WORK ABOUT SKILLS CONTACT
Infrastructure · Security · Identity

Wilfredo Laboy
builds systems that hold.

Head of Infrastructure & Security · Senior Systems Engineer · MDM Endpoint Engineer at Hyper Nimbus
Contract role · July 2026 to present · Remote

Systems Engineer: cloud infrastructure, security and identity for AI products. Wilfredo Laboy builds and secures the cloud foundations behind AI products, working across AWS infrastructure, identity and access, CI/CD and compliance. He has helped take products from prototype to public launch for clients in government, e-commerce, financial services and hospitality.

Building tools and games that give creative teams space to play and actually enjoy the process.

Get in touchSee the work

About

Since July 2026, Wilfredo has been a contract Systems Engineer at Hyper Nimbus, an AI company. He was brought in for infrastructure, security, CI/CD and identity on a government digital-services platform. His role soon grew to cover several products on shared AWS infrastructure: an AI assistant for a consumer e-commerce brand, a lead-generation platform for financial-services agents, and Hyper Bricks, an AI workspace that launched publicly in October 2026.

His work runs from single sign-on and least-privilege access to production troubleshooting, security reviews, payments integration and compliance policy. He works closely with a distributed engineering team, and much of his day-to-day work is done alongside AI coding agents. He believes in checking the real state of a system before changing it, and in giving everyone, himself included, only the access they need.

Track record

2019 – 2026

Senior Engineer, End User Support · John Wiley & Sons

  • Sole architect and administrator of the enterprise Mac and cross-platform endpoint platform for a global workforce of 1,000+ employees, across Jamf Pro, Mosyle Business, and Microsoft Intune.
  • Led two full-fleet MDM migrations as staged rollouts with validation gates and rollback paths, with zero business disruption. The first saved about $100K a year.
  • Built zero-touch provisioning through Apple Business Manager: hardware ships straight to employees and configures itself on first boot.
  • Rolled out CrowdStrike Falcon endpoint security across macOS, Windows, iOS, and Android, and wrote the Bash automation library the fleet ran on.
2015 – 2018

Mac & Endpoint Administrator · Infor

  • Administered Jamf Pro for a global software company's Mac fleet: configuration profiles, policies, software deployment, inventory, and compliance.
  • Owned the full Mac device lifecycle, from enrollment to decommission, and served as the escalation tier for endpoint issues.
  • Wrote the internal documentation for Mac workflows that the support team worked from.

Selected work

October 2026

Hyper Bricks launch

  • Helped launch Hyper Bricks, an AI workspace built from modular "bricks", to the public.
  • Built a secure Stripe webhook receiver for subscriptions. It verifies every signature and never logs customer payment details.
  • Before launch, audited the product for any client data in public areas. Found and fixed an issue in the public web bundle the same day it was found.
  • Reviewed sign-in and access changes ahead of the launch.

Identity and access

  • Designed and built single sign-on, with automatic user provisioning, from Google Workspace to AWS IAM Identity Center.
  • Set up role-based groups and scoped admin roles in place of blanket super-admin access.
  • Required multi-factor authentication on every human cloud-console account, enforced through policy as code.
  • Keeps an inventory of every credential (owner, storage, expiry and rotation, never the values). Runs regular access reviews and cleans up unused high-privilege access.

Security engineering

  • Reviews code and infrastructure changes for security and privacy, including third-party integrations, SAML login, OAuth scopes and data retention.
  • Ran a dependency-vulnerability cleanup across release branches and added a CI check that blocks high and critical advisories.
  • Found that Kubernetes network policies were not being enforced and wrote the rollout plan to fix it.
  • Leads incident investigations: log analysis, root cause, written reports and follow-up actions.

Compliance and policy

  • Wrote the company's Data Retention & Disposal Policy and checked it against the actual code and cloud configuration.
  • Supports SOC 2 readiness, including the access-control evidence and a list of gaps to fix.
  • Works on Google OAuth restricted-scope verification and the related security assessment.
  • Owns the product Terms of Service updates and contributes to the privacy policy and subprocessor list.

Platform and operations

  • Supports production on AWS (EKS, load balancers, VPC networking) across several product lines.
  • Diagnoses production problems, from memory leaks to expired tokens, and gets them to the right owner.
  • Fixes CI/CD pipelines and sets up safe rollbacks before deployments.
  • Sets up partner integrations with hospitality and payments platforms.

Skills

Cloud

AWS (IAM, IAM Identity Center, EKS, VPC, ALB, Lambda, Secrets Manager, SES, CloudTrail), Kubernetes, Terraform

Identity

SSO (SAML), SCIM, Google Workspace administration, OAuth, Cognito, MFA, least-privilege design

Security and compliance

Security code review, incident response, SOC 2, data-retention policy, dependency scanning, secrets management (1Password)

DevOps

GitLab CI/CD, merge request review workflows, release management

Development

Node.js, TypeScript, React, webhook and API integrations (Stripe)

Ways of working

AI-assisted engineering with AI coding agents, remote teams, clear written documentation

Working principles

  1. Check the real state of a system before acting on it.
  2. Give everyone, me included, only the access they need.
  3. Treat any credential that has been exposed as compromised, and replace it.
  4. Prefer reversible, reviewable changes over direct edits to shared systems.
  5. Correct my own mistakes openly, where the original was posted.

Beyond the day job

Wilfredo also builds games. He is the Founder & Studio Director of Crescent Cove, an independent game studio, and the Technical Director at Rider Kick Studios. The games, tools, and devlogs live over at Crescent Cove.

Contact

Consulting, collaboration, or just talking shop about infrastructure, security, and identity, my inbox is open.

info@wilfredolaboy.com

LinkedIn · GitHub

© 2026 WILFREDO LABOY · ALSO: FORGE AT CRESCENT COVE, INDIE GAMES & TOOLS →