--- title: CV — Damián Búho — Senior Software Engineer description: Skills and work history of Damián Búho, tailored for Senior Software Engineer. lang: en --- > CV tailored for Senior Software Engineer. > **Open to opportunities · Remote · Full-time · Part-time · Contract** Currently residing in Uruguay. ## Contacts - [My LinkedIn](https://www.linkedin.com/in/damian-buho/?skipRedirect=true) - [damianbuho.57](https://signal.me/#eu/f-QVMzRKorOObrH1MlGaq0Bh2M0Cvi2-arDu4ed2Zzp3QBREq71Nu4ouZeshEopw) - [My ORCID](https://orcid.org/0009-0004-8579-7633) - [My Email](mailto:damian.buho@proton.me) - [Kiota](https://kiota.ch/damian-buho) - [My Gitlab](https://gitlab.com/damian-buho) - [My Github](https://github.com/damian-buho) - [My Mastodon](https://mastodon.social/@damianbuho) - [My Codeberg](https://codeberg.org/damian-buho) ## What I'm looking for - Problems worth solving - High stakes and adversaries - Reasonable autonomy ## What I'm avoiding - “AI for AI’s sake” startups - Gambling / predatory finance - Surveillance and data brokers Adult industry clients welcome ## What I offer - 20+ years of experience - Instincts for unconventional problems - Particular set of skills ## Remuneration - Market rate - Prefer stablecoins - Flexible with other methods - Not interested in equity ## Preferred positions - **[Platform Engineer](/cv/platform-engineer/)** — CI/CD and Developer Experience - **[Staff / Principal Engineer](/cv/staff-engineer/)** — Can do any archetype - **[DevOps Engineer](/cv/devops-engineer/)** — On-premise infrastructure - **[Tech Lead / CTO](/cv/tech-lead-cto/)** — Hands-on - **[Senior Software Engineer](/cv/senior-software-engineer/)** — Still know how to code ## Languages - **English** (C1) - **Russian** (Native) - **Spanish** (A1) — aprendiendo ahora - **Ukrainian** (A1) — розумію ## Timezone Available from UTC-8 to UTC+2. ## Countries ### Preferred - 🇨🇱 Chile · ☑ Work permit needed · ☑ Willing to relocate - 🇺🇾 Uruguay · ☑ Work permit needed · ☒ Willing to relocate - 🇨🇴 Colombia · ☑ Work permit needed · ☒ Willing to relocate - 🇦🇷 Argentina · ☑ Work permit needed · ☒ Willing to relocate - 🇵🇪 Peru · ☑ Work permit needed · ☒ Willing to relocate - 🇲🇽 Mexico · ☒ Work permit needed · ☒ Willing to relocate ## Skills | Skill | Level | | --- | --- | | System Design | 10/10 | | Data Modeling & Schema Design | 10/10 | | Microservices & EDA | 10/10 | | Linux | 10/10 | | PgSQL, MariaDB, SQLite | 6/10 | | Containers & Docker | 10/10 | | Debugging | 7/10 | | Code Review | 10/10 | | Documentation | 9/10 | | Static Analysis & Linting | 10/10 | | Profiling & Load Testing | 10/10 | | High Load | 5/10 | | Cryptography | 7/10 | | Quality Assurance | 7/10 | | Go | 5/10 | | Python | 6/10 | | TypeScript & JavaScript | 6/10 | | Bash & Shell Scripting | 9/10 | | Rust | 4/10 | | PHP | 10/10 | | Ruby | 4/10 | | Crystal | 5/10 | | Authentication | 7/10 | | MongoDB | 6/10 | | Redis, Valkey, Memcached | 7/10 | | Kafka, RabbitMQ, NATS, MQTT | 6/10 | | Observability | 9/10 | | Make & Makefiles | 9/10 | | Accessibility Audit | 6/10 | | SEO, GEO, Web Analytics | 9/10 | | Application Security | 7/10 | ## Relevant experiences > Some details are omitted for privacy; I can disclose them in person. ### Chief Technology Officer at stealth startup for ~3 years in around 2016 #### What I did - Built a system that prevented adblockers from … blocking ads - Our product processed existing advertisement inventory in real-time, making it unblockable, without damage to RTB/VAST performance and loss of conversion - Designed the architecture, developed core code, managed developers, Ops, UX and QA specialists - Dealt with CI/CD, built pipelines, migrated from delivery via Debian packages to containers - Studied the life patterns of a local AdBlock list maintainer and timed our updates to the hours when he couldn’t react, which is a totally normal thing to do #### What I achieved - A working product - A system that could process millions of users on the cheapest hardware - A place in hell, probably, for making the internet worse #### What I learned - A lot about the intricacies of RTB, DMP and other evil technologies - How to build high-load things that must respond in under 25 ms #### Skills - [Containers & Docker](/skill/containerization/) - Stakeholder Management - Engineering Management ### Chief Technology Officer at stealth startup for ~2 years in early 2010s #### What I did - Made a version of Yelp for the local market - Designed the architecture and framework; managed developers, Ops, UX and QA specialists as hands-on CTO - Set up infrastructure and CI/CD #### What I achieved - Launched the project - Moved on #### What I learned - Big data makes you do wild things: I once had 7 versions of the same data structure in one collection ### Lead Developer at stealth startup for 6 months in early 2010s #### What I did - Designed and developed a system for tracking visits, clicks and leads for affiliate programs - Zero-effort integration: any e-commerce site could gain affiliate functionality with a couple of hooks #### What I achieved - Besides project completion, I made an algorithm that coarsens data