# Experience · Caleb Sargeant

> Markdown copy of <https://calebsargeant.com/experience/>, generated from the same data as the page.

13 years in IT across 13 engineering roles, from an MSP helpdesk in Cape Town to platform engineering in the Netherlands.

Open a role for its full duty list. Those lists are what the [JDs & Duties PDF](https://calebsargeant.com/downloads/Caleb_Sargeant_JDs_and_Duties.pdf) is generated from, so the document and this page cannot drift apart.

[JDs & Duties PDF](https://calebsargeant.com/downloads/Caleb_Sargeant_JDs_and_Duties.pdf) · [CV PDF](https://calebsargeant.com/downloads/Caleb_Sargeant_CV.pdf)

## Cloud Engineer, PinkRoccade

June 2025 to Present · 1 yr 3 mo · Netherlands · Permanent

Cloud and platform engineering for local-government software: Kubernetes platforms, infrastructure as code and the migration path off legacy application stacks.

### Highlights

- Cloud and Kubernetes platform engineering for government-sector workloads.
- Infrastructure as code and CI/CD for application teams.
- Migration and modernisation of legacy application platforms.

### Stack

Kubernetes, Azure, Terraform, GitHub Actions, Helm, Linux, Python

## Platform Engineer, Budget Thuis

January 2024 to May 2025 · 1 yr 4 mo · Amsterdam, Netherlands · Permanent · Remote from Cape Town until May 2024

Azure platform engineering for a Dutch energy and telecoms provider: AKS, Terraform, the internal developer platform, and the CI/CD that hundreds of .NET services ship through.

### Highlights

- Designed, built and ran Azure infrastructure as code with Terraform: AKS clusters, ACR, VNets, NSGs and identity integrations.
- Led the migration of legacy Linux VMs to microservices on AKS.
- Built the internal developer platform: reusable DRY infrastructure modules that bootstrap a new team's environments and repos.
- Rolled out observability (Prometheus, Grafana, Blackbox Exporter) across dev, test, acceptance and production.
- Integrated Microsoft Entra ID with Kubernetes RBAC, and audited IP whitelisting, SSO and certificate management.
- Stood in as Scrum Master for the platform team, running retrospectives and turning actions into prioritised engineering work.
- Started the role remotely from Cape Town and relocated to Amsterdam after five months.

### Stack

Azure, AKS, Terraform, Ansible, GitHub Actions, TeamCity, Helm, FluxCD, RabbitMQ, Prometheus, Grafana, Entra ID

### Duties

#### Infrastructure engineering

- Design, implement and manage Azure cloud infrastructure using Terraform (AKS clusters, ACR, VNets, NSGs, identity integrations).
- Lead the migration of legacy Linux VMs to modern microservices on AKS.
- Manage and maintain RabbitMQ clusters on AKS using FluxCD and Helm, including vhost configuration, authentication, resource setup, ingress and metrics collection.
- Implement observability stacks, including Prometheus, Grafana and Blackbox Exporter, across all environments (dev, test, acc, prod).
- Investigate and resolve connectivity and performance issues (Redis timeouts, RabbitMQ stability, disk-space errors).

#### CI/CD and developer tooling

- Build, improve and debug GitHub Actions workflows and TeamCity pipelines for .NET and containerised applications.
- Standardise and document GitHub configuration practices: org secrets, repo management, fork setups and onboarding new developers.
- Investigate and enable cost-efficient GitHub Actions usage and storage options (logs, caching, runner disk space).
- Set up and manage self-hosted GitHub runners, including Windows-based runners with Bash scripting capabilities.
- Enable Azure authentication during test workflows and optimise .NET restore issues in pipelines.

#### Internal developer platform

- Develop and maintain reusable infrastructure modules following DRY principles.
- Bootstrap environments and repositories for internal teams (Mobile Backend, Web API teams).
- Establish shared environment agreements, naming conventions and access controls (GitHub, Azure, APIM).
- Create onboarding guides, request forms and documentation to support internal teams in using the platform efficiently.
- Design internal API management flows and support APIM configuration for public-facing APIs and internal services.

#### Security & identity

- Integrate Microsoft Entra ID (Azure AD) with Kubernetes RBAC for role-based access.
- Implement and audit IP whitelisting, SSO across internal services, and certificate management.
- Ensure secrets and variable management across GitHub and Azure adhere to least-privilege and automation best practices.

#### Platform operations & support

- Provide cross-team support and runbooks for day-to-day developer issues (GitHub, Redis, TeamCity, environment provisioning).
- Rotate into a support roster and document support schedules and processes.
- Set up a service-desk system for the platform team, including intake forms and ticket triaging for internal requests.
- Troubleshoot production and test issues, including .NET application deployments, AKS issues and on-prem system challenges.

