--- title: "Erik Kristensen — Engineering Leader & Principal Engineer" description: "Engineering director who still writes the code. Open to director, head of engineering, hands-on CTO, and principal engineer/architect. Maintainer of aws-nuke." source: https://ekristen.dev/ --- # I lead teams that build platforms that work. I build them too. - **aws-nuke** — multi-cloud resource teardown — *739k* - **terraform-provider-pgp** — pgp operations for terraform — *1.1M* - **docker-openvpn-client** — vpn egress for containers — *644k* - **libnuke** — the engine under the nuke tools - **sift workstation** — the dfir linux distribution — *500k* - **cast** — dfir analysis workstations — *84k* - **distillery** — binary installs without a package manager — *26k* - **azure-nuke & gcp-nuke** — the same teardown, other clouds — *79k* - **atlas** — secure distributed thanos - **guppi** — orchestrating many coding agents I run engineering organizations and I still ship the code. Today that’s **five teams and 20+ engineers** at SANS, and about **3.1 million downloads** of open source I wrote and still maintain myself. aws-nuke is the piece most people know me for, but most of what I build is developer tooling, release engineering, and the infrastructure sitting underneath other people’s platforms. I lead through architecture and technical direction — I want the seat where leading a team still means building what it ships. [Get in touch](https://ekristen.dev/#contact) [Selected work →](https://ekristen.dev/#work) [Resume (PDF)](https://ekristen.dev/resume.pdf) open to — director / senior director · head of engineering · hands-on cto · principal engineer / architect - **3.1M+** — Open source downloads - **2,398** — GitHub stars - **20+** — Engineers led - **2009** — Building open source since ## Software I maintain in the open Most of it came out of the day job. I started contributing to aws-nuke around 2021 because the cyber range platform I was building at SANS needed cloud accounts wiped clean between students — and when the resource types we needed weren’t landing upstream fast enough, I forked it to add our own. In December 2023 I rewrote the core into **libnuke** to make it properly testable, and azure-nuke and gcp-nuke followed on the same engine. SANS runs all three in production today. Hit a problem at work, build the tool, maintain it in public, run it back through the day job — that loop is most of what’s below. 2.48M GitHub release assets · 710k Docker Hub pulls · 52k/yr npm · 7k/yr Homebrew ### [aws-nuke](https://github.com/ekristen/aws-nuke) maintainer · ★ 1,401 · ↓ 739k releases · 144 forks · 174 contributors · Go Removes every resource from an AWS account: hundreds of resource types, safety rails, and a filter engine for scoping exactly what gets destroyed. I contributed to rebuy-de’s original from 2021 and forked it when the resources we needed weren’t landing fast enough, then rewrote the core onto libnuke. When they asked whether I’d take the project over, I asked them to archive and point here instead — their 5.8k-star history, and the credit for it, stayed theirs. ### [terraform-provider-pgp](https://github.com/ekristen/terraform-provider-pgp) most downloaded · ★ 12 · ↓ 1.1M registry · Go A Terraform provider for PGP operations. Quietly the furthest-reaching thing I’ve published: over a million pulls through the Terraform registry. ### [docker-openvpn-client](https://github.com/ekristen/docker-openvpn-client) ★ 42 · ↓ 644k pulls · 40 forks · Docker OpenVPN client packaged for Docker, so a container can sit behind a tunnel without the host doing anything. Nearly two-thirds of a million pulls from Docker Hub. ### [sift workstation](https://github.com/teamdfir/sift) maintainer · ★ 551 · ↓ 500k+ source & vm · 67 forks The SANS Investigative Forensic Toolkit, the DFIR Linux distribution, which I’ve helped maintain since 2013. Not my project, so its downloads sit outside the totals above. ### [cast](https://github.com/ekristen/cast) ★ 139 · ↓ 84k releases · Go Installer for SaltStack-based security distributions like SIFT and REMnux. Used by DFIR practitioners to stand up analysis workstations. ### [libnuke](https://github.com/ekristen/libnuke) ★ 60 · ↓ go module · Go The shared engine extracted out of the nuke tools: scanning, queueing, filtering, and lifecycle logic reused across AWS, Azure, and GCP. ### [azure-nuke](https://github.com/ekristen/azure-nuke) ★ 58 · ↓ 54k releases · Go Tenant- and subscription-wide resource teardown for Azure, built on libnuke. ### [distillery](https://github.com/ekristen/distillery) ★ 61 · ↓ 26k releases · 8 forks · Go Like Homebrew with less fizz — installs binaries straight from GitHub, GitLab, and Hashicorp releases. No package maintainer in the loop, no waiting for a formula. ### [gcp-nuke](https://github.com/ekristen/gcp-nuke) ★ 45 · ↓ 25k releases · Go Project-wide resource teardown for Google Cloud, completing the multi-cloud set. ### [dns-proxy](https://github.com/ekristen/dns-proxy) ★ 210 · ↓ 3.7k/yr npm · JavaScript Override hosts, domains, or entire TLDs and redirect them wherever you need. Long-lived, still pulled from npm every week. ### [guppi](https://github.com/ekristen/guppi) new · ★ 14 · Go All tmux sessions, all agents, one interface. Built for the reality of running many coding agents at once. [All 300+ repositories →](https://github.com/ekristen?tab=repositories) ## Systems I owned end to end The open source above is what I can show you. This is the work that mattered most and lives behind a login, described at the level of decisions and outcomes instead of