Security & Infrastructure
The core. We design, harden, and operate the systems your business can't lose: identity and access, network boundaries, cloud posture, and the seams between them. Everything below sits on this layer.
Open source · on the GitHub Marketplace
Judgment is
the deliverable.
TechPivot is a San Diego technology consultancy: security-first engineering across AWS cloud, infrastructure, software, and AI that ships, not AI that demos. We architect it, build it, and stay accountable until it runs in production.
Selective · reviewing new engagements
Every engagement gets principal-level attention. If it's a genuinely hard problem, you'll hear back fast.
The practice
We build, secure, and run what companies depend on.
Companies bring in TechPivot when a technology decision carries real risk; we hand the result back to their team intact. Security and infrastructure are the foundation; on top of them we set the architecture for cloud, platforms, software, and the AI now woven through all of it. That judgment was earned across defense, enterprise software, and healthcare SaaS. It gives a company CTO- and CISO-level direction without the title.
See what we do the gap
Most AI projects die between the demo and production. That gap is infrastructure and security, and that is exactly what we build.
the proof
The fastest way to judge an engineering practice is to read its code. Ours is public, maintained, and running in other people's CI.
the handoff
Every engagement ends with your team owning the result outright: the system, the knowledge, and the keys.
What we do.
Cloud, Platform & DevOps
Infrastructure as code, CI/CD, and the automation that makes releases boring. We build the platforms fast-moving teams rely on.
AWS Architecture
Well-Architected without the theater: reviews that surface real risk, landing zones whose account boundaries hold, and guardrails that keep them honest.
AI Engineering & Architecture
We architect AI systems the way we architect infrastructure, because that's what they are. Retrieval, agents, evals, and guardrails designed with blast radius in mind, wired into the systems you already run, and secured from day one. We build the part that has to work, and secure the part that could hurt you.
FinOps & Cost Engineering
Cloud spend is an engineering problem before it's a finance problem. We build the tagging discipline and cost visibility that make the numbers trustworthy enough to act on.
Software & Systems
When the problem needs building, we build it. Full-stack software from database to interface, architected to last and instrumented so you can see what it's doing in production.
The Principle
Doing more with less.
Senior leverage, small footprint, automation that runs itself.
We also design complex, connected environments: networks, audio/video, physical security, and data infrastructure, architected and observed as one coherent system.
UniFi 10 GbE SFP+ PoE+ Cat6A ONVIF RAID
How we engage.
From a focused engagement to embedded leadership, scoped to what you need.
Consulting & advisory
Architecture reviews, security and AI readiness assessments, and the high-stakes technology decisions that shape everything after them. A clear recommendation in weeks, backed by findings your team can act on.
AWS engagements
Engagements from a one-week Well-Architected review to a full landing-zone build: multi-account org design, IAM boundaries, network segmentation, container platforms on EKS and ECS, and the DevOps practice that keeps delivery moving after we hand off.
Cloud & platform builds
Scoped builds with a concrete deliverable and a timeline. Kubernetes platforms, CI/CD, infrastructure as code, and migrations, engineered and handed off clean.
Cost engagements
We read the bill at the CUR level: commitment and Savings Plans strategy, tagging and showback your finance team can reconcile, and unit economics that tie spend to what you ship.
AI delivery
We move AI from readiness assessment to production. Retrieval and agent pipelines, evals standing in front of every release, and LLM platforms with the security boundaries that keep models inside them.
Fractional leadership
Sometimes the roadmap outruns the org chart. We embed at CISO and CTO altitude, running security programs, owning architecture decisions, and leading delivery inside your team.
- 01assess
A focused discovery of your systems, team, and goals, scoped in days rather than months.
- 02build
A concrete deliverable with a timeline and success criteria. Senior hands, no delegation.
- 03you own it
Code, docs, and runbooks transfer to your team. The knowledge stays when the engagement ends.
Every engagement is scoped, priced, and finished, with an end date instead of an open-ended retainer.
- AI & automationagents, retrieval, evals
- Applicationrunning in production
- Platformpipelines, CI/CD, delivery
- Infrastructurecloud, network, identity
Securitywraps every layer
Security and compliance, engineered in.
Governance, risk, and compliance shape our first architecture decision and every one after it. This is technical GRC. We understand compliance deeply and engineer the systems that satisfy it. We've owned that work where an audit is a fact of life: designing controls that survive scrutiny, threat-modeling systems before they ship, and keeping cloud and AI inside boundaries that hold. When a company needs one partner accountable for both how a system is architected and the proof that it's safe, that's the seat we take.
- governance & controls design
- risk assessment & threat modeling
- compliance-ready, audit-tested architecture
-
System & Organization Controls -
Information Security Management -
AI Management Systems -
Health Data Privacy & Security -
EU Data Protection Regulation -
Cybersecurity Framework -
Payment Card Data Security -
Critical Security Controls
SOC 2, ISO/IEC 27001 and 42001, HIPAA, GDPR, NIST CSF, PCI DSS, and CIS. Frameworks we build for and audit against: readiness, evidence, and architecture.
Open source, in production.
Engineering claims are cheap. The work is public — read the code.
techpivot/terraform-module-releaser on: pull_request Actively maintained v2.2.0
Terraform Module Releaser is a GitHub Action TechPivot builds and maintains in the open. It makes Terraform monorepos releasable: on every pull request it detects which modules changed and calculates each one's semantic-version bump from conventional commits; on merge it cuts per-module tags, releases, and documentation wikis scoped to just those directories. Zero-config, 100% GitHub-native, MIT-licensed, and compatible with GitHub Enterprise Server.
The release pipeline
on: pull_request
- detect which modules changed in the monorepo
- calculate each module's semver bump from conventional commits
- comment the release plan on the pull request
- tag + release on merge, scoped to each module's directory
- generate per-module wiki docs + changelog
- clean up tags for deleted modules
19 releases · shipping steadily since 2024
Proof, not promises
220+
GitHub stars · source: the repo
19
releases · latest v2.2.0 (Aug 2026)
MIT
license · self-hostable, no lock-in
Listed
on the GitHub Marketplace
Plus dozens of dependent repositories and full GitHub Enterprise Server compatibility.
The repository lives under the TechPivot organization on GitHub, and Mark Johnson maintains it as @virgofx, the developer handle he has used since 2011. His contributions across the ecosystem run from PHP framework internals to CI tooling.
About.
Career arc: defense contractor, then enterprise software, then healthcare SaaS co-founder, to security engineering in-house, with TechPivot alongside.
I'm Mark Johnson, and I run TechPivot. For more than twenty years I've been the person companies call when a system has to be secure, has to scale, and has to not go down.
Defense contractor to enterprise software to a healthcare SaaS company I co-founded. Different stakes, same job: build it right, then keep it running. Along the way: Northrop Grumman, ServiceNow, and a patient-portal platform I helped take from zero to production.
That work continues today, in-house, and TechPivot is the consultancy where a handful of client problems get that experience applied directly. The hands stay on real systems; the practice is where it compounds for clients.
B.S. Electrical Engineering, UC San Diego. I think about systems from the electrical layer up through the whole OSI stack: the failures that matter almost always live at the boundaries between layers, and that's where I work.
I write and open-source under TechPivot and as @virgofx on GitHub. It's all one person.
If your problem sits at the intersection of security, cloud, and software, that's exactly the work I want.
Let's talk.
We take on a small number of engagements where judgment across security, infrastructure, and AI actually moves the needle. If that's the problem you have, we'd like to hear about it.
Direct email, no intake forms, no account managers. If it's a fit, you'll know quickly.
San Diego, CaliforniaWorking with teams anywhere.