#### Documentation & process enablement

- Write and maintain extensive documentation in Confluence for platform procedures, onboarding, observability, CI/CD and infrastructure standards.
- Update and document changes to monitoring stacks and deployment pipelines.
- Capture action items from retrospectives and help enforce best practices across sprints.

#### Scrum Master duties

- Temporarily act as Scrum Master for the platform team, facilitating retrospectives, managing sprints and organising ceremonies.
- Ensure action items from retrospectives are translated into concrete engineering tasks and prioritised.

## Co-Founder, Magma Moose

March 2023 to Present · 3 yr 6 mo · Remote · Netherlands · Founder

Co-founded a development studio built around platform, cloud, network and security engineering, and its own developer tooling. I run the engineering: the shared infrastructure everything sits on, and most of the products on top of it.

### Highlights

- Built the studio's infrastructure as code: Terraform and Terragrunt across Cloudflare, Kubernetes, Oracle Cloud, AWS and GCP, including Zero Trust access and IPsec/BGP tunnels into the OCI DRG.
- Shipped Diatreme, a release-orchestration GitHub Action and Cloudflare Worker that unifies four semantic-versioning tools and does Docker build, scan, SBOM to Dependency-Track and registry promotion by digest.
- Shipped Chargate and Brimyr, which gate a pull request on net-new findings and on the coverage of the lines it actually changed rather than on a whole-repo number.
- Built Dün Mir, a fleet-assurance platform: agents on routers push heartbeats to a control plane that runs a dead-man sweep and alerts, with a licensed operator console composed in-process against a frozen agent API.
- Run the studio's security posture: DefectDojo as the finding hub, Dependency-Track as the SBOM sink, and a scheduled job that syncs between them and opens issues for new high-severity findings.
- Built Caldrith, a multi-tenant GitHub App that reconciles organisation and repository settings from configuration as code, and uses it to provision shared security and release workflows into every repository.

### Stack

Terraform, Terragrunt, Kubernetes, FluxCD, Cloudflare, GitHub Actions, Python, FastAPI, React, Docker, DefectDojo, Dependency-Track, OCI, MikroTik, FortiGate

### Duties

#### Company and direction

- Co-founded the studio and set its technical direction, including what to open-source and what to keep licensed.
- Own the product roadmap across release tooling, security gating, fleet assurance and developer experience.
- Write and maintain the public positioning, the product documentation and the studio website.

#### Shared infrastructure

- Design and maintain the infrastructure as code estate in Terraform and Terragrunt across Cloudflare, Kubernetes, Oracle Cloud, AWS and GCP.
- Run Cloudflare Zero Trust for internal access, including tunnels, access applications, identity providers and device posture.
- Operate the OCI edge, including MikroTik CHR routers, FortiGate IPsec tunnels with BGP, and DRG peering.
- Manage DNS, certificates and the Workers estate fronting the public sites.
- Run the Kubernetes platform with FluxCD, including the apps the studio depends on.

#### Release and supply-chain tooling

- Build and maintain Diatreme across python-semantic-release, semantic-release, GitVersion and release-please.
- Implement Docker build and scan with CycloneDX SBOM generation published to Dependency-Track, and provenance-verified image promotion by digest through GHCR.
- Support publishing to npm, Maven, Gradle, RubyGems, NuGet, pip and S3, and keep it GitHub Enterprise compatible.

#### Security engineering

- Build Chargate, which gates a pull request on net-new code-quality and security findings rather than on the repository total.
- Build Brimyr, which gates on patch coverage, diff-cover style, with the ecosystem auto-detected.
- Run DefectDojo and Dependency-Track as the studio's finding and SBOM sinks, with a scheduled sync that opens GitHub issues for new high-severity findings.
- Build Draventis for scheduled DAST against deployed environments with OWASP ZAP and Nuclei, reimported into DefectDojo. Early phase, not yet in production.
- Build Ponvara to read GHAS alerts and Dependency-Track findings into DefectDojo. Early phase, not yet in production.

#### Fleet assurance (Dün Mir)

- Design the control plane: agents on each router push heartbeats and job reports, and the plane runs a dead-man sweep and delivers alerts.
- Keep the agent wire contract frozen and versioned, so the licensed console composes the control-plane core in-process rather than proxying it.
- Build the operator console in React and Vite against a FastAPI backend, with first-party auth and multi-tenancy injected through the core's extension points.
- Deploy and run it on the studio's Kubernetes platform.

#### Developer platform and ways of working

- Build Caldrith, a self-hostable multi-tenant GitHub App that reconciles organisation and repository settings from configuration as code.
- Use it to provision shared security and release workflow templates into every repository in the organisation.
- Maintain a shared Homebrew tap with automated nightly updates, and a shared set of AI agent skills used across the tooling.
- Enforce signed commits, SHA-pinned actions, branch protection and a documented review process across the estate.