internals. ### Video production platform SANS Institute · 20% faster turnaround · six figures saved/yr - **Context** — Course content is the product, and video production sits on the critical path for all of it. Turnaround time bounds how fast curriculum reaches students. The pipeline behind it was **fifteen-year-old technology**, delivered over a general-purpose CDN doing a job it was never designed for. Rendering alone consumed a full day of every production cycle. - **My role** — Architected the system and set the technical direction; my org built it. - **Approach** — A modernization, not a patch. Replace the aging production stack outright, move rendering onto hardware built to do it, and move delivery onto infrastructure actually built for video. - **Outcome** — Rendering went from a full day to roughly **70 minutes**, which took that day back out of the schedule: a **20% reduction in content turnaround** realized immediately, and editors keep the four days the editing itself actually takes. **Six figures of savings a year** alongside it, and a projected 50% reduction as the rest of the work lands. ### Cyber range platform SANS Institute · 50,000+ students/yr · aws, azure & gcp - **Context** — Realistic training environments — full networks, not toy labs — had to stand up and tear down on demand across hundreds of courses, at a volume nobody could shepherd by hand. What came before was hand-built and non-reproducible, and every environment shared one network entry point, so a single failure took access away from everyone at once. - **My role** — Led it and built it. A team of 3–4, and everything from the architecture to the delivery was mine. I’ve kept ownership of the platform through two promotions since, still shipping features and fixing bugs on it myself. - **Approach** — I used Kubernetes as a state machine and drove it with GitOps, so an environment became a declared desired state instead of a deploy script. That is what made targeting any cloud platform tractable. I designed the spec for how an environment gets built, the observability layer, and the deployment system, then built all three. Every environment arrives self-monitoring and self-alerting and federates its metrics into one central view, live and historical. I also owned the cloud account lifecycle strategy: accounts allocated, reclaimed, and sanitized deterministically between uses. That is what lets a course hand a student full administrative access to a real cloud account. - **Outcome** — 50,000+ students a year across AWS, Azure, and GCP, at a **95%+ environment build success rate**. The failures that remain are transient cloud-provider faults absorbed by automatic retry, not manual recovery. Per-environment isolation replaced the shared entry point, so blast radius is one environment instead of the whole program. ### Mobile device lab NowSecure · 160+ devices · 4+ clusters - **Context** — App security testing is only trustworthy on real devices, so the entire product was bound to physical hardware at exactly the point it needed to scale like software. We already ran everything else in containers. The question was how to marry the two instead of picking one. - **My role** — Three of us built it. The architecture, the hardware design, the bootstrap layer, and the delivery were mine. - **Approach** — Took the design cue from GitLab and its runner model: a site registers itself and pulls work instead of being centrally administered. We built physical racks of device hardware and paired them with self-bootstrapping OS installs and Kubernetes, so a rack came up, joined, and managed itself. Devices became a checkout-able resource: request one, install the app, run the test, release it, all driven remotely, with nobody needing to be in the room with the hardware. That registration pattern is the one I carried forward into the range platform above. - **Outcome** — 4+ self-managing clusters and 160+ devices under continuous remote control, run by three people at high reliability. Each device sustained about **two app analyses an hour**, so the fleet ceiling sat somewhere near 320. We rarely pushed it that far: throughput was bounded by how long instrumenting an app actually takes, and the orchestration layer always had headroom above what the testing could consume. ## Load-bearing systems, and the teams behind them I started out doing cyber security defense in the Air Force in 2004 and have been working on security, cloud, and developer infrastructure ever since. Mobile security runs through a good part of it, from smart device defense in the Air Force to Fixmo and then NowSecure. - **Technical Lead** · U.S. Air Force · 2004–2011 - **Architect** · Fixmo · 2011–2013 - **Director** · NowSecure · 2013–2021 - **Chief Engineer** · SANS Institute · 2021–2023 - **Director** · SANS Institute · 2023–present ↑ I’ve gone back and forth between these on purpose ### Director of Engineering and Research & Operations Center · SANS Institute Jun 2025 – Present **Five teams, 20+ engineers.** Scope expanded in June 2025 from the Research & Operations Center alone to Engineering as well, roughly doubling the organization. Together that accounts for **almost every system students interact with**, from curriculum development through delivery. Most recently I architected the new video production platform and set its technical direction: **20% off content turnaround** so far, and six figures a year in savings, detailed above. 