Alex Duarte

Field CTO, Wiz at Google

Between the customer and the code.

Field CTO at Wiz, now part of Google Cloud, working with strategic customers and product engineering across Login, RBAC, Projects, Service Catalog, Workflows and Federal. At Wiz since before $100M ARR, through $1B and the Google acquisition. Outside work, I build and run my own software products.

Get in touch
How the work connects On the left, the people I work with: CIOs and CISOs, Fortune 50 enterprises, top AI companies, federal agencies, healthcare and financial services. On the right, what I build with: MCP, Claude Code, Codex, Cursor, OpenCode, Gemini, and a K3s and Argo CD platform. Both connect through me. CIOs and CISOs Fortune 50 Top AI companies Federal and FedRAMP Healthcare Financial services MCP Claude Code Codex Cursor OpenCode Gemini K3s and Argo CD Alex

About

I'm a Field CTO at Wiz, now part of Google Cloud, covering Login & Authentication, RBAC, Projects, Service Catalog, Workflows and Federal. The work sits between our strategic customers and the engineers who build the product: rebuilding a customer's environment, reproducing the issue, finding the root cause, and working with engineering on the fix. What we learn in the field then feeds back into the product.

I joined Wiz in April 2022, before it reached $100M ARR, and have worked through each stage since: Cloud Security Architect, team lead, Manager of Technical Account Management for the Northeast Majors region (8 direct reports), and Field CTO. Along the way Wiz passed $1B in ARR and was acquired by Google.

Customers range from Fortune 50 enterprises and top AI companies to healthcare, financial services and federal agencies. I also administer Wiz's FedRAMP back office, and spoke at Gartner C-level Communities events for CIOs and CISOs in 2025–2026.

Outside work, I build. Through Xylems Solutions LLC I run four apps (Beanstalk, QueueCraft, Squish Financial and MFM Tracker), deployed through a K3s and Argo CD GitOps platform. AI coding tools like Claude Code, Codex and Cursor are part of how I work, and QueueCraft has an MCP endpoint so they can pick up tickets.

Self-taught, and bilingual in English and Spanish.

Experience

Wiz, now part of Google Cloud

Joined April 2022, before Wiz reached $100M ARR. Stayed through $1B+ ARR and Google's $32B acquisition (closed March 2026).

  1. Field CTO: Login & Authentication, RBAC, Projects, Service Catalog, Workflows, Federal

    • Highest point of technical escalation for six platform domains across a rotating book of strategic accounts: Fortune 50 enterprises, top AI companies, healthcare, financial services and federal agencies.
    • Rebuild and reproduce complex customer environments, isolate root cause, and drive fixes with product engineering, then bring that field context back to how engineering, product and support prioritize.
    • Helped lead the redesign of the Projects experience and drive the success of the Tenant Manager product, turning field patterns into shipped features and closed gaps.
    • Back-office administrator for Wiz's FedRAMP environment; partner on federal requirements across authentication, access control and tenancy.
    • Speaker at Gartner C-level Communities executive events (2025–2026) and at AWS re:Inforce 2025 with the Amazon Cognito and Amazon Neptune teams.

  2. Manager, Technical Account Management, Northeast Majors / Enterprise

    • Led a team of 8 Technical Account Managers for the Northeast Majors region.
    • Program-managed account escalations across product, engineering and support to coordinated, on-time resolutions.
    • Built customer success plans with measurable KPIs and reported progress to customers and leadership.
    • Partnered with sales, renewals, operations and marketing on strategic account plans for retention and expansion; recruited, mentored and developed TAMs.

  3. Senior Cloud Security Architect, Majors

    • Team lead for the East Coast Cloud Security Architects and mentor for new hires.
    • Moved to the Majors segment to drive full platform adoption with Wiz's largest customers.
    • Wrote the playbook of common customer technical challenges and how to solve them, used to onboard new architects.

  4. Cloud Security Architect

    • Joined during hypergrowth; resolved customer technical issues with engineering, built custom integrations, and represented customers on roadmap and process.
    • Built risk-mitigation plans with account teams and made sure customers got measurable security outcomes from their deployment.

Xylems Solutions LLC

Founded as Rising Phoenix Services in 2011 (web development, hosting, IT consulting). Now the parent of Rising Phoenix and Xylems.dev, my software studio.

  1. Founder

    • Build and run four products: Beanstalk, QueueCraft, Squish Financial and MFM Tracker.
    • Built and run the K3s and Argo CD GitOps platform they deploy to.

Earlier career

  1. 2019 – 2022

    Director of Computing Operations, NIIMBL

    Led the IT team and owned security, risk and compliance for the National Institute for Innovation in Manufacturing Biopharmaceuticals, including NIST SP 800-53 rev 4 and FedRAMP alignment.

  2. 2018 – 2019

    Cloud Support Engineer, Amazon Web Services

    Reproduced customer issues in purpose-built AWS test environments; trained new hires and sat on hiring panels.

  3. 2015 – 2018

    Linux Systems Administrator, Computing Support Specialist, University of Delaware

    Ran a 70+ node research computing cluster for five research groups; earlier led a three-intern help desk for 500 staff.

  4. 2010 – 2019

    IT Manager, Network Support Technician, Fraunhofer USA Center for Molecular Biotechnology

    Grew from technician to IT manager: built the VMware and Hitachi SAN infrastructure and owned the IT budget; returned part-time on contract (2017–2019) to lead vSphere 6.5 and Windows Server 2016 upgrades.