## DevOps Engineer, tengen

February 2023 to Present · 3 yr 7 mo · Remote · South Africa · Contract

Sole DevOps engineer for a multi-cloud estate: GitOps Kubernetes, Terraform modules, WireGuard/MikroTik networking, and the monitoring that keeps a production camera fleet honest.

### Highlights

- Ran fully declarative Kubernetes clusters on FluxCD, with Kustomize and Helm templates per environment.
- Wrote and maintained Terraform modules for EKS, VPCs, subnets, IAM, databases and VPNs across AWS, Azure and GCP.
- Secured infrastructure secrets with SOPS (GPG/AGE) stored in Git and decrypted in CI.
- Upgraded production MongoDB from 4.4 to 7 with replica sets, staging/prod separation and offsite backups.
- Cut long-term storage cost by automating disk cleanup and moving backups to S3 Glacier with lifecycle rules.
- Built and ran the production camera platform for live plate recognition, with remote HTTPS, NTP/DNS sync and reverse proxies.

### Stack

Kubernetes, FluxCD, Terraform, Ansible, AWS, Azure, GCP, Docker, MikroTik, Zabbix, MongoDB

### Duties

#### Infrastructure automation & cloud platforms

- Deployed and configured applications and services using Ansible, Docker and Kubernetes.
- Managed infrastructure on AWS, Azure and GCP, including provisioning, backup strategies and cost optimisation.
- Wrote and maintained Terraform modules to provision EKS clusters, VPCs, subnets, IAM, databases and VPNs.
- Automated complex workflows to improve deployment reliability and infrastructure consistency with GitHub Actions, Terraform and Ansible.

#### Kubernetes, GitOps & secrets management

- Managed Kubernetes clusters using GitOps workflows with FluxCD, enabling fully declarative cluster state and automated deployments.
- Created and managed Kustomize and Helm templates for reusable, environment-specific Kubernetes configuration.
- Secured infrastructure secrets with SOPS using GPG-encrypted/AGE secrets stored in Git and integrated into CI/CD pipelines.
- Designed secure multi-environment architecture with RBAC, service accounts and namespace segregation.
- Evaluated Rancher against Atlantis for Terraform automation and GitOps workflow management.
- Refactored Terraform repositories for modularity, security and scalability.

#### Networking, VPNs & security

- Deployed and maintained WireGuard and L2TP VPNs, configuring secure tunnels between MikroTik routers, firewalls and cloud environments.
- Resolved VPN connectivity issues, managed access for the internal team and external partners, and audited VPN/firewall logs.
- Configured and maintained firewalls (SonicWall, MikroTik, FortiGate), ensuring proper routing and secure network segmentation.
- Hardened infrastructure based on penetration-test results, including closing unused ports, hardening routers and auditing SSH access.

#### Monitoring, logging & observability

- Implemented and maintained Zabbix monitoring for cameras, routers, VPNs and VM infrastructure.
- Tuned alerting to reduce noise in Slack and improve actionable insight, including alert-duplication fixes and S3 lifecycle alerting.
- Automated monitoring for disk usage, Mongo/MySQL performance and system resource thresholds using scripting and GitHub Actions.

#### CI/CD & deployment engineering

- Built and maintained CI/CD pipelines with GitHub Actions, supporting PR workflows, automated testing, DB seeding and production rollouts.
- Dockerised multiple backend and frontend services, deployed with PM2, and implemented alerting for process failures and API throttling.
- Documented rollback strategies, staging/production separation and release playbooks to improve developer confidence and safety.

#### Infrastructure management

- Managed VMs across AWS, Azure and on-prem, including disk expansion, image issues, high CPU/disk usage and network availability.
- Implemented disk-cleanup automation, S3 lifecycle rules, and moved backups to S3 Glacier to reduce long-term storage costs.
- Developed and documented disaster-recovery plans and procedures to rebuild legacy environments.

#### Database operations

- Upgraded MongoDB clusters from 4.4 to 7, including migration, replica sets, staging/prod separation and offsite backups.
- Maintained and tuned MySQL for staging and production, resolving connectivity issues, timezone misalignments and user access management.
- Built backup and monitoring scripts for the Zabbix DB, MongoDB and SonicWall configurations, ensuring recoverability and auditability.

#### Camera & IoT infrastructure

- Deployed and maintained production cameras for live plate recognition, including remote HTTPS setup, NTP/DNS sync and reverse proxies.
- Troubleshot camera-specific issues such as intermittent reads, high data usage, timezone errors and daily reboots.
- Built tools for retrieving images, rebooting failing cameras and confirming network routing through the firewall.
- Collaborated with third parties and partners on camera rollouts, VPN routing, IP whitelisting and site troubleshooting.

