SysOps Engineer (Platform & Observability)
Previously Junior Linux Engineer
Nclose (Integrity360), managed detection and response provider
Sept 2023 to present
Platform and observability
- Help run 5+ Elastic and OpenSearch clusters (220 nodes, ~2 PB) on hot, warm and cold tiers, including the SIEM behind an average 200k events per second.
- Fixed ISM retention across 12 compliance clusters, eliminating manual index deletion. Case study →Fixed ISM retention across 12 compliance clusters, eliminating manual index deletion.
- Cut routine OpenSearch diagnosis from about 45 minutes to about two minutes, and added capacity forecasting. Case study →Cut routine OpenSearch diagnosis from about 45 minutes to about two minutes, and added capacity forecasting.
- Resolved Elastic, OpenSearch and Logstash performance issues for 10+ clients.
- Built Grafana dashboards and run Zabbix monitoring across 300+ hosts.
Data pipelines
- Built an Orca Security ingestion pipeline in Python, deployed via Puppet to three clients. Case study →Built an Orca Security ingestion pipeline in Python, deployed via Puppet to three clients.
- Operate the ingest layer: Logstash, Filebeat and RabbitMQ, alongside Kafka.
- Extended the production Puppet module that monitors Logstash pipeline health.
Infrastructure and automation
- Manage 350+ hardened Linux nodes with Puppet, and 70+ VMs on Proxmox.
- Run Docker in production: multi-stage builds, custom networking, a private registry, Compose and Swarm.
- Migrated a financial asset manager's three offices from Ubuntu to Debian, using a self-reverting IP swap script to remove rollback risk. Case study →Migrated a financial asset manager's three offices from Ubuntu to Debian, using a self-reverting IP swap script to remove rollback risk.
Delivery and leadership
- Delivered 15+ forward deployments for enterprise clients in consumer finance, higher education, local government, oil and gas, retail and hospitality.
- Recognised by the CEO for log analysis during a major healthcare security incident. Case study →Recognised by the CEO for log analysis during a major healthcare security incident.
- Write root cause analyses, CAB submissions and runbooks, and mentor colleagues on Linux and platform tooling.