Merged contribution to CNCF Falco (k8saudit-ovh v0.4.1)

Hello, I'm

Ilyass Kaouam

DevSecOps & Platform Security Engineer

Lille, France · Full remote

I build and secure Kubernetes platforms, from detection to enforcement to incident response, and I help teams turn infrastructure debt into a plan they can execute. 16 years across finance, retail and high-traffic systems.

See my projects LinkedInDownload CV (PDF) Email me

16yrs

of infrastructure & security work

Dozens

of Kubernetes clusters run across companies and clients

L3→L7

security controls built: firewalls, WAF, admission policies, runtime detection, SIEM

1B+

API calls per week operated (Decathlon)

~300k€/yr

platform cost cut (OpenShift → Kubernetes)

1

merged contribution in CNCF Falco

About

I’m a senior infrastructure and security engineer, based in Lille and working full remote. My ground is where platform engineering meets security: designing the detection chain, writing the policies that stop risky deployments, putting access behind identity, and keeping the network boring and reliable.

Since February 2026 I secure a Kubernetes platform on OVHcloud at ID6TM: runtime detection with Falco, a Wazuh SIEM with Shuffle automations, Gatekeeper admission policies, zero-trust administration access and centralised database access, all delivered through GitOps. I also wrote the platform’s technical architecture document.

Before that: Kubernetes and cloud for 10+ clients at Cyllene, a multi-cloud API platform serving a billion calls a week at Decathlon, enterprise platforms at Pictime, and six years building and hardening Inforisk’s production platform, from physical servers to Proxmox, Ceph and Ansible.

I like problems that need low-level debugging and a decision at the end of it, and I write things down so the next person does not need me.

Toolbox

Security & detection

  • Wazuh (SIEM)
  • Shuffle (SOAR)
  • Falco (eBPF)
  • OPA Gatekeeper
  • WAF (ModSecurity, CRS, anti-bot)
  • Cloudflare WAF
  • Trivy / Starboard
  • Nmap / OpenVAS
  • Incident runbooks

Network security & access

  • pfSense
  • iptables / nftables / ipset
  • NetworkPolicies
  • Netbird / WireGuard
  • IPsec VPN
  • Keepalived / VRRP
  • Zitadel / OIDC SSO
  • OpenLDAP / FreeIPA
  • Vault + ArgoCD Vault Plugin
  • Bytebase

Kubernetes & GitOps

  • Kubernetes (OVHcloud, GKE, EKS, RKE2)
  • ArgoCD & ApplicationSets
  • Argo Workflows
  • Helm
  • cert-manager
  • Docker / Docker Swarm
  • OpenShift (migration)

IaC & CI/CD

  • Terraform
  • Ansible
  • Packer
  • GitLab CI
  • BuildKit

Cloud & virtualisation

  • OVHcloud (vRack, managed K8s & DBs)
  • GCP
  • AWS
  • Azure
  • Proxmox & Ceph
  • VMware vSphere

Network & web

  • Traefik & Gateway API
  • Cloudflare (mTLS origin pull)
  • HAProxy
  • F5
  • Nginx
  • Apache / Tomcat
  • PowerDNS
  • Policy routing

Observability

  • Prometheus & Alertmanager
  • Grafana
  • Loki & Fluent Bit
  • Elasticsearch / ELK
  • Zabbix
  • Nagios
  • Opsgenie / PagerDuty
  • Uptime Kuma

Data, storage & backup

  • PostgreSQL (RepMgr, PgPool)
  • MySQL / Galera
  • MongoDB
  • Redis
  • SQL Server
  • GlusterFS / NFS
  • Bacula

Systems & code

  • Linux (Debian, RHEL, CentOS)
  • Windows Server / Active Directory
  • Go (open-source contributions)
  • Python
  • Bash, sed, awk

Selected projects

All projects

Latest writing

All articles

Experience

  1. Feb 2026 – Present

    DevSecOps / Platform Security Engineer · ID6TM

    Security of a three-cluster Kubernetes platform on OVHcloud and redesign of the network & security architecture.

