Cybersecurity Platform Engineer
~ $ I build and maintain cybersecurity platforms
Cybersecurity Platform Engineer
Nclose (Integrity360)
Afrihost, April 2021 to August 2023; Nclose, September 2023 to now.
Client deployments
0+
deployments delivered · for enterprises and government
Client deployments: Collectors and pipelines configured remotely inside a client's own environment. More than 15 so far, for international and national enterprises and government in consumer finance, higher education, oil and gas, retail and hospitality.Search and log platform
~2PB
of data · about 2,000 laptops' worth
PB: petabytes: A petabyte is a million gigabytes. The clusters hold roughly 2 PB of data, about as much as 2,000 laptops with 1 TB drives.Search and log platform
0kEPS
events per second · average ingest, across clients
EPS: events per second: How many security events (log lines, alerts, audit records) the SIEM takes in, reads and stores every second, on average across all the clients it serves. 200k EPS is roughly 17 billion events a day.Total managed nodes
0+
Linux nodes · hardened and managed with Puppet
Linux nodes: A node is a single server. I look after more than 350 of them, locked down against attack (hardened) and kept consistent with Puppet, a tool that sets up every server from one central place.Search and log platform
0
cluster nodes · across 5+ search clusters
Cluster nodes: Elastic and OpenSearch are search engines built for huge volumes of logs. My team and I run 5+ clusters of them, 220 servers in all, including the SIEM (security information and event management): the system that gathers security records from across a business so analysts can spot and stop attacks.Client deployments
0+
deployments delivered · for enterprises and government
Client deployments: Collectors and pipelines configured remotely inside a client's own environment. More than 15 so far, for international and national enterprises and government in consumer finance, higher education, oil and gas, retail and hospitality.Search and log platform
~2PB
of data · about 2,000 laptops' worth
PB: petabytes: A petabyte is a million gigabytes. The clusters hold roughly 2 PB of data, about as much as 2,000 laptops with 1 TB drives.Tap for the next figure, hold one for details
Press and hold a figure for details
Total managed nodes
350+
Linux nodes
hardened and managed with Puppet
Linux nodes: A node is a single server. I look after more than 350 of them, locked down against attack (hardened) and kept consistent with Puppet, a tool that sets up every server from one central place.Search and log platform
cluster nodes
220
of data
~2PB
average ingest
200kEPS
Client deployments
15+
deployments delivered
for enterprises and government
Client deployments: Collectors and pipelines configured remotely inside a client's own environment. More than 15 so far, for international and national enterprises and government in consumer finance, higher education, oil and gas, retail and hospitality.About
Give me something broken and a terminal, and I'll find out why.
I co-run large-scale search and log pipelines at a managed detection and response provider in South Africa: Elastic and OpenSearch clusters, the SIEM they power, and Puppet and Python across hardened Linux nodes. I've always thought in systems, and working things out on my own is what hooked me. It still does.
Off the clock
- Started
- 2021, support desk
- Learned
- Self-taught
- Mentored
- 20+ consultants & engineers
- Based in
- South Africa
Case studies
- 01
Phased Ubuntu to Debian migration of log collectors across three offices
How I moved a financial asset manager's log collectors to new Debian machines, one kind of log source at a time.
Read case study
- 02
Applying an updated ISM policy to existing OpenSearch indices
Why the team kept deleting old indices by hand, and the fix that made retention run on its own.
Read case study
- 03
OpenSearch diagnostics and capacity forecasting tooling
Built so the team stops firefighting the OpenSearch clusters and starts planning for them.
Read case study
- Roles
- Fully remote
- Citizenship
- Australian
- Hours
- 07:00 to 19:00 SAST
- Notice
- One month