#### Documentation & support

- Authored internal documentation for VPN and WireGuard setup, camera setup and HTTPS integrations, backup strategy and DR procedures, and infrastructure diagrams and rollout plans.
- Created onboarding guides for engineers, filled gaps in legacy systems, and documented legacy rebuild strategies for disaster scenarios.
- Provided consistent support to team members and clients on DB/VPN access, SSH issues and deployment failures.

#### Internal tools & developer experience

- Improved Git workflows, including protected branches and a branching strategy for IaC and application codebases.
- Developed scripts for common operations such as VPN status checks, Docker container backups, MongoDB cleanups and certificate renewals.
- Participated in tool evaluations (DefectDojo, SonarQube, Infracost) and ensured integrations were functioning in CI/CD.
- Improved developer UX by Dockerising dev environments, linking PM2 processes to GitHub repos and enabling fast local onboarding.

#### Collaboration & communication

- Participated in cross-functional collaboration with developers, system administrators and infrastructure engineers.
- Held onboarding meetings, camera POC planning sessions and infrastructure design workshops.
- Communicated directly with stakeholders to resolve critical issues, support networking configuration and plan infrastructure rollouts.

## DevSecOps Engineer, Byte Orbit

November 2022 to December 2023 · 1 yr 1 mo · Cape Town, South Africa · Permanent

The security half of a product engineering org: AWS WAF and Cisco FTD in Terraform, the application-security toolchain (Dependency-Track, DefectDojo, SonarQube), and ZTNA evaluations.

### Highlights

- Wrote the Terraform for AWS WAF, a Cisco FTD Geneve/GWLB transit gateway, Dependency-Track, DefectDojo and SonarQube across environments.
- Stood up the application-security toolchain end to end and wired it into GitLab CI with Sonar, dependency checks, Trivy and ZAP.
- Ran the vulnerability response loop, monitoring alerts, risk-assessing new findings and driving them to closure as tickets.
- Delivered ZTNA proof-of-concepts (Duo Network Gateway, ZScaler, Cisco Umbrella SIG) and the SSO/SAML integrations behind them.
- Contributed the ISO 27001 documentation and reported weekly on security industry trends to the Information Security Council.

### Stack

Terraform, AWS, Cisco FTD, GitLab CI, OWASP Dependency-Track, DefectDojo, SonarQube, Datadog, Duo, Trivy, ZAP

### Duties

#### Infrastructure as code

- Write Terraform code for different environments: AWS WAF, Cisco FTD GWLB and transit gateway, OWASP Dependency-Track, DefectDojo, SonarQube.
- Cisco FTD NGFW install and configure as a POC in AWS with a Geneve tunnel GWLB, using Terraform.
- Rotate S3 access keys in AWS.

#### Application security toolchain

- Install and configure OWASP Dependency-Track, configure it to send OpsGenie alerts, and integrate it with DefectDojo.
- Install and configure SonarQube.
- Install and configure DefectDojo.
- Modify and secure GitLab CI/CD pipelines with Sonar, dependency check, Trivy, ZAP and similar.
- GitLab CI/CD branch permissions, security audit and configuration.

#### Vulnerability & incident response

- Receive, investigate and close OpsGenie alerts relating to security incidents.
- Monitor all security alerts for the organisation, liaise with teams and risk-assess new vulnerabilities, logging them as tickets to get them resolved.
- Collaborate with teams on pentest report findings and get them resolved.
- Write documentation on security risks and how to mitigate them.
- Weekly investigation and reporting of security industry trends for Information Security Council meetings.

#### Identity, access & zero trust

- Duo Network Gateway POC as a ZTNA solution: install and configure, get HTTPS connections working, configure DNG with SSO and protect applications behind it.
- ZScaler POC as a ZTNA solution.
- Cisco Umbrella SIG trial and POC.
- SAML configurations with various applications using JumpCloud.
- Integrate Duo with Datadog.
- 1Password: administer access and policies.
- Audit the use of Apple Developer Consoles.

#### Governance

- ISO 27001 documentation and collaboration with teams.
- Investigate a fingerprinting solution for a client.

## DevOps Engineer, Mindspring Computing

September 2021 to November 2022 · 1 yr 2 mo · Cape Town, South Africa · Permanent

The generalist DevOps seat at an MSP: GCP/Azure/AWS administration, Jenkins and Bamboo, Ansible-managed infrastructure, and the monitoring and backup estate for a book of clients.

### Highlights

- Migrated the organisation from Bitbucket to GitHub, and deployed applications to GCP App Engine.
- Installed and ran Prometheus, Alertmanager and Grafana via Docker and Ansible, with granular alerting into Slack.
- Wrote the automation that starts and stops cloud instances overnight to cut spend.
- Configured MikroTik route failover for fibre outages, with notification, and ran a zero-trust IPTables policy via Ansible.
- Built the backup estate: Veeam on Hyper-V, scripted FTP and cloud backups, and Hyper-V replication.

