Wazuh SIEM: one place to see what happened
Centralised detection for three Kubernetes clusters, the VMs and the cloud account, from architecture to SSO and noise tuning.
Read the case studyProjects
Case studies from my work: the context, what I built or decided, and what changed. Internal names, addresses and client details are left out on purpose.
Kubernetes platform security — ID6TM
Falco runtime security, and a fix merged into CNCF Falco
Real-time threat detection in the clusters, tuned against false positives and validated by attack tests, plus a resilience fix shipped upstream.
Read the case studyOPA Gatekeeper: about 50 policies, from audit to enforcement
Policy-as-code on three clusters, rolled out per environment, observable, with documented exceptions and gaps.
Read the case studyDebugging a Netfilter mark collision: Netbird, OVH OKS and kube-proxy
A critical connectivity incident traced to overlapping Netfilter mark bits, fixed with a DaemonSet and reported upstream.
Read the case studyEarlier work
Inforisk: building, securing and modernising the production platform
From physical servers to a rebuildable, monitored and hardened platform: Proxmox and Ceph, Ansible, WAF and anti-bot, dynamic firewall, isolated network, and a team trained to carry on.
Read the case studyPaylib: from OpenShift to Kubernetes
A regulated payment platform moved to GitOps-driven Kubernetes, saving about 300k€ a year.
Read the case study