Rafael A. Sanchez

I lead the technology organization. I also build it.

Head of Technology at Biubox since 2018, a multi-marketplace e-commerce and 3PL operation across the United States and Mexico. The architecture, the engineering standards and the roadmap are mine, set in partnership with the CEO.

• Direction, with the CEO

  I set technology direction alongside the CEO: what we build, what we buy, and what we retire. The roadmap is mine to defend and mine to deliver.

• Standards that outlive any one engineer

  Every project ships with a governance document: architecture rules, security requirements, performance budgets, and the explicit points where work stops for a human decision. New engineers onboard against a documented environment, not tribal knowledge.

• Identity for the whole estate

  OIDC-authenticated access, least-privilege IAM and centralized secrets across every workload, with an audit trail on every mutation. The same discipline I bring to client identity work.

• The answer when an auditor asks

  SOC 2- and ISO 27001-aligned governance, and the compliance features Mexico's 2025 LFPDPPP privacy law required. Owning the platform means owning that answer.

Marketplace orders processed

530,000+, up 40% year over year

Infrastructure

130+ Terraform-managed AWS resources, OIDC-authenticated access, least-privilege IAM, centralized secrets, an audit trail on every mutation

Integrations

Liverpool, Coppel and Totalplay marketplaces, direct and through Mirakl, plus Shopify storefronts; FedEx, Estafeta, Envia and UPS carriers

Governance

SOC 2- and ISO 27001-aligned governance; compliance features built for Mexico's 2025 LFPDPPP privacy law

Selected systems

• eSuite operations platform

  FastAPI, React 19, TypeScript, DynamoDB, AWS Bedrock, ALB with OIDC

  Catalog and PIM, orders, offers, buybox intelligence, logistics, billing, and helpdesk in one platform. A server-rendered legacy portal and a React SaaS rewrite run side by side while the migration completes.

• Dynamic pricing engine

  Python, asyncio, DynamoDB

  Reprices offers across five marketplace channels in real time, with state-level pricing tiers for Mexico, margin floors, and buybox recovery logic.

• Marketplace integration suite

  Remix, Python, DynamoDB, AWS Bedrock

  A Shopify app plus independent pipelines for orders, catalog, and repricing. Product enrichment by Claude on AWS Bedrock. Incremental sync in under two seconds.

• AI development factory

  FastAPI, Claude Agent SDK, ECS Fargate, Terraform

  A multi-agent delivery pipeline on the Claude API: spec generation, implementation, review, and deployment with human-in-the-loop gates. 28 workflows, 8 governance rules.

• Infrastructure as code

  Terraform, AWS

  Private subnets, ALB with OIDC, SSM Session Manager instead of bastions, point-in-time recovery on every table, least-privilege IAM. 130+ resources and no console clicks.

• Marketplace mock API

  FastAPI, Pydantic

  260+ endpoints simulating ten marketplace and carrier integrations, with error and latency injection for testing failure modes offline.

• Texas Strikers

  FastAPI, Selenium, DynamoDB

  A registration bot and league site for my son's little-league team. Objectively over-engineered. The kids got their spots.

Enterprise identity, delivered end to end.

From design review to production cutover, with zero unplanned downtime across every engagement.

• Statewide citizen identity

  Delivered a citizen identity platform on PingOne Advanced Identity Cloud for a U.S. state government, working side by side with a Big Four systems integrator: journey architecture, scripted nodes, and federation design at citizen scale.

• Migrations without unplanned downtime

  Led Access Management migrations and upgrades, AM 6.x to 7.5 and on-premises to cloud-native, from design review through production cutover. Zero unplanned downtime, every time.

• The parts off-the-shelf configuration can't cover

  SAML 2.0, OAuth 2.0 (authorization code with PKCE, token exchange) and OIDC federation, custom authentication journeys and IdP adapter scripting, PingGateway integrations in Groovy including BFF-style session architecture, and Kerberos desktop SSO.

• Identity as code

  Configuration versioned, promoted, and deployed across environments with the Frodo CLI, so releases are repeatable and rollbacks are boring.

• Delivery rigor

  Solution design documents, architecture reviews, methods of procedure, and compliance checklists for HIPAA, GDPR, ISO 27001 and SOC 2, so security reviewers and stakeholders can stand behind every cutover.

• Through vendor consolidation

  Technical anchor for enterprise clients through the ForgeRock–Ping merger, guiding architecture decisions through platform change from the inside.

Platforms

PingOne Advanced Identity Cloud, PingAM, PingIDM, PingDS, PingGateway, Microsoft Entra ID, Active Directory

Protocols and methods

SAML 2.0, OIDC, OAuth 2.0, JWT, Kerberos, MFA, single sign-on, passwordless

Practices

Zero trust architecture, identity as code with the Frodo CLI, legacy-to-cloud migration, identity continuity through mergers and acquisitions

Five employers, one habit of staying hands-on.

1. 2018 – present

   Biubox / BIU Supply

   Head of Technology

   Austin, Texas

   Architecture, engineering standards, and roadmap for a 13-system AWS platform.

2. 2023 – 2026

   Ping Identity (formerly ForgeRock)

   Senior Technical Consultant, Identity and Access Management

   Austin, Texas and client sites

   PingOne Advanced Identity Cloud and the full ForgeRock stack for enterprise and public-sector clients.

3. 2021 – 2023

   Infosys

   Senior IT Infrastructure Architect

   Austin, Texas

   Microsoft Entra ID federation with PingOne Advanced Identity Cloud for a healthcare client; hybrid on-premises-to-Azure architecture.

4. 2000 – 2021

   IBM

   Senior Cloud DevOps Engineer and SRE; Cloud Operations and Reliability Manager

   Austin, Texas

   Led follow-the-sun SRE teams under HIPAA, GDPR, ISO and SOC frameworks, and ran the Watson-powered Sterling Fulfillment Optimizer. Earlier: Java and J2EE on WebSphere, Lotus Domino administration.

5. 1996 – 2000

   Unitech de Venezuela

   Senior Consultant

   Venezuela

Held firmly. Argued openly.

• Production is the only real environment.

  Development environments that don't mirror production are bug incubators. I build infrastructure that carries production's constraints from day one: network topology, IAM policies, failure modes included.

• If it can't be audited, it isn't done.

  Every mutation leaves a record: who, what, when, before and after. It's the difference between "something changed" and knowing exactly what changed and why.

• Configuration is code.

  Identity journeys, infrastructure, and pipelines are versioned, reviewed, and promoted the same way. Nobody clicks through a console to make a change that matters.

• Speed comes from discipline.

  The teams that ship fastest have the clearest constraints. Governance documents, typed interfaces, and async-first I/O are not slowdowns; they are what keeps velocity sustainable past the first sprint.

Let's talk about your identity platform, or the one you're about to build.

I work from Austin, Texas, and collaborate with teams in the United States and Mexico, in English or Spanish.