Linux Systems Engineer
~ I build and maintain cybersecurity platforms
Linux Systems Engineer
Nclose (Integrity360)
My TimelineTap an item
Afrihost, April 2021 to August 2023; Nclose, September 2023 to now.
About
Troubleshooting comes naturally to me, and technology is my passion.
I work in the SysOps team at Integrity360Its largest Security Operations Centre worldwide is in Cape Town, South Africa., one of the largest Managed Detection and ResponseA human-led, 24/7 cybersecurity service that combines security tools, threat intelligence and expert analysis to detect, investigate and neutralise cyberthreats. providers in South Africa. I co-run a large-scale SIEM as one of its core engineers and share responsibility for its day-to-day operation, from The OSI modelA conceptual framework published by ISO that standardises how computer systems communicate over a network, from physical hardware (layer 1) to user-facing software (layer 7).. I've completed 15+ forward-deployed projects for some of South Africa's largest retailers, financial services firms and even government. I love using tools and tech in creative ways to achieve my goals.
Off the clock
- Started
- 2021, support desk
- Learned
- Self-taught
- Mentored
- 20+ consultants & engineers
- Based in
- Cape Town, South Africa
Forward-deployed
0+
projects delivered · for enterprises and government
Forward-deployed projects: Forward-deployed work: collectors and pipelines configured remotely inside a client's own environment. More than 15 so far, for international and national enterprises and government in consumer finance, higher education, oil and gas, retail and hospitality.Search and log platform
~2PB
of data · about 2,000 laptops' worth
PB: petabytes: A petabyte is a million gigabytes. The SIEM holds roughly 2 PB of data, about as much as 2,000 laptops with 1 TB drives.Search and log platform
0kEPS
events per second · average ingest, across clients
EPS: events per second: How many security events (log lines, alerts, audit records) the SIEM takes in, reads and stores every second, on average across all the clients it serves. 200k EPS is roughly 17 billion events a day.Total managed nodes
0+
Linux nodes · hardened and managed with Puppet
Linux nodes: A node is a single server. I look after more than 350 of them, locked down against attack (hardened) and kept consistent with Puppet, a tool that sets up every server from one central place.Search and log platform
0
SIEM nodes · across 5+ search clusters
SIEM nodes: Elastic and OpenSearch are search engines built for huge volumes of logs. My team and I run 5+ clusters of them. The largest, with 220 nodes, is the SIEM (security information and event management): the system that gathers security records from across a business so analysts can spot and stop attacks.Forward-deployed
0+
projects delivered · for enterprises and government
Forward-deployed projects: Forward-deployed work: collectors and pipelines configured remotely inside a client's own environment. More than 15 so far, for international and national enterprises and government in consumer finance, higher education, oil and gas, retail and hospitality.Search and log platform
~2PB
of data · about 2,000 laptops' worth
PB: petabytes: A petabyte is a million gigabytes. The SIEM holds roughly 2 PB of data, about as much as 2,000 laptops with 1 TB drives.Tap for the next figure, hold one for details
Press and hold a figure for details
Total managed nodes
350+
Linux nodes
hardened and managed with Puppet
Linux nodes: A node is a single server. I look after more than 350 of them, locked down against attack (hardened) and kept consistent with Puppet, a tool that sets up every server from one central place.Search and log platform
SIEM nodes
220
of data
~2PB
average ingest
200kEPS
Forward-deployed
15+
projects delivered
for enterprises and government
Forward-deployed projects: Forward-deployed work: collectors and pipelines configured remotely inside a client's own environment. More than 15 so far, for international and national enterprises and government in consumer finance, higher education, oil and gas, retail and hospitality.Case studies
- 01
Phased Ubuntu to Debian migration of log collectors across three offices
How I moved a financial asset manager's log collectors to new Debian machines, one kind of log source at a time.
Read case study
- 02
Applying an updated ISM policy to existing OpenSearch indices
Why the team kept deleting old indices by hand, and the fix that made retention run on its own.
Read case study
- 03
OpenSearch diagnostics and capacity forecasting tooling
Built so the team stops firefighting the OpenSearch clusters and starts planning for them.
Read case study
- Roles
- Fully remote
- Citizenship
- Australian
- Hours
- 07:00 to 19:00 SAST
- Notice
- One month