### Stack

GCP, Azure, AWS, Ansible, Jenkins, Bamboo, Docker, Nagios, Prometheus, Grafana, ELK, MySQL, MongoDB, MikroTik, FortiGate

### Duties

#### Deployments & Git

- Git merge pull requests and deploy to the app server.
- Rebase branches using Git and resolve merge conflicts.
- Deploy applications to GCP App Engine.
- Migrate from Bitbucket to GitHub.

#### CI/CD

- Install, configure and maintain Atlassian Bamboo.
- Install, configure and maintain Jenkins.
- Write Bitbucket pipelines.

#### Cloud administration

- Resize instances in GCP and work with GCP billing accounts.
- Office 365 and Google Admin administration.
- Create a script to automatically start and stop instances overnight to save costs.
- GCP / Azure / AWS cloud infrastructure management.
- Cloud migration investigation of on-premise servers.

#### Infrastructure configuration & administration

- Configure the UniFi controller in Docker via Ansible.
- Configure IPTables via Ansible.
- Resize root partition sizes on servers and clear disk space on small-disk servers.
- Script FTP backups, backups to Bitbucket, and backups to a cloud server across the whole environment.
- Configure Veeam backups on Hyper-V servers and set up Hyper-V replication.
- Configure Windows server backups.
- Test SFTP server connectivity; set up SFTP and OpenVPN servers.
- Set up crontabs on servers.
- Investigate certificate issues on Ubuntu/CentOS with Let's Encrypt root cert expiry.
- Nginx configuration.

#### Monitoring & logging

- Nagios XI and Core configuration and maintenance.
- Install and configure Prometheus, Alertmanager and Grafana via Docker and Ansible.
- Set up granular alerting on Prometheus and configure Prometheus Slack alerting.
- Work with Datadog monitoring.
- Install and configure an ELK stack server.

#### Database administration

- MySQL/Postgres database backups, replication configuration and maintenance.
- MySQL/Postgres create users and grant permissions; update fields after select queries.
- Investigate MongoDB alerts and upgrade the MongoDB cloud cluster.

#### Networking & security

- Install and configure a FortiGate 30e.
- Install and configure MikroTik RouterOS.
- MikroTik route failover when fibre goes down, with notification.
- Blocking and permitting IP addresses, and NAT with IPTables.
- Configure IPTables zero-trust; audit IPTables rules.
- SSH key management.

#### Documentation & other

- Write documentation on RAID disk failure in the datacentre to mitigate downtime.
- Create documentation on CI/CD, document incident reports, and document migrating physical instances to GCP/AWS/Azure.
- API calls via Postman.
- Penetration testing.
- Work with MailScanner.
- Agile methodologies.

## Senior Security Engineer, Thinkst Applied Research

October 2020 to September 2021 · 11 mo · Cape Town, South Africa · Permanent

Deep technical support and research for Canary, the deception platform: deployments across every major cloud and hypervisor, protocol-level troubleshooting, and published security write-ups.

### Highlights

- Supported Canary and Canarytoken deployments across AWS, GCP, Azure, on-prem and VMware, including DNS-tunnelling and HTTP channel configuration.
- Found a way to get Canary running on OpenStack.
- Wrote Canarytoken deployments and console configuration in Python, PowerShell and Bash, and assisted customers with API deployments.
- Researched security vulnerabilities and exploits and published write-ups (pass-the-hash and others) on the security blog.
- Ran SAML/SSO configuration, webhooks and syslog integrations for enterprise customers.

### Stack

AWS, GCP, Azure, VMware, OpenStack, Python, PowerShell, Bash, SAML/SSO, Syslog, DNS

### Duties

#### Support engineering

- Configuring and updating SAML/SSO.
- Enabling and deploying Canary in AWS/GCP/Azure/on-prem/VMware.
- Canary-related deployments and questions (DNS tunnelling, how it is configured).
- Canarytoken deployments and questions (DNS/HTTP channels, how they are configured).
- Troubleshoot and resolve offline Canaries and Canaries with stuck settings.
- Configuring and enabling features for the Canary Console.
- Troubleshooting and resolving API access and usage; configuring webhooks; enabling and configuring syslog.
- Set up, troubleshoot and resolve Canary issues over videoconference.
- Answering general security questions, with deep understanding of TCP/IP protocols (DNS, DHCP, SSH, SFTP, HTTP/S, LDAP) and of cloud technologies.

#### Scripting

- Canarytoken deployments via Python, PowerShell and Bash.
- Generating Canary deployment config, and Canary console config and Linux commands in Bash.
- Assist customers with API deployments.

#### Research & projects

- Found a way to get Canary running on OpenStack.
- Post write-ups of research and learning done on security topics (pass-the-hash and others).
- Research security vulnerabilities and exploits, and write security blog posts about them.