20+ engineers · Five teams · Student-facing platform · Global scale ### Director, Research & Operations Center · SANS Institute Jun 2023 – Jun 2025 · 2 years Promoted out of the Chief Engineer seat to lead the Research & Operations Center — **roughly nine engineers** responsible for range research and operations. I kept personal ownership of the range platform straight through the transition instead of handing it off: still architecting it, still shipping features, still fixing the bugs. Director · ~9 engineers · Kept building ### Chief Engineer & Architect, Ranges · SANS Institute Feb 2021 – Jun 2023 · 2.5 years Architected and built the platform that deploys SANS cyber ranges: Kubernetes as a state machine, driven by GitOps and Terraform, so a range is a declared desired state that can land on whatever cloud platform the work requires. **Hundreds of deployments per week**, thousands per year, self-healing and self-monitoring. A team of 3–4; I designed and built the range spec, the monitoring system, and the deployment system. Detailed as the cyber range platform above. Chief Engineer · Architecture · Cyber ranges ### Director of DevOps · NowSecure Dec 2013 – Feb 2021 · 7 years A **three-person team** holding hundreds of systems online — servers, IoT devices, and physical mobile devices — across dozens of customer deployments and hundreds of deployments a week. I architected the infrastructure that scaled the mobile device fleet and automated mobile app security testing. A team that small against that much surface area meant directing and building at once. Director · Team of 3 · Hundreds of systems · Hands-on architecture ### Chief Enterprise Architect · Fixmo Oct 2011 – Dec 2013 · 2 years I designed the cloud systems behind Fixmo’s products and then built them, which is how the products stayed up for customers in every time zone. I drove the requirements that moved the flagship product into the cloud so it could **scale linearly**, and I ran every external web property alongside it: company site, support portal, documentation system. Chief Architect · Cloud architecture · Global 24/7 uptime · Mobile security ### Cyber Security Defense · United States Air Force May 2004 – Nov 2011 · 7.5 years Seven and a half years in cyber security defense: forensics, intrusion detection, firewalls, and proxies. The first four went into consolidating **half of the Air Force’s boundary protection** under a single cohesive managed policy, which meant writing the tooling that merged separate proxy and firewall configurations into one. For the last two and a half I led the technical implementation of **mobile security for smart devices**, alongside the network defense work rather than instead of it. Technical lead · Boundary protection · Network defense · Mobile security ## Where I do my best work I’ve gone back and forth between architecture roles and director roles three times now and it wasn’t accidental. I like running teams and I like building the thing. When I’ve taken the architect seat, I’ve been asked to run the organization a year or two later; I said yes, and I kept the platform. Right now I have 20+ engineers across five teams, so the organizational job is one I can do and have been doing for a while. But I think I’m best in the roles where leading a team still means being the person architecting what it builds. Head of engineering, hands-on CTO, principal engineer or architect. I’m not looking for a job where I stop building. I can read a system at the byte level and explain it at the 10,000-foot level to executives and stakeholders who want the result, not the mechanism. Knowing both ends is what lets me work a design through with the engineers instead of arbitrating it from a distance. ### Technical leadership open to Principal Engineer · Principal Architect - **I still write the code.** Roughly 3.1M downloads of open source I wrote and maintain. I read the issues and I cut the releases. - **I like the plumbing.** Multi-cloud resource lifecycle, release engineering, secrets and PKI, observability. Most of my open source exists because I needed something at work that wasn’t there. - **I maintain in public.** Issue queues, breaking changes, and releases for tools that other teams point at live production accounts. - **Most design questions I work through with the team.** Experience covers a lot of it, some need a spike to settle, and I’ll take someone else’s answer over mine when it’s better. ### Organizational leadership open to Director · Senior Director · Head of Engineering · Hands-on CTO - **I own technical direction for multiple teams.** Five separate teams and 20+ engineers at SANS — the Research & Operations Center plus the engineering systems students interact with. - **I’ve run small teams against very large surfaces.** At NowSecure I had three people and we were responsible for hundreds of systems and hundreds of deployments a week. That only works if the person leading is also building. - **I hire and mentor.** Experience and fit matter more to me than how the resume reads. - **I sit between leadership and the systems.** I’ve had to tell executives what an architecture will actually tolerate and tell engineers why a date is real, and both of those go better if you understand the system yourself. ## Let’s talk Director and senior director roles, head of engineering, hands-on CTO at a startup, principal engineer and principal architect — or a question about one of the tools. Email is fastest. - **Email** — [erik@ekristen.dev](mailto:erik@ekristen.dev) - **GitHub** — [@ekristen](https://github.com/ekristen) - **LinkedIn** — [erikkristensen](https://www.linkedin.com/in/erikkristensen/) - **X** — [@esotericmeans](https://x.com/esotericmeans)