Speaking

Personal projects

Four products under Xylems Solutions, deployed on the platform below.

QueueCraft In daily use

A work tracker built for humans and coding agents. Agents connect over an authenticated MCP endpoint to pick up issues, open branches named after the ticket, post handoff notes, and ask each other for review. Each stored agent has its own budget and run history.

Notes: The MCP server is the product. Claude Code and Codex use it to track changes across my repos.

React, PostgreSQL, MCP (JSON-RPC), WebMCP, TOTP MFA, Capacitor iOS, K3s

Squish Financial Live

A budgeting app for people who want a calm, encouraging view of their money. It syncs bank accounts through Plaid, tracks budgets and goals, and projects where you're headed.

Notes: An AI coach on the Claude API, with the model chosen by plan: Haiku on the free tier, Sonnet on paid plans. It only speaks up when asked.

React, TanStack, Express, Supabase, Plaid, Claude API, Capacitor iOS

Visit squishfinancial.com

Beanstalk Live, web and iOS

A family chores app. Kids earn points, unlock achievements and spend in a prize store the parents stock; parents set recurring chores and approve rewards.

Notes: Merges to main deploy automatically: tests, a Trivy scan that blocks fixable criticals, a GitOps tag bump, an Argo CD sync, then an iOS over-the-air bundle published only after the new API reports its commit.

TypeScript, Turborepo, Express, PostgreSQL, Capacitor iOS, CircleCI, Argo CD

MFM Tracker Live

A tracker for high-risk pregnancies. Log blood pressure readings and timed kick counts, get clear guidance when a session comes up short, and send your maternal-fetal medicine team a weekly report you've reviewed first.

Notes: Built for my own family, with MFA and a report the patient reviews before anything reaches a clinician.

Node, PostgreSQL, PWA, MFA

Visit babytracker.xylems.dev

The platform they run on

Everything above runs on a K3s cluster, declared in one Git repository and reconciled by Argo CD.

  1. Push

    Every change starts as a PR named after its QueueCraft ticket.

  2. Build

    Self-hosted CircleCI runners inside the cluster build the image; gitleaks, kubeconform and yamllint gate the manifests.

  3. Scan

    Trivy scans the image and blocks the release on fixable critical CVEs.

  4. Publish

    The image goes to GitHub Container Registry and CI commits the new tag to the GitOps repo.

  5. Sync

    Argo CD (app of apps) sees the change and rolls it out to K3s.

  6. Verify

    Health checks confirm the running commit before mobile bundles publish; Gatus and Prometheus alert if anything drifts.

Cluster
K3s, bootstrapped with Terraform; MetalLB, Traefik, NVIDIA GPU device plugin
Delivery
Argo CD app-of-apps, Argo CD Image Updater, CircleCI self-hosted runners, GHCR
Secrets
Self-hosted Infisical with the Kubernetes operator; SOPS + age via ksops
Edge
cert-manager with Let's Encrypt, external-dns, Traefik ACLs
Observability
Prometheus, Alertmanager, Grafana, Loki, Grafana Alloy, Gatus
Data and automation
PostgreSQL 18, n8n with a custom Python runner and Ollama nodes

Next: a dedicated inference node for local models, running an open-source agent harness, with room-aware Home Assistant voice satellites on top.

AI toolchain

The tools I use most days, and what each one is for.

ToolHow I use it
Claude CodePrimary agent for multi-repo work: planning, refactors, CI and deploy scripts, with CLAUDE.md files and project memory in each repo.
CodexParallel tasks and second opinions; QueueCraft's first agent integration was built for it.
CursorIn-editor work when I want to drive the change myself, line by line.
OpenCodeOpen-source harness I use to compare models side by side, and the base for my local-model setup.
Gemini and Vertex AILong-context reading and Google Cloud work; Vertex AI for model access inside GCP.
Claude APIProduction inference in Squish Financial, with the model chosen by plan.
MCPI build MCP servers (QueueCraft, a Vikunja bridge) so agents can act on real systems with scoped tokens.
Local modelsOllama in n8n automations today; a dedicated Apple Silicon inference node next.

Skills

AI engineering
Claude Code, Codex, Cursor, OpenCode, Gemini, Vertex AI, Claude API, MCP servers, Ollama
Security
Cloud security (CNAPP, CSPM), Identity and SSO (SAML, OIDC, SCIM), RBAC and multi-tenancy, FedRAMP, NIST SP 800-53, Vulnerability management
Cloud and platform
AWS, Google Cloud, Azure, Kubernetes (K3s), Argo CD, Terraform, Docker, CircleCI
Build
TypeScript, React, Node.js, Python, PostgreSQL, PHP, Bash
Field leadership
Executive briefings, Technical escalations, Customer-to-roadmap advocacy, Team leadership

Education

  • Delaware Technical Community College
    Computer Information Systems coursework, 2011 – 2012
  • St. Georges Technical High School
    Web and Print Technology, 2007 – 2011

Certifications

  • Wiz Certified Cloud Fundamentals
    Wiz, 2025

Languages

  • English (native)
  • Spanish (native)

Contact

For Field CTO roles, speaking, or a conversation about agents in the enterprise, send a message and I'll reply by email.

Download resume

One quick check that you're a person, then the PDF downloads.