03 — Area of expertise
Security & Observability
Secure by default. Seen before it breaks.
Guardrails from the admission controller to the endpoint, and observability that answers real questions during an incident.
- Identity across every cloud: GCP IAM, AWS IAM, Azure Entra ID and Keycloak — least privilege, workload identity, no static keys.
- Security and access audits that end in a prioritised remediation plan, inside an ISO 27001 scope.
- Kubernetes security as code: Kyverno admission, Tetragon runtime enforcement, Cilium network policies and mTLS.
- Endpoint protection at scale: Defender for Endpoint for 1,200+ users, EDR alerts turned into tickets.
- Observability built for incidents: Prometheus, Grafana, Loki, OpenTelemetry, SLOs and on-call.
Selected work
- Veolia
Policy guardrails
Admission and runtime policies that developers can actually debug.
- TeamWork
Endpoint security rollout
1,200+ users, EDR alerts to ITSM tickets via a severity matrix.
- Veolia · Skyloud
Observability stacks
Prometheus, Grafana, Loki, Mimir — from scratch and at scale.
Full interactive presentation in progress.
Tools
- GCP IAM
- AWS IAM
- Entra ID
- Keycloak
- Kyverno
- Tetragon
- Cilium
- Vault
- CrowdStrike
- Defender
- Prometheus
- Mimir
- Grafana
- Loki
- OpenTelemetry
- Alertmanager
- Opsgenie