Work

Getting a SOC up and running for a managed service provider

I deployed the Sekoia.io SOC/XDR platform for an MSSP and onboarded ten of its SMB clients. I tuned the detection rules, set up decoys and honeypots, wrote the incident response playbooks and standardised the daily checks. The team has run the platform on its own since.

• ~500endpoints
• 28 Mevents / day
• 10clients

Finding the gaps before an attacker does

Internal and external penetration tests, followed by a maturity assessment against NIST CSF, ISO 27001 and ANSSI. I delivered a remediation roadmap ranked by risk and presented it to leadership.

Securing Kubernetes clusters in production

Hardening of clusters and hosts: RBAC, network policies, admission control. I built container image scanning into the deployment pipeline, then set up security monitoring for the clusters.

Bringing an infrastructure back after a cyberattack

Emergency response on a compromised infrastructure. I contained the attack, ran the investigation, restored critical servers, then hardened the environment to prevent a repeat.