Santiago Hurtado #

Principal Systems Architect · Germany

What I Do #

I engineer distributed platforms from embedded systems up to cloud control planes. My focus is on the end-to-end architecture that allows companies to scale their connected fleets reliably, securely, and without multiplying operational costs:

Edge & OS Architecture: Hardening device operating systems, establishing hardware cryptographic trust, and ensuring continuous autonomous operation under unreliable network and power conditions.
Industrial Data Flows: Architecting event-driven messaging backbones that unify industrial telemetry (OT) with enterprise cloud infrastructure (IT).
Fleet Orchestration: Building declarative control planes and automated delivery pipelines that enable lean platform teams to operate massive device fleets at scale.

Impact & Deliverables #

Zero-Touch Fleet Provisioning: Engineered an automated GitOps and OTA delivery pipeline scaling to 500+ sites/year, reducing field onboarding from days to minutes without manual intervention.
Enterprise-Wide Strategic Alignment: Aligned 5+ business units on a unified, modular infrastructure framework, harmonizing edge deployments across diverse product roadmaps.
Mission-Critical Messaging at Scale: Architected Kubernetes Operators for enterprise MQTT brokers, enforcing zero-downtime rolling upgrades and safeguarding strict production SLAs.
High-Risk & Air-Gapped Environments: Deployed resilient operating systems and telemetry backbones across hundreds of gateways managing thousands of sensors in air-gapped industrial facilities.
Legacy Modernization: Led the architectural governance to migrate a 15M+ LOC ecosystem into a distributed, containerized platform.
Compliance & Supply Chain Governance: Built automated CVE pipeline gating and SBOM generation to guarantee compliance with IEC 62443, EU CRA, and NIS2 before field rollout.

Architecture Focus #

Lifecycle & Integrity: Dual-rootfs A/B updates, automatic rollback, and resilient field recovery.
Supply Chain Security & Gating: End-to-end SBOM generation and automated CVE vulnerability gates spanning the base OS, container images, and software pipeline stages.
Operability by Design: GitOps pipelines, edge telemetry, and declarative infrastructure for lean operations.
Edge & Cloud MLOps: Closed-loop delivery from cloud model training down to constrained field runtimes.
Security as a Constraint: Zero Trust networking, Secure Boot, and hardware security modules (HSM/TPM).

Toolbox #

Systems & Edge: Yocto · Embedded Linux · Zephyr · Mender · k3s · Docker/OCI
Cloud & Platform: Kubernetes · FluxCD · Terraform · Azure IoT Edge · Azure ML
Messaging & Observability: MQTT · OPC UA · Kafka · OpenTelemetry
Languages: Go · Python · C++