---
title: "TechPivot — Security, Cloud & AI Engineering Consulting"
description: "TechPivot is a San Diego technology consultancy: security-first engineering across AWS cloud, infrastructure, software, and AI, from architecture to production."
canonical: "https://www.techpivot.com/"
source: "https://www.techpivot.com/"
---

**Open source · on the GitHub Marketplace**

# Judgment is the deliverable.

TechPivot is a San Diego technology consultancy: security-first engineering across AWS cloud, infrastructure, software, and AI that ships, not AI that demos. We architect it, build it, and stay accountable until it runs in production.

[Start a conversation](https://www.techpivot.com/#contact) · [See the open source](https://www.techpivot.com/#open-source)

**Selective · reviewing new engagements**: Every engagement gets principal-level attention. If it's a genuinely hard problem, you'll hear back fast.

![Abstract dotted globe in cyan and indigo with the TechPivot monogram embossed into its surface as landmasses, slender arcs lifting off the surface, encircled by a tilted orrery of orbital rings.](https://www.techpivot.com/assets/hero-still-globe.C6v-zbv7_Zhhs6C.webp)

**The practice**

## We build, secure, and run what companies depend on.

Companies bring in TechPivot when a technology decision carries real risk; we hand the result back to their team intact. Security and infrastructure are the foundation; on top of them we set the architecture for cloud, platforms, software, and the AI now woven through all of it. That judgment was earned across defense, enterprise software, and healthcare SaaS. It gives a company CTO- and CISO-level direction without the title.

[See what we do](https://www.techpivot.com/#capabilities)

**the gap**: Most AI projects die between the demo and production. That gap is infrastructure and security, and that is exactly what we build.

**the proof**: The fastest way to judge an engineering practice is to read its code. Ours is public, maintained, and running in other people's CI.

**the handoff**: Every engagement ends with your team owning the result outright: the system, the knowledge, and the keys.

## What we do.

### Security & Infrastructure

The core. We design, harden, and operate the systems your business can't lose: identity and access, network boundaries, cloud posture, and the seams between them. Everything below sits on this layer.

identity + access (okta, IAM) · zero-trust boundaries · reliability engineering

### Cloud, Platform & DevOps

Infrastructure as code, CI/CD, and the automation that makes releases boring. We build the platforms fast-moving teams rely on.

terraform · kubernetes · github actions · observability (grafana)

### AWS Architecture

Well-Architected without the theater: reviews that surface real risk, landing zones whose account boundaries hold, and guardrails that keep them honest.

architecture reviews · account strategy · guardrails

### AI Engineering & Architecture

We architect AI systems the way we architect infrastructure, because that's what they are. Retrieval, agents, evals, and guardrails designed with blast radius in mind, wired into the systems you already run, and secured from day one. We build the part that has to work, and secure the part that could hurt you.

retrieval + RAG pipelines · agent orchestration · evals that gate deploys · guardrails + data boundaries · LLM ops on AWS

### FinOps & Cost Engineering

Cloud spend is an engineering problem before it's a finance problem. We build the tagging discipline and cost visibility that make the numbers trustworthy enough to act on.

cost visibility · tagging discipline · spend accountability

### Software & Systems

When the problem needs building, we build it. Full-stack software from database to interface, architected to last and instrumented so you can see what it's doing in production.

node · python · PHP · postgres · mysql

### The Principle

Doing more with less.

Senior leverage, small footprint, automation that runs itself.

We also design complex, connected environments: networks, audio/video, physical security, and data infrastructure, architected and observed as one coherent system.

---

UniFi · 10 GbE · SFP+ · PoE+ · Cat6A · ONVIF · RAID

## How we engage.

From a focused engagement to embedded leadership, scoped to what you need.

### Consulting & advisory

Architecture reviews, security and AI readiness assessments, and the high-stakes technology decisions that shape everything after them. A clear recommendation in weeks, backed by findings your team can act on.

architecture review · security assessment · AI readiness · technology due diligence

### AWS engagements

Engagements from a one-week Well-Architected review to a full landing-zone build: multi-account org design, IAM boundaries, network segmentation, container platforms on EKS and ECS, and the DevOps practice that keeps delivery moving after we hand off.

well-architected · landing zones · multi-account & IAM · EKS/ECS · DevOps practice

### Cloud & platform builds

Scoped builds with a concrete deliverable and a timeline. Kubernetes platforms, CI/CD, infrastructure as code, and migrations, engineered and handed off clean.

cloud migration · kubernetes + containers · IaC (terraform) · CI/CD + DevOps

### Cost engagements

We read the bill at the CUR level: commitment and Savings Plans strategy, tagging and showback your finance team can reconcile, and unit economics that tie spend to what you ship.

