Site Reliability Engineering
- SLI/SLO design and error budget governance
- Incident response and postmortem programs
- Observability stack design and on-call maturity
SRE · DevOps · Platform Engineering
Secure infrastructure, built to last.
SRE, DevOps, and Platform Engineering consulting with security at the foundation — not bolted on.
Expertise across
- Kubernetes
- Terraform
- AWS/GCP
- Zero Trust
- SOC 2
Services
Engineering excellence, secured from the ground up
We help teams build reliable, scalable infrastructure with security embedded into every layer — not added as an afterthought.
DevOps & CI/CD
- Pipeline hardening and supply chain security
- GitOps workflows and deployment automation
- Infrastructure-as-Code review and remediation
Platform Engineering
- Internal developer platforms and self-service infra
- Policy-as-code and secure-by-default templates
- Golden paths that embed security into every workflow
Our Approach
Security-first, always
Most consultancies treat security as a checkbox. We embed it into every layer of reliability and platform design.
From SLI design to pipeline hardening, every recommendation is evaluated through both an operational and security lens. The result: infrastructure that is resilient under pressure and defensible by design.
- 1
Assess
Map your reliability posture, attack surface, and operational gaps.
Harden
Apply security controls and reliability patterns at every layer.
- 3
Automate
Codify policies, pipelines, and guardrails into your platform.
- 4
Monitor
Instrument SLIs, detect drift, and iterate with measurable outcomes.
About
Why RootIn Security
We are rooted in foundational engineering and shielded by security — bridging the gap between operational excellence and information security.
Depth over breadth
Senior engineers on every engagement — no bench warming, no hand-offs to junior staff.
Security-native
Security is embedded in every architecture decision, not a separate audit phase.
Operational outcomes
Measurable reliability improvements — fewer incidents, faster recovery, stronger posture.
Gerardo Monterroza
Founder & Principal Consultant
Gerardo leads RootIn Security with hands-on SRE and DevOps experience across Terraform, Kubernetes, and AWS. He has engineered full-lifecycle Dev/Stage/Prod environments with 100% deployment parity, led Dynatrace-driven observability migrations, served as primary incident responder via incident.io, and managed edge infrastructure including Imperva WAF and F5 load balancers. Previously, he built organization-wide observability (CloudWatch, X-Ray, Prometheus, Grafana), cut MTTD by 35%, and reduced Terraform deployment failures from 12% to 1.5%.
TerraformKubernetesAWSDynatraceIncident responseImperva WAF / F5
Connect on LinkedInCase Study
Results that speak for themselves
Real outcomes from a recent engagement — anonymized to protect client confidentiality.
US-based SaaS platform
Challenge
Fragmented observability across microservices, a 12% Terraform deployment failure rate, slow incident detection, and inconsistent Dev/Stage/Prod environments.
Approach
Built an organization-wide observability stack (CloudWatch, X-Ray, Prometheus, Grafana), standardized VPC and RDS under composable Terraform modules, automated certificate renewal and resource cleanup with Python and Lambda, and established incident.io runbooks with SLO-driven response.
Outcomes
- 35% improvement in mean time to detect
- Deployment failures reduced from 12% to 1.5%
- 98% of incidents resolved within SLO windows
Engineering Blog
Latest insights
Practical perspectives on SRE, DevOps, and secure platform engineering.
TerraformDevOps
Why Your Terraform Root Module Is a Liability
Monolithic Terraform root modules create hidden risk. Here's how composable module structure cut deployment failures from 12% to 1.5% — and how to apply the same pattern to your infrastructure.
SREObservability
Designing SLIs That Actually Matter
Most teams track the wrong signals. Here's how to choose SLIs that reflect user experience and drive meaningful SLO conversations.
DevOpsSecurity
Hardening CI/CD Pipelines Against Supply Chain Attacks
Your pipeline is an attack vector. Practical steps to sign artifacts, pin dependencies, and enforce policy gates before anything reaches production.
Contact
Book a 30-minute consultation
Pick a time that works for you. We'll discuss your infrastructure challenges and how RootIn Security can help.
Prefer email? hello@rootinsecurity.com