Hugo Vicente
Technical Product Manager · Software Engineer
Computer Science and Engineering graduate from Instituto Superior Técnico. I work on networking, distributed systems, and observability, and I write the code behind the products I manage.
About
I'm a Computer Science and Engineering graduate from Instituto Superior Técnico, most recently a Product Manager Intern on Cloudflare Tunnel.
At Cloudflare I owned Protected Quick Tunnels, email authentication for accountless tunnels behind a single flag, and wrote the Wrangler support for it myself. Before that I administered 80+ Linux servers at IST and led an ML project on synthetic clinical data.
Outside work I build systems to understand them: TraceBloom, an observability and evals platform for LLM agents, and Go-VPN, a VPN written from the TUN device up. I'm looking for roles where product and engineering overlap.
Experience
-
Product Manager Intern
Cloudflare · Tunnel
- Owned Protected Quick Tunnels (
cloudflared2026.9.3): email authentication for accountless tunnels behind one flag (--allowed-mail). Set the design constraints and co-authored the launch post for Birthday Week 2026. - Implemented Wrangler support for Protected Quick Tunnels (cloudflare/workers-sdk#15639) and merged 9 PRs to the Cloudflare Tunnel docs.
- Restructured the cf CLI for Tunnel, Mesh, and Workers VPC, with 10+ production MRs merged.
- Shipped cross-platform named cloudflared services (Windows, macOS, Linux), validated in systemd and OpenRC test environments.
- Shipped custom hostnames for published applications in the new Zero Trust dashboard, plus fixes for certificate, Access JWT validation, and Security Analytics bugs.
- Ranked the Tunnel roadmap by ROI from customer interviews and community feedback, then shipped patches for the top findings.
- Wrote 5 PRDs across product, SDK, and billing, aligning Product, Engineering, Access, and Billing on each launch, including billing models for Tunnels for Platforms and Mesh GA.
- Scoped SSH-in-browser for Tunnel connectors and delivered the validated spec to engineering.
- Owned Protected Quick Tunnels (
-
Project Manager
JUNITEC
- Owned the technical roadmap for a synthetic clinical data platform: a modular ML pipeline combining CTGAN, TimeGAN, Synthea, and BioGears.
- Cut model experimentation costs by up to 70% by standardizing GPU training on Google Colab Pro, with a "train remotely, infer locally" workflow.
- Coordinated preprocessing, training, and validation over 500 Hz biosignal data from 6,000+ surgical patient records.
-
Software Developer
JUNITEC
- Built an AR educational platform for the Calouste Gulbenkian Museum in React and Firebase, shipping weekly to museum stakeholders.
-
System Administrator
RNL · Instituto Superior Técnico
- Administered and monitored 80+ Linux servers, including HPC clusters and virtualized environments.
- Built Grafana dashboards and automated monitoring workflows, cutting incident diagnosis time by 35%.
Projects
Protected Quick Tunnels
Share a local app on a public URL that only the emails or domains you list can open, with
no Cloudflare account. Cloudflare Access verifies the visitor's address with a one-time PIN,
and cloudflared checks it against rules that never leave your machine, so
Cloudflare learns that a tunnel is protected but not who you invited. Built as an intern
from PRD through engineering to production release, in cloudflared and Wrangler.
$ cloudflared tunnel --url http://localhost:8080 \
--allowed-mail [email protected] \
--allowed-mail '*@example.com'TraceBloom
Open-source observability and evaluation platform for LLM agents: a Rust OTLP collector, ClickHouse storage, a Next.js live trace viewer over SSE, TypeScript and Python SDKs, and an eval engine that flags prompt regressions. I owned all 31 architecture decisions across 7 milestones, with implementation by AI coding agents under my review. 250+ tests in CI; read-only database credentials and per-IP rate limits on the public deploy; 14 dependency CVEs and an IP-spoofing gap fixed before release.
Go-VPN
Point-to-point VPN that tunnels IP packets over UDP through a Linux TUN device, dropping
datagrams from unknown senders and shutting down cleanly on SIGINT and SIGTERM. CI runs
go vet, gofmt, race-detector tests, and a Docker build; a two-peer
Compose setup and a network-namespace lab cover end-to-end testing. Encryption is next.
Fault-Tolerant Blockchain
Team course project. A replicated ledger where a central sequencer orders transactions into RSA-2048 signed blocks, and nodes verify every client request and block signature. Optimistic execution, linearizable reads, and client failover across replicas.
KVS Subscription Server
Course project. A multithreaded key-value store in C where clients connect over named pipes
and subscribe to keys for real-time change notifications. Read-write locks on the store, a
semaphore-based producer-consumer queue for sessions, a worker thread pool for batch jobs, and
SIGUSR1 to disconnect all clients.
More on github.com/hugo-vicente11 ↗
Blog
Notes on what I'm building and learning: side projects, distributed systems, and product engineering.
All posts on the blog ↗
Skills & Toolkit
Programming Languages
- Go
- C
- Python
- TypeScript
- Java
- C++
- SQL
Infrastructure
- Linux
- systemd
- Docker
- GitHub Actions
- Grafana
- Prometheus
- OpenTelemetry
- ClickHouse
- PostgreSQL
- Cloudflare Workers
Frameworks & Protocols
- gRPC
- Protocol Buffers
- React
- Next.js
Languages
- Portuguese · native
- English · fluent
- Spanish · basic
- French · basic
Education
BSc in Computer Science & Engineering
Instituto Superior Técnico · Lisbon, Portugal
Get in touch
I'm always open to conversations about product, engineering, and building things that ship. The fastest way to reach me is email.