Every time you tap a credit card, there’s a good chance the transaction passes through systems Zack Butcher helped secure. Zack is a founding and Principal Engineer at Tetrate, one of the earliest engineers on Google’s Istio project, co-author of O’Reilly’s Istio: Up and Running, and a co-author of NIST federal cybersecurity standards on zero trust. He visited Temple as part of our Distinguished Industry Speaker Series and sat down with Owl Byte to talk about his path from building websites at age 11 to shaping how government agencies secure their systems.
Key takeaways:
- Infrastructure is a force multiplier. Zack jokingly calls his work “plumbing,” but software low in the stack ends up powering hundreds of companies at once. His comparison: it’s a little like being Batman, because nobody knows you made it work.
- Service mesh in one sentence. Companies split big systems into small pieces to move faster, and those pieces then need to find and talk to each other securely and reliably. Istio does this by placing a proxy (Envoy) beside every application to observe and control traffic.
- What Google really teaches you. At scale, “a one in a million thing happens every day.” Beyond that: how to design reliable distributed systems, and how to work with teams whose priorities don’t match yours, which Zack calls a massively important life skill.
- Why he left to co-found Tetrate. Thirty companies told him they needed Istio to work differently than Google planned, which was market validation before he ever quit. His description of startup life borrows Larry Page’s phrase: “uncomfortably excited” every day.
- Zero trust, explained. Traditional security is a gate at the front of the building; once you’re in, everything is open. Zero trust puts a badge reader on every door, and if Bob’s badge tries to open your lab, that’s a strong signal something is wrong.
- From engineer to federal standards. Auditors followed NIST guidelines, so better security practices were rejected simply because they weren’t yet written down. Zack’s access control research with NIST grew into co-authoring the standards themselves.
- AI, honestly assessed. LLMs are “average machines,” so lean on them for undifferentiated work and invest in what makes you different. He expects a major AI-driven security incident in a regulated industry (a matter of when, not if), and sees agents automating business workflows as the big trend through 2027.
- Skills that will matter in five years. Code is how the job gets done, not why it exists. The value is in architecture, system design, and big-picture thinking, and working with AI is like directing a team of junior engineers. Security and infrastructure will always put food on the table.
- His advice for students. Get real-world experience through internships and co-ops (two years of co-op work helped him land Google right out of school). Join clubs like ACM and try ICPC, which is great practice for whiteboard interviews. Above all, go ask: the worst that can happen is someone says no.