depending on the server load - The bigger your site is, the coarser the data (up to a limit), so response time and resource consumption stayed near-constant - We successfully processed statistics with mixed precision after collection - Data scientists probably do it every day now, but in the early 2010s they hadn’t been invented yet - The idea was inspired by time dilation in EVE Online #### What I learned - How to respond fast - Data structures are not holy artifacts - Dirty data is better than no data at all #### Skills - [PHP](/skill/php/) - Engineering Management - [System Design](/skill/system-design/) - [PgSQL, MariaDB, SQLite](/skill/sql-databases/) - Redis, Valkey, Memcached - TypeScript & JavaScript ### Lead Developer at government contractor for ~1 year in early 2010s #### What I did - Built and managed a separate department: developers, sysops, QA and even one tech writer - Led development of an integrated system for interaction between citizens and city services / utilities - Payment processing, emergency handling, and compliance and regulation control across a whole bunch of small departments, companies, vendors, etc. #### What I achieved - Despite all the efforts of the government customers, we successfully delivered it, and as far as I know, it still works - Got promoted to CTO #### What I learned - The only thing less efficient than a typical municipality is the same municipality at night #### Skills - Engineering Management - [PHP](/skill/php/) - Microservices & EDA ### PHP Developer at stealth startup for 6 months in early 2010s #### What I did - Developed a “retail” closed-source PHP CMS/CMF - Brought my print media experience to digital publishing: one of the first CMSes with drafts, notes, collaborative editing and real workflows (with sign-offs) #### What I achieved - Dragged it to the first release and real consumer sites - Realized that open source is the future #### What I learned - How to make something for specific audiences — other developers, media and SEO people #### Skills - [PHP](/skill/php/) - [System Design](/skill/system-design/) ### Lead Developer at stealth startup for ~1 year in late 2000s #### What I did - Developed a system that allowed investors to buy and sell shares in various non-traditional assets - In short, you could “IPO” your business, website, or even a cow, if you wanted. Any income source. - We had dividends, splits and merges, direct exchange between assets and a lot of other machinery for all the roles - Something like modern tokenization, but centralized and in the pre-Bitcoin era - The founder came with this raw idea and I brought this project to production, solo #### What I achieved - Made a fully working product with many ideas ahead of their time (we even had proto-passkeys!) - Chose a perfect time to quit #### What I learned - How to build systems working with money - What to do when your client decides to build a Ponzi scheme based on your beautifully crafted exchange system, and gets himself in prison for fraud - How to spot exploitable parts of systems #### Skills - [PHP](/skill/php/) - TypeScript & JavaScript - [Application Security](/skill/application-security/) - Stakeholder Management ### Software Developer at small SEO company for 6 months in late 2000s #### What I did - Developed and supported a machine that stole and rewrote content on an industrial scale, before that became grounds for an IPO - Worked on a large automated doorway/satellite network, link farming and other SERP manipulation stuff #### What I achieved - Nothing to be proud of, but technology-wise, this system was interesting: all the stealing was done in real time - We had multiple nodes that worked transparently for the victim and the visitor alike #### What I learned - There is an obscene amount of money in making things worse for everyone. But you shouldn’t do it. - How to make something for robots instead of people. Ironically, after almost 20 years, this skill is relevant again. #### Skills - SEO, GEO, Web Analytics ## Other experiences ### CI/CD Lead at fintech company in Asia for ~4 years in early 2020s #### What I did - Developed and maintained Docker images for a huge fleet of microservices (more than 500) - Designed and implemented CI pipelines (Jenkins and Makefile) - Built a unified CI library that freed developers to focus on their code - Developed standards and automation workflows - Supported internal DevEx services #### What I achieved - Worked long enough to see my optimized and polished images in production - Worked even longer to see people start doing the same work from scratch, because corporations - Got a serious skills upgrade #### What I learned - Leveled up in containerization, pipelines, workflows, platform engineering - Learned the nuances of payment processing and fintech #### Skills - [Containers & Docker](/skill/containerization/) - Release Engineering ### Fractional CTO at leathercraft workshop for 7 months in early 2020s #### What I did - Got involved in small-scale leathercraft production for some time - Developed a *tailored* ERP/CRM system with stock management and automatic pricing (from blueprints