## Senior Network Security Engineer, Kurtosys Systems

July 2020 to October 2020 · 3 mo · Cape Town, South Africa · Permanent

Promotion into the senior seat on the same global network, with design and architecture input, Azure migration and the PKI and MFA rollouts.

### Highlights

- Implemented MFA for remote-access VPN and network device management access (Duo, Google Authenticator).
- Implemented Microsoft PKI: a standalone root and enterprise subordinate CA environment.
- Migrated virtualised and physical servers to Azure, and migrated Windows NPS to cloud-based FreeRADIUS.
- Built VPN tunnels between ASA, Azure and AWS, and scripted the DR procedure with Azure.
- Implemented network L2 and L3 redundancy and failover, and Syslog into Azure Sentinel.

### Stack

Cisco ASA, FirePOWER, Azure, AWS, OpenStack, Zabbix, Azure Sentinel, FreeRADIUS, Duo, BGP, OSPF

### Duties

#### Projects

- Implement MFA for remote-access VPN and network device management access (Duo, Google Authenticator).
- Build Zabbix server monitoring in and between the datacentre and corporate environments.
- Implement Syslog with Azure Sentinel.
- Implement network L2 and L3 redundancy/failover.
- Virtual office migration of virtualised and physical servers to cloud-based services and virtualised instances in Azure.
- Migration of Windows NPS to cloud-based FreeRADIUS instances.
- Implement Microsoft PKI (standalone root and enterprise subordinate CA environment).
- Build VPN tunnels from and between ASA, Azure and AWS.
- Scripted DR procedure with Azure.
- FirePOWER, NGFWv and ASAv implementation.
- Re-cable the entire server room.

#### Roles & responsibilities

- Deployment and configuration of network devices, by manual process (to be identified for automation) or automated process.
- Development and improvement of network devices or virtualised functionalities.
- Development of reporting on the effectiveness of the processes.
- Contribute to design and architecture of the network.
- Monitoring of global network infrastructure and services.
- Provide network support to major infrastructure projects.
- Coordination of change control and deployment processes.
- Network device and service hardening.
- Provide 2nd/3rd line network support to infrastructure and engineering teams.
- Help maintain reliable operation of the network infrastructure.

## Network Security Engineer, Kurtosys Systems

December 2017 to July 2020 · 2 yr 7 mo · Cape Town, South Africa · Permanent

Two and a half years on a global, multi-datacentre financial-services network: Cisco ASA and FirePOWER, high availability across layers, and packet-level diagnostics.

### Highlights

- Ran network security on Cisco ASA (ACLs, stateful inspection and threat detection) across a global estate.
- Implemented high availability across multiple layers (HSRP and others) and dynamic routing with BGP, OSPF and EIGRP.
- Diagnosed at packet level on Linux and Cisco, including decrypting TLS 1.2 in Wireshark with ephemeral keys.
- Automated network configuration with Ansible and RANCID under Git-based configuration management.
- Ran 802.1x and RADIUS in a mixed FreeRADIUS/Windows NPS environment, and Cisco ISE BYOD.

### Stack

Cisco ASA, FirePOWER, Cisco ISE, OpenStack, AWS, Active Directory, Ansible, RANCID, Zabbix, Graylog, BGP, OSPF, HSRP

### Duties

#### Network engineering

- Management of the physical and data-link layers, mainly all types of Ethernet up to 10G over fibre or UTP.
- Deep understanding of the TCP/IP protocols (DNS, DHCP, SSH, SFTP, HTTP/S, LDAP, RDP).
- Diagnostics and troubleshooting, including capturing and analysing packets on Linux or Cisco devices (decrypting TLS 1.2 with Wireshark using ephemeral keys).
- Network security, ACL, stateful inspection and threat detection, predominantly on the Cisco ASA firewall.
- Conventional data centre and corporate networking.
- Implementation of high availability across multiple layers (HSRP and other).
- Dynamic and static routing (BGP, OSPF, EIGRP).
- Understanding load-balancing technologies (L4-L7, SSH/HTTPS).
- Ethernet, fibre and wireless connectivity including 10GE and 802.11ac.
- Intrusion prevention and detection systems.
- Network device licensing.

#### Cloud & virtualisation

- OpenStack networking (Nova, OpenStack CLI, GUI).
- AWS networking (VPC, VPN, EIP).
- AnyConnect remote-access VPN; IPsec and SSL VPN technologies.
- Microsoft Hyper-V (2012/2012 R2/2016) and Microsoft Failover Clustering.