    • Detection & response: Falco (eBPF, custom rules, attack tests), Wazuh SIEM with SSO and noise tuning, Shuffle automations and a weekly security report.
    • Policy-as-code with OPA Gatekeeper on every cluster, audit first then deny per environment, with alerting and an SSO policy UI.
    • Zero-trust access: VPN, SSO with 2FA and OIDC-based RBAC on admin tools; centralised database access with separation of duties; origin reachable only through Cloudflare (mTLS).
    • Reliability: GitOps patch management with release channels, alert noise down 23%, a Netfilter mark collision fixed and reported upstream; wrote the technical architecture document.
    • Open source: resilience fix merged in falcosecurity/plugins (PR #1270, k8saudit-ovh v0.4.1).

  2. Sep 2021 – Dec 2025

    Senior DevOps / SysOps Engineer · Cyllene

    Technical lead for managed infrastructure and modernisation across 10+ enterprise clients.

    • Cloud-native architectures on GCP (GKE, Cloud SQL) with Terraform; CI/CD with ArgoCD, Argo Workflows, Helm and GitLab CI.
    • Kubernetes security referent (Trivy, Starboard, Gatekeeper, hardening).
    • Paylib migration from OpenShift to Kubernetes: about 300k€ per year saved.
    • Full observability (Grafana, Prometheus, Alertmanager, Opsgenie); audits on HA, disaster recovery and costs.

  3. Jan 2020 – Jul 2021

    SysOps / Cloud Engineer · Decathlon

    Critical API management platform: 1.1 billion calls per week.

    • Extended AWS to GCP (multi-cloud) for availability and latency; infrastructure as code with Terraform.
    • 30 TB multi-region Elasticsearch optimised, then migrated to a managed service (Aiven); Gravitee moved to Kubernetes.
    • Monitoring redesigned for proactive alerting at scale.

  4. Feb 2018 – Jan 2020

    System & Network Engineer · Pictime Groupe

    Production platforms for large retail, banking, finance and insurance clients.

    • Platforms for Auchan, Société Générale and Boulanger; HA with HAProxy and F5, GlusterFS and Galera clusters.
    • Contribution to an Azure migration; Active Directory, MSSQL and DNS replication; VMware private cloud; level-4 support.

  5. Oct 2012 – Jan 2018

    System Administrator / Infrastructure Engineer · Inforisk

    Built, secured and modernised the production platform: availability, scalability, drastically reduced costs.

    • Physical to virtual: Proxmox cluster with replicated Ceph storage; VM deployment fully automated and infrastructure codified with Ansible; many critical services migrated to Debian.
    • Security: WAF with false-positive corrector, custom rules and anti-bot; dynamic ipset firewall with behavioural detection; pfSense VPNs; isolated private network; HA entry tier (Keepalived/VRRP).
    • Traceability and monitoring: user actions on critical servers tracked, ELK log centralisation, Zabbix fully upgraded and alerting continuously improved.
    • Data: PostgreSQL replication (RepMgr, PgPool), Bacula backups across sites, continuity and recovery plans.
    • Supported the developers and trained a level-2 engineer to support them autonomously.

Certifications, education & languages

Certifications

  • Google Cloud — Professional Cloud Architect (2023)
  • Google Cloud — Associate Cloud Engineer (2023)
  • AWS — Cloud Practitioner (2019)
  • Kubernetes CKA → CKS — in progress

Education

  • Master 2 (Bac+5), Information Systems & IT Project Management — CESASUP, 2016–2017
  • Specialized Technician, Computer Networks — ISIM, 2008–2010
  • Specialized Technician, Software Development — PIGIER, 2007–2009

Languages

  • French — fluent
  • English — professional (B2, working towards C1)
  • Arabic — native

Get in touch

Based in Lille, working full remote. Open to conversations about platform security, Kubernetes and infrastructure roles or advisory work. Email is the fastest way.

ilyassikai@gmail.com LinkedIn GitHub