and supplier inputs) - The software traced the full product lifecycle: by the item serial number, you could tell where every thread or button came from - Even integrated a laser engraver (you still need a human to move things though) #### What I achieved - Developed an insatiable passion for hardware - Renovated the workshop - Made some weird furniture #### What I learned - How the leather industry works - How to build workshops (I made another one later) - How far our intangible IT bullcrap is from real physical production #### Skills - Engineering Management ### “Analyst” at small outlet for 11 months in late 2000s #### What I did - Surveillance and corroboration - Penetration testing - Research and analytics - Deception and exploiting trust - Background checks on slow days #### What I achieved - Had seven different personas with perfectly crafted legends and almost kept my sanity - Found a mole in a client’s sales department and brought him to justice - Investigated a couple of embezzlements - Gained 4 kg watching people do nothing exciting - Sorted a lot of garbage #### What I learned - How to think like a bad guy: seeing liabilities, opportunities, attack vectors and how to counter them - How to do open-source intelligence (OSINT), gather/hoard and analyze information - How deeply unprotected we all are on a physical level, and how often we focus on cybersecurity and forget that concierges can be bribed - You always have to say “competitive intelligence” instead of “corporate espionage” for legal reasons #### Skills - Intelligence - [Application Security](/skill/application-security/) ### Jack of all trades at local outlet for ~1 year in around 2005 #### What I did - Produced a small local newspaper - Did everything: writing, typography, design, pre-press, web-version #### What I achieved - A dozen issues published without issues - One fight with the corrupt cops on election day #### What I learned - What kerning is, how much one visual minute is, and how to make things legible - How to run print media or any kind of massive paper operation (which one day will be relevant again) #### Skills - Graphic Design ## Featured projects ### [The Projectfile Specification](/project/projectfile-specification/) The Projectfile specification describes “projectfile”, a simple hierarchical file about a project. It can be YAML, TOML or JSON. There is a CLI tool that hides formats from you, reads and writes keys and supports includes, interpolation and other interesting stuff. ### [Spiderlint](/project/spiderlint/) - 600+ distinct checks - Fact/rule engine: you can override everything and create your own rules declaratively - Page-specific and site-specific checks - A11Y, SEO, GEO, Lighthouse - Validations for every used format - Even uncompressed images! - Well-known files, TLS, HTTP Headers, Semantic Markup - Can and should be self-hosted ### [Report Relay](/project/report-relay/) Accepts 16 report formats and sends them to stdout or an OpenTelemetry collector as logs. - CAA IODEF incident reports - Cross-Origin-Embedder-Policy and Cross-Origin-Opener-Policy reports - Browser crash and Deprecation reports - Legacy CSP report-uri, HPKP pin validation failure and Expect-CT reports - Content Security Policy and Document Policy reports - Permissions Policy and Subresource Integrity reports - Browser intervention and Network Error Logging reports - SMTP TLS reports ### [Ignorelint](/project/ignorelint/) - Validates 20+ different kinds of ignore files - Automatically fixes errors that could be fixed deterministically - Informs about dead rules ### [B19 / Ubuntu](/project/b19-ubuntu/) B19 is a set of conventions and slightly opinionated tools, with Ubuntu as its foundation and around 100 images built on it. Healthchecks, tests, benchmarks, reports, commands, bootstraps, everything is pre-set and extremely extendable. Perfect for creating in-house manageable image inventories. ### [Uwindaji Kit](/project/uwindaji-server/) Uwindaji can automatically find facts about intelligence targets, keep them tamper-proof, maintain provenance, monitor developments. You specify a person or organization, you get a report from multiple distributed tools that work together. Every domain, email, phone number and address triggers “specialist” services (non-LLM), which enrich them and share findings between themselves. You can analyze it manually or use it with agents as MCP/CLI (_LLMs love to play spies_). Currently this system monitors and prevents [sanctions compliance violations.](https://www.techradar.com/pro/security/russian-websites-could-soon-be-easy-pickings-for-hackers-as-security-certificates-expire-banks-emails-and-government-systems-all-potentially-at-risk) ### [Doomsday Clock Exporter](/project/doomsday-clock-exporter/) Doomsday Clock Exporter regularly fetches the current Seconds to Midnight value from the [Bulletin of the Atomic Scientists](https://thebulletin.org/doomsday-clock/) and makes it available to your Prometheus. You can set up automations like “cancel all my cloud subscriptions if the value drops below 30 seconds”. Or just keep it as a reminder that nothing really matters.