Techstream · Brussels
Zero-touch delivery for regulated platforms, with the evidence to prove it.
Felipe Sotille, DevSecOps Architect & Engineer
Seventeen years in software engineering, shaped by work at SWIFT and Swissquote; most recently zero-touch release orchestration at SWIFT. I design the same for your platform, and I still ship code.
§ 01, In numbers
Source: dev.felipe.sotille.com
| 17+years in software engineering | 40+Java apps on zero-touch release orchestration | 300+VMs on orchestrated patching, 40% faster | 2.5bnfinancial records migrated to Oracle | 100k+concurrent users on a Kafka/Vert.x platform |
ExperienceSWIFT, Brussels (2019–2024; 2025–present) · Swissquote, Geneva (2024) · Eleven Sports, Lisbon (2018–2019)
Source: dev.felipe.sotille.com
§ 02, The gate
An example policy, simplified; not taken from any platform I have worked on.
OPA · Rego
Every release goes through the same gate. Agent-written code included.
package release.gate
default allow := false
allow if {
input.sbom.format in {
"CycloneDX", "SPDX"
}
input.artifact.signature.verified
input.scans.sast == "pass"
input.scans.dast == "pass"
# applies to agents too
input.review.human_approvals >= 1
}§ 03, Who
- Brazil·2008–2018
- Lisbon·2018–2019
- Geneva·2024
- Brussels·2019–2024, 2025–
Brazil, Lisbon, Geneva, Brussels.
I started in Brazil in 2008 writing Java for WPLEX, Metaway, Città and Allcance. In 2018 I led the backend at Eleven Sports in Lisbon: CQRS and events on Vert.x and Kafka, Kubernetes on GCP, hundreds of thousands of concurrent interactions. From 2019 I was at SWIFT in Brussels, taking the Identity Management monolith to microservices while the service stayed live.
In 2024 I led a 2.5 billion-record migration to Oracle at Swissquote. Since 2025 I have been back at SWIFT as DevSecOps Architect (Customer Success Architect), onboarding 40+ Java apps onto zero-touch release orchestration. I ship agent-first there, and my own coding-agent work runs on scoped tasks, with human review and the same security gates as human-written code. The longer version is on the about page.
§ 04, What I do
Fixed scope: 04, 05
Six things I do, and what you have at the end of each.
- 01
Release orchestration and secure-delivery platform design
A pipeline teams follow because it is cheaper than bypassing it.
- 02
Software supply-chain security and audit evidence
Evidence an auditor can read without a meeting.
- 03
Coding agents under governance
Scoped tasks, review rules and gates that treat agent code as code.
- 04
DevSecOps maturity assessment
A scored position per domain and a prioritised roadmap, in two weeks.
- 05
Workshops and coaching
A team that runs the pipeline without me, in two days.
- 06
Hands-on engineering
Java 21 and Spring at Swissquote, Vert.x and Kafka at scale.
§ 05, Open work
Apache-2.0
Nine frameworks, Apache-2.0, published under Techstream.
- 01
DevSecOps Framework
Sets out the principles, lifecycle and secure SDLC, with controls across the pipeline.
- 02
Secure CI/CD Reference Architecture
A threat model of the pipeline, with controls for SAST, DAST, SCA, secrets and pipeline IAM.
- 03
Release Orchestration Framework
Governs deployments and controls delivery across environments.
- 04
Software Supply Chain Security Framework
Covers the four places a supply chain is attacked: dependencies, build systems, artifacts, deployment environments.
- 05
DevSecOps Maturity Model
Five levels across eight domains, a scoring questionnaire and a gap analysis.
- 06
Compliance Automation Framework
Turns controls into policy as code, collects the evidence and keeps monitoring it.
- 07
DevSecOps Methodology
Four phases, assess, design, implement, optimise, with the playbooks for each.
- 08
AI DevSecOps Framework
Secures AI-assisted and agentic delivery: coding agents in pipelines, prompt-injection defence, agent authorisation.
- 09
Forensics & Incident Response Framework
Evidence architecture and investigation playbooks for CI/CD, cloud, supply-chain, identity and AI-agent incidents.
techstream-docs ties them together; techstream-learn holds the labs.
§ 06, From people I have worked with
Three of five, verbatim.
He does not merely automate tasks; he engineers repeatable, resilient delivery systems that improve deployment reliability, enforce secure coding standards and reduce operational risk.
His ability to solve complex technical challenges and deliver scalable solutions in such a demanding environment reflects a deep understanding of modern software engineering practices.
A technical reference and mentor for multiple engineering teams, frequently sought out for guidance on secure software delivery and release orchestration.
§ 07, Writing
Medium · Techstream Weekly · six volumes
What I have published, and what I am still writing.
- May 2026
Why Your AI Agent Is the Next SolarWinds: Supply Chain Security for the Agentic Era
- May 2026
The Four Layers of Software Supply Chain Integrity
- Apr 2026
The 4-Phase DevSecOps Transformation
Techstream Weekly
Platform, secure delivery and coding agents, once a week.
Five items every Friday, each with one line of fact and one line of opinion, for people who ship software on regulated platforms. Plus one thing from me.
9 October 2026
Agents under the same gates
Why the first question about coding agents in a regulated pipeline is not “how much” but “which gates”, and what changed this week in supply chain, platform and Java.
§ 08, Write to me
Tell me what you’re shipping and what’s in the way.
I read and answer every message myself.