CV — Serhii Budiak

01 The man

Name Serhii Budiak. Pronounced Bood-yak. Будяк, Ukrainian — thistle.

Located Calgary, Alberta. Since 2022.

Background Sixteen years across critical infrastructure — energy, healthcare, government, telecom — on four fronts: Ukraine, Croatia, the wider EU, and North America. Eight of them operating the network of Kyiv City Municipality; currently guiding a VMware-to-Nutanix migration across Eastern Europe. Calgary is the base, not the boundary.

02 Selected work

Five that mattered.

Kyiv 2014 – 2022 Critical infrastructure · municipal

Server rooms where failure made the headlines, not the ticket queue.

Eight years operating the network of a capital city through annexation, blackouts, and a war that ran no change windows. The systems that held weren’t the ones with the largest budgets. They were the ones run by people who had practised failure on a quiet Tuesday, so they knew what to do on a loud one.

United States 2023 – 2024 Health-tech SaaS · HIPAA-aligned

Built to pass the audits of the hospitals it sells to.

Engaged as the startup’s architect — not by the hospitals. I built a scalable, HIPAA-aligned platform designed to clear the security requirements of at least two of the top-five US hospital networks, which are the company’s customers and its auditors. It passed every review they ran.

Ukraine National scale Tax authority · distributed architecture

A national system that outlives any one data centre.

Designed a distributed architecture for a national tax authority, split across multiple data centres for resilience and continuity. The point was never a single flagship site — it was that no single site could take the service down.

Croatia Backbone telecom Internal IT · ISO 27001

Rebuilding a tier-1 carrier from the inside, then passing the audit.

Took part in rebuilding the internal IT of a backbone telecom provider and carried it through an ISO 27001 audit. On the operator’s side of the table — the systems had to actually run, not just document well.

Ontario Ongoing Government · modernisation

Dragging a 1990s design into a threat model that’s thirty years newer.

Securing government organisations in Ontario — moving them off architecture built in the 1990s onto something that stands up to how attackers actually work now. Current, ongoing, unglamorous, necessary.

03 Also building

Tools I run, not pitches.

04 Credentials

Listed because someone always asks.

The work is on the services page.

Plus: ISACA & (ISC)² member. NSE4 (Fortinet), Scality Architect, and a second HPE ASE — vendor-issued, no credly. Working frameworks: HIPAA, HITRUST, SOC 2, NIST 800-53/171, ISO 27001, GDPR, PIPEDA, PIPA.

05 Contact

Email [email protected] — no form, no autoresponder. You get me.

PGP Available on request. Send an email and I’ll reply with the public key.

Mailing Calgary, AB. Specific address on request.

Signal After the first email.

06 Colophon

Typefaces A grotesque for the headlines, Newsreader for ledes and body, IBM Plex Mono for the budiak· wordmark and labels. Self-hosted.

Palette Limestone paper #E9EBEE · ink #15191D · signal blue #2E6BE6, with dark plates #0C0F12 for punctuation. One signal colour.

Hosting Static HTML. Nginx. No analytics. No JavaScript framework.

Entity Budiak Security Inc. Calgary, Alberta.

Source Hand-written. No AI illustrations, no stock photography, no generated copy.