#### Platforms & identity

- Linux (Ubuntu) and Windows (7-10, Server 2012 to 2016) administration for network services.
- Understanding of domain services on Windows Servers and all related protocols.
- Active Directory (Windows 2012 R2/2016, forests with multiple child domains); hierarchical AD design and implementation.
- 802.1x, RADIUS in a mixed environment, FreeRADIUS, Windows NPS.
- Cisco ISE BYOD.
- DNS (MS, BIND); SSH and (S)FTP using AD authentication from Linux.

#### Automation & monitoring

- BASH scripting.
- Network automation (RANCID, Ansible) and Git-based configuration management.
- Central log aggregation using Logstash, Graylog and ElasticSearch.
- SNMP monitoring with data collection (Cacti, Zabbix); infrastructure monitoring (Nagios, Zabbix).
- Network device configuration backup (RANCID).
- Bandwidth testing, monitoring and reporting (NetFlow, AWS cost analyser).
- Compute-node acceptance testing using performance testing tools.
- Ubiquiti UniFi wireless systems.

#### Ways of working

- Working on multiple projects in a controlled and organised manner.
- Working independently on projects or BAU tasks.
- Working as part of a geographically dispersed team.

## Security Engineer, Dimension Data

November 2016 to December 2017 · 1 yr 1 mo · Cape Town, South Africa · Permanent

Managed-security engineering across a book of enterprise clients: Cisco ASA, FortiGate and Juniper firewalls, site-to-site VPNs and ACL reviews.

### Highlights

- Configured and troubleshot site-to-site VPNs, ACLs and firewalls (Cisco ASA, FortiGate, Juniper) for enterprise clients.
- Ran zero-hit ACL reviews across all clients, and firewall upgrades on ASA and FortiGate.
- Owned incidents end to end, from first-line call through to closure and client reporting.

### Stack

Cisco ASA, FortiGate, Juniper, McAfee ePO, Bluecoat, Wireshark

### Duties

#### Engineering

- First-line support calls: configuring and troubleshooting site-to-site VPNs, configuring and maintaining ACLs, configuring and maintaining firewalls (Cisco ASA, FortiGate, Juniper).
- Creating and modifying routes; maintenance and changes to interfaces; NAT.
- Troubleshooting connectivity with captures, packet-tracers and Wireshark.
- Installing and configuring Cisco ASAs and FortiGates; firewall upgrades.
- Configuration and log backups.
- McAfee ePO maintenance and reporting; Bluecoat reporter reporting.
- Zero-hit ACL review of all clients.

#### Service management

- Identify problems prior to, or when, they occur, and log incidents in a timely manner.
- Liaise with all stakeholders to fast-track resolution; escalate where applicable.
- Full ownership in managing calls, with continuous feedback to clients.
- Update incidents with progress and resolution details.
- Design/config documentation; create and maintain network diagrams.
- Daily health checks; daily/weekly/monthly reports; SOPs and spares lists checked bi-annually.

## Customer Support Engineer, Dimension Data

March 2015 to November 2016 · 1 yr 8 mo · Cape Town, South Africa · Permanent

End-to-end customer support for an enterprise client base, including a VIP user group, plus the AD, Exchange and infrastructure administration behind it.

### Highlights

- Provided 1st, 2nd and 3rd line support (telephonic, remote and onsite) across the client base, with a dedicated VIP support focus.
- Administered Active Directory, Group Policy, print, DNS and DHCP servers.
- Managed third-party vendors for cabling, boardrooms, printers and hardware call logging.

### Stack

Active Directory, Exchange, Group Policy, DNS, DHCP, Windows Server, Cisco

### Duties

#### Support

- Log, assign, monitor and report on incidents and requests from users, and redirect unresolved problems to the relevant section.
- Provide an end-to-end customer interface to understand and drive customer requests to closure.
- Provide 1st, 2nd and 3rd line customer support (telephonic, remote and onsite) for all customers.
- Added focus on VIP support: frequent communication, follow-up, proactive checks and speedy turnaround times.
- Responsible for advanced fault finding, repair and configuration on all workstations, laptops, desktops and mobile devices.
- Provide hardware troubleshooting on IT infrastructure, like servers, switches, desktop telephones (Cisco), projectors and VC end points.
- Provide mobile device support (BlackBerry, Apple, Android, Nokia).

#### Administration

- Setup and maintenance of AD accounts; setup and management of MS Exchange Server accounts.
- Creating and maintaining Group Policy Objects.
- Administer and maintain Active Directory, Group Policy, print server, DNS server and DHCP server.
- Maintaining the IT asset register and assisting with IT-related procurement.
- Administrative support to IT Operations, such as managing backup drives to the disaster-recovery site.
- Engage with third-party vendors to ensure site requirements are carried out: building cabling, boardrooms and meeting rooms, printer and hardware call logging.
- Ensure ISO requirements are met and policies and procedures are adhered to.

## Desktop Support Engineer, MMI Holdings (Carecross Health)

March 2014 to March 2015 · 1 yr · Cape Town, South Africa · Permanent

The whole IT department for a health business: desktops, servers, the switched network, access control and everything in between.

