
  • Network segmentation
  • Network policies
  • Kyverno
  • Trivy
  • Threat modelling
  • Secure SDLC

Observability

  • Cloud Monitoring
  • Prometheus
  • PromQL
  • Cloud Logging
  • Structured logging
  • Uptime checks
  • SLO & alerting design

Web & backend

  • Express
  • NestJS
  • FastAPI
  • Next.js
  • React
  • Redis

04 / Writing

Engineering notes.

Google Cloud, infrastructure, and lessons from building and operating.

05 / About

An engineer's perspective.

Before shifting to full-time cloud work, I spent four years in blockchain security and smart contract development, most recently at Coinbase, where I audited bridges, payment protocols, and network upgrades securing billions of dollars.

That experience shapes how I approach cloud architecture: minimal IAM permissions, private-by-default networking, and observability in place before the first production incident.

I'm based in Toronto, with a background in mathematics and experience helping developers understand and build on complex protocols.

Education

B.Sc. Mathematics

Federal University of Agriculture, Abeokuta, Nigeria

2018–2022

Speaking & developer education

DeFi Security Summit
Speaker, representing the Coinbase Security team.

Google DevFest Lagos & Africa Tech Summit Nairobi
Protocol education and developer onboarding.

2023–2024

Let's connect

Let's build something reliable.

Hiring for cloud infrastructure? I'd like to hear from you.

[email protected] LinkedIn ↗ Résumé (PDF) ↗