cost analysis · commitments · showback · unit economics

### AI delivery

We move AI from readiness assessment to production. Retrieval and agent pipelines, evals standing in front of every release, and LLM platforms with the security boundaries that keep models inside them.

production RAG · deploy-gating evals · model platform on AWS · AI security boundaries

### Fractional leadership

Sometimes the roadmap outruns the org chart. We embed at CISO and CTO altitude, running security programs, owning architecture decisions, and leading delivery inside your team.

fractional CISO · fractional CTO · security programs · architecture direction

1. **01 assess**: A focused discovery of your systems, team, and goals, scoped in days rather than months.
2. **02 build**: A concrete deliverable with a timeline and success criteria. Senior hands, no delegation.
3. **03 you own it**: Code, docs, and runbooks transfer to your team. The knowledge stays when the engagement ends.

Every engagement is scoped, priced, and finished, with an end date instead of an open-ended retainer.

- AI & automation · agents, retrieval, evals
- Application · running in production
- Platform · pipelines, CI/CD, delivery
- Infrastructure · cloud, network, identity

Security · wraps every layer

## Security and compliance, engineered in.

Governance, risk, and compliance shape our first architecture decision and every one after it. This is technical GRC. We understand compliance deeply and engineer the systems that satisfy it. We've owned that work where an audit is a fact of life: designing controls that survive scrutiny, threat-modeling systems before they ship, and keeping cloud and AI inside boundaries that hold. When a company needs one partner accountable for both how a system is architected and the proof that it's safe, that's the seat we take.

- governance & controls design
- risk assessment & threat modeling
- compliance-ready, audit-tested architecture

- System & Organization Controls
- Information Security Management
- AI Management Systems
- Health Data Privacy & Security
- EU Data Protection Regulation
- Cybersecurity Framework
- Payment Card Data Security
- Critical Security Controls

SOC 2, ISO/IEC 27001 and 42001, HIPAA, GDPR, NIST CSF, PCI DSS, and CIS. Frameworks we build for and audit against: readiness, evidence, and architecture.

## Open source, in production.

Engineering claims are cheap. The work is public — read the code.

techpivot/terraform-module-releaser · on: pull_request · Actively maintained · v2.2.0

Terraform Module Releaser is a GitHub Action TechPivot builds and maintains in the open. It makes Terraform monorepos releasable: on every pull request it detects which modules changed and calculates each one's semantic-version bump from conventional commits; on merge it cuts per-module tags, releases, and documentation wikis scoped to just those directories. Zero-config, 100% GitHub-native, MIT-licensed, and compatible with GitHub Enterprise Server.

[Built for Terraform](https://www.terraform.io/) · [terraform-module-releaser on GitHub](https://github.com/techpivot/terraform-module-releaser)

[Read the case study](https://www.techpivot.com/work/terraform-module-releaser) · [View on GitHub](https://github.com/techpivot/terraform-module-releaser) · [Add this Action](https://github.com/marketplace/actions/terraform-module-releaser)

The release pipeline

on: pull_request

1. detect which modules changed in the monorepo
2. calculate each module's semver bump from conventional commits
3. comment the release plan on the pull request
4. tag + release on merge, scoped to each module's directory
5. generate per-module wiki docs + changelog
6. clean up tags for deleted modules

19 releases · shipping steadily since 2024

**Proof, not promises**

[220+ · GitHub stars · source: the repo](https://github.com/techpivot/terraform-module-releaser) · [19 · releases · latest v2.2.0 (Aug 2026)](https://github.com/techpivot/terraform-module-releaser/releases) · [MIT · license · self-hostable, no lock-in](https://github.com/techpivot/terraform-module-releaser/blob/main/LICENSE) · [Listed · on the GitHub Marketplace](https://github.com/marketplace/actions/terraform-module-releaser)

Plus dozens of dependent repositories and full GitHub Enterprise Server compatibility.

The repository lives under the [TechPivot](https://github.com/techpivot) organization on GitHub, and Mark Johnson maintains it as [@virgofx](https://github.com/virgofx), the developer handle he has used since 2011. His contributions across the ecosystem run from PHP framework internals to CI tooling.

## About.

Career arc: defense contractor, then enterprise software, then healthcare SaaS co-founder, to security engineering in-house, with TechPivot alongside.

![Mark Johnson, security and infrastructure engineer, San Diego](https://www.techpivot.com/assets/mark-johnson-techpivot-2x.CLDUjY69_ZPNOor.jpeg)

*Mark Johnson · San Diego, CA*

I'm Mark Johnson, and I run TechPivot. For more than twenty years I've been the person companies call when a system has to be secure, has to scale, and has to not go down.