### Highlights

- Ran service and IT support for the entire IT department, from workstation builds to Terminal Servers.
- Monitored, installed and maintained the HP switched network, and implemented and neatened network cabling.
- Administered the ImproNet security access-control system.

### Stack

Windows Server, Active Directory, Group Policy, DNS, DHCP, FSRM, Terminal Server, HP switches, Ubiquiti

### Duties

#### Support & administration

- Service and IT support for the entire IT department.
- Log, assign, monitor and report on incidents and requests from users; close off all logged calls.
- Administrative support to IT Operations, such as managing backup drives to the disaster-recovery site.
- Maintaining the IT asset register and assisting with IT-related procurement.
- Setup and maintenance of AD accounts; setup and management of MS Exchange Server accounts.
- Creating and maintaining Group Policy Objects.
- Windows DNS, DHCP and FSRM administration; troubleshooting and maintaining Windows Server.
- Management of the security access-control system (ImproNet).
- Installing, monitoring and maintaining Terminal Servers.

#### Infrastructure

- Monitoring, installing and maintaining the HP switched network.
- Network cabling implementation and neatening.
- Installing new workstations, thin stations and laptops.
- Setup new BlackBerry, iPhone and Android phones; setup and troubleshoot fax.
- Ubiquiti wireless administration.
- Create scripts using batch.
- Troubleshooting printers, and resolving software and hardware problems.
- Help 3G users remotely; troubleshoot and resolve any computer-related issue in the building.

## IT Support Engineer, Mindspring Computing

November 2012 to February 2014 · 1 yr 3 mo · Cape Town, South Africa · Permanent

Where it started. MSP helpdesk covering client-side and server-side, on-site work, and the self-taught programming that turned into everything after.

### Highlights

- Ran helpdesk across client-side (Windows, Mac, Office, ADSL) and server-side (CentOS/RHEL 5+, Windows Server 2003+).
- Administered Linux mail (domains, forwards, relays, queues and DNS records) and ADSL/server monitoring with Nagios XI.
- Tested and set up a Git server and a ThinStation server for the business.
- Taught myself PHP, HTML, CSS, VBS, batch and Bash in quiet hours, and built an app that auto-logs into servers using KeePass and PHP.
- Built and shipped two client websites (kaytrad.co.za, saasie.co.za).

### Stack

CentOS, Windows Server, Nagios XI, Linux mail, DNS, PHP, Bash, Git

### Duties

#### Helpdesk, client side

- Workstations from Windows 98 onwards, and macOS.
- Troubleshoot and resolve problems with any version of Outlook on Windows and Mac, and with Office products.
- Troubleshoot and resolve problems with ADSL; top-up bandwidth for clients.
- Troubleshoot and resolve network issues; setup printers; install required software.
- Clear computers of virus/malware/adware; fix Java problems for internet banking.
- Resolve any browser-related issue (Chrome, Firefox, IE); used vTiger CRM for helpdesk ticketing.

#### Helpdesk, server side

- CentOS Linux servers (RHEL 5 and later), command line mostly; Windows Server 2003 and later, and SBS 2003 and later.
- Linux/Windows server maintenance; ADSL/server monitoring using Nagios XI.
- Create new domains, out-of-office messages, mail forwards, new email users, and add users to the relay server (Linux).
- Create and edit DNS records; recover mail; check and clear mail queues; test mail server connectivity using telnet.
- Setup VPN connections; troubleshoot and resolve DNS and DynDNS issues.

#### Technical work at the office

- Create Ethernet cables; reinstall Windows/Mac/Linux machines; install new Windows/Linux servers and workstations.
- Test hard-drive integrity and recover client data; troubleshoot hardware and quote via finance.
- Research and test new technologies; test and set up a Git server and a ThinStation server.
- Neaten cabling; write up proposals; setup and configure new routers; troubleshoot UPS issues.
- Password recovery of Windows/Linux/Mac machines.

#### On-site support

- Scheduled visits and callouts when the helpdesk could not solve the problem.
- Maintenance of workstations and servers; setup new computers; install printers; setup fax.
- Solve network issues; setup switches, routers and cabling; cover for assigned technicians.
- Three months as an in-house technician at a Mindspring client: server installs, Kaseya and ManageEngine evaluation, SQL Server audit, Hyper-V installs and replication, Windows Deployment Services.

#### Development experience

- Learned to program in PHP, HTML, CSS, VBS, batch and Bash during quiet office hours, and developed test programs in those languages.
- Developed an application that auto-logs into servers and services using KeePass and PHP.
- Upload created websites via FTP/cPanel; edit websites using Joomla/WordPress.
- Created scripts to make my work easier.
- Websites created: kaytrad.co.za and saasie.co.za.