Sean Hartrich

Deep expertise across the AWS platform: EC2, EKS, IAM, S3, Lambda, RDS, EventBridge, SNS, CloudTrail, CloudWatch, Secrets Manager, ECR, DynamoDB, VPC/Networking. Comfortable operating at scale across both commercial and GovCloud (FedRAMP) environments.

Owns and maintains Okta's BT AWS Organization — including account vending pipeline, OU hierarchy, Service Control Policies (IMDSv2 enforcement, networking restrictions, credential rotation allowances), and access provisioning for 40+ teams.

Architected and built an end-to-end automated security compliance pipeline using AWS Config Rules, CloudFormation Stacksets, Lambda, EventBridge, and Cloud Custodian to detect and auto-remediate misconfigurations across an entire AWS Organization.

Owns Okta's Federal VDI image pipeline — migrated from GoLang/Packer/CodePipeline to Python/GitLab Runners; manages FIPS compliance encryption, workspace lifecycle automation, and PagerDuty alerting.

Operates Okta's federal GovCloud environment including STIG-compliant infrastructure, federal IAM hardening with IP restrictions and YubiKey MFA, and monthly POAM inventory obligations.

Primary IaC tool for all cloud infrastructure. Manages EKS clusters, AWS Organizations, account pipelines, networking, and service infrastructure across commercial and federal environments — over 1,400 commits across 32 repositories.

Deploys and operates production EKS clusters — including node group sizing, Bottlerocket AMIs, pod affinity/anti-affinity, IRSA (IAM Roles for Service Accounts), and JVM/Tomcat tuning for production JFrog Artifactory workloads.

Uses Helm charts and Kustomize overlays to manage Kubernetes workloads including CrowdStrike Falcon Operator, Istio service mesh, and JFrog Artifactory.

Lead engineer for Okta BT's self-hosted Artifactory Enterprise Plus instance — deployed on EKS with Okta SSO/SCIM via OPP agent, Istio and CrowdStrike hardening, disaster recovery runbook, and automated E2E artifact test suite.

Builds and maintains custom Docker images for CI/CD pipelines; integrates Chainguard hardened base images for GovCloud ECR; manages container security scanning with Twistlock/Qualys.

Deployed CrowdStrike Falcon node sensors across EKS clusters via Helm operator and Kustomize; drove cross-team engagement with Enterprise Security to extend Falcon coverage to BT SRE cloud infrastructure.

Uses Cloud Custodian with CloudTrail Lambda triggers for event-driven compliance remediation — auto-remediation of open security group rules, SSH port restrictions with edge case handling, and cross-account SNS notification routing.

Integrates Checkov static analysis into CI/CD pipelines to catch Infrastructure as Code security misconfigurations before they reach production.

Manages FIPS compliance deployments and STIG-compliant upgrade procedures for federal GitLab across multi-step major version upgrades; enforces immutable instance upgrade methodology for compliance posture.

Implements IMDSv2 enforcement org-wide via SCP, IP restriction policies for federal IAM users, breakglass IAM user management, and ABAC spike evaluations for dynamic SCP exception handling.

Builds GitHub Actions workflows with OIDC authentication, composite actions, and self-hosted runners (GHARC). Authored the BT-wide GitHub EMU migration guide enabling all engineers to migrate from GitLab CI to GitHub Actions.

Maintains GitLab CI/CD pipelines including the STIG-compliant federal GitLab instance, custom runner images, and cross-account role assumption for pipeline execution.

Maintains Okta's self-hosted GitHub Actions runner cluster — integrates Artifactory registry credentials, CrowdStrike sensor, E2E test workflows, and stress-tested alerting baselines.

Maintains Okta BT's Netbox IP address management platform; coordinates CIDR subnet allocation across new AWS account provisioning and networking architecture.

Uses Python for infrastructure automation (rewrote GoLang/Packer VDI pipelines in Python), Lambda functions, and compliance tooling. Uses Bash for CI/CD scripting and operational automation.

Works at the intersection of Okta product and infrastructure — configures SAML SSO, SCIM provisioning via Okta OPP agent with nginx SCIM proxy sidecar, and OIDC federation for EKS IRSA and GitHub Actions workflows.

Manages AWS IAM Identity Center for SSO/OIDC across the BT AWS Organization; maintains permission sets, account assignments, and OIDC provider configurations for Airflow EKS, Spinnaker, and GitHub.

Drives observability initiatives including ingesting Federal BT CloudTrail logs into BT Splunk; builds log transform Lambdas with custom sourcetype assignment for Kubernetes and managed-service VPCs.

Configures PagerDuty alerting for production infrastructure — WorkSpaces capacity limits, EKS cluster health, GitLab log volume, GHARC E2E test failures, and breakglass login events.

Designs CloudTrail-event-driven architectures for auto-tagging, alerting, and compliance; manages CloudWatch log groups, alarms, and dashboards across commercial and federal environments.