Defense contractor to enterprise software to a healthcare SaaS company I co-founded. Different stakes, same job: build it right, then keep it running. Along the way: Northrop Grumman, ServiceNow, and a patient-portal platform I helped take from zero to production.

That work continues today, in-house, and TechPivot is the consultancy where a handful of client problems get that experience applied directly. The hands stay on real systems; the practice is where it compounds for clients.

B.S. Electrical Engineering, UC San Diego. I think about systems from the electrical layer up through the whole OSI stack: the failures that matter almost always live at the boundaries between layers, and that's where I work.

I write and open-source under [TechPivot](https://github.com/techpivot) and as [@virgofx](https://github.com/virgofx) on GitHub. It's all one person.

If your problem sits at the intersection of security, cloud, and software, that's exactly the work I want.

## Let's talk.

We take on a small number of engagements where judgment across security, infrastructure, and AI actually moves the needle. If that's the problem you have, we'd like to hear about it.

Direct email, no intake forms, no account managers. If it's a fit, you'll know quickly.

[Start a conversation](mailto:info@techpivot.com) · [TechPivot on GitHub](https://github.com/techpivot)

[info@techpivot.com](mailto:info@techpivot.com)

San Diego, California · Working with teams anywhere.

---

```json
{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@type": [
        "ProfessionalService",
        "LocalBusiness",
        "Organization"
      ],
      "@id": "https://www.techpivot.com/#organization",
      "name": "TechPivot",
      "description": "San Diego technology consultancy: security-first engineering across AWS cloud, infrastructure, software, and AI.",
      "url": "https://www.techpivot.com/",
      "logo": "https://www.techpivot.com/apple-touch-icon.png",
      "image": "https://www.techpivot.com/og/techpivot-1200x630.png",
      "areaServed": "US",
      "address": {
        "@type": "PostalAddress",
        "addressLocality": "San Diego",
        "addressRegion": "CA",
        "addressCountry": "US"
      },
      "knowsAbout": [
        "technology consulting",
        "AI engineering",
        "AWS architecture",
        "cloud engineering",
        "platform engineering",
        "DevOps",
        "Terraform",
        "Kubernetes",
        "security engineering",
        "compliance",
        "SOC 2",
        "ISO 27001",
        "fractional CISO",
        "fractional CTO"
      ],
      "email": "info@techpivot.com",
      "founder": {
        "@id": "https://www.techpivot.com/#person"
      },
      "sameAs": [
        "https://github.com/techpivot",
        "https://www.linkedin.com/company/techpivot/"
      ]
    },
    {
      "@type": "Person",
      "@id": "https://www.techpivot.com/#person",
      "name": "Mark Johnson",
      "alternateName": "virgofx",
      "jobTitle": "Principal Security & Infrastructure Engineer",
      "image": "https://www.techpivot.com/assets/mark-johnson-techpivot-2x.CLDUjY69_ZPNOor.jpeg",
      "worksFor": {
        "@id": "https://www.techpivot.com/#organization"
      },
      "url": "https://www.techpivot.com/",
      "sameAs": [
        "https://github.com/virgofx"
      ]
    },
    {
      "@type": "WebSite",
      "@id": "https://www.techpivot.com/#website",
      "url": "https://www.techpivot.com/",
      "name": "TechPivot",
      "publisher": {
        "@id": "https://www.techpivot.com/#organization"
      },
      "mainEntity": {
        "@id": "https://www.techpivot.com/#organization"
      }
    }
  ]
}
```

Security-first technology consulting.

**Site**

- [Practice](https://www.techpivot.com/#practice)
- [Capabilities](https://www.techpivot.com/#capabilities)
- [Services](https://www.techpivot.com/#services)
- [Security](https://www.techpivot.com/#security)
- [About](https://www.techpivot.com/#about)
- [Contact](https://www.techpivot.com/#contact)

**Open source**

- [The work](https://www.techpivot.com/#open-source)
- [terraform-module-releaser](https://github.com/techpivot/terraform-module-releaser)
- [GitHub Marketplace](https://github.com/marketplace/actions/terraform-module-releaser)
- [Case study](https://www.techpivot.com/work/terraform-module-releaser)
- [@virgofx](https://github.com/virgofx)

**Connect**

[TechPivot on GitHub](https://github.com/techpivot) · [TechPivot on LinkedIn](https://www.linkedin.com/company/techpivot/)

[info@techpivot.com](mailto:info@techpivot.com)

San Diego, California

© 2026 TechPivot. A San Diego technology consultancy. Sole proprietorship of Mark Johnson. · Cookieless. Privacy by default.