Security engineer.Ultramarathon runner.

• AWS EKS
• Google Cloud
• Azure AKS
• Proxmox

Architected multi-node Wazuh and OpenSearch clusters across on-premises and hybrid cloud environments, AWS EKS, Google Cloud, Azure AKS, and Proxmox, using EC2 or ECS when managers ran outside Kubernetes. Spread pod and index replicas across availability zones around an active master for cluster coordination, enrollment, and the API, scaling worker pools horizontally with pod anti-affinity to ensure immediate agent failover upon worker disruption.

Tuned ingestion pipelines processing over 250B events by profiling backpressure across analysisd queue depths, decode and rule-matching worker threads, Filebeat batching, and OpenSearch index buffer throughput. Correlated queue buffer saturation against event-to-index latency and dynamically adjusted memory limits to absorb sudden burst traffic without dropping agent events or exhausting host resources.

Reduced AWS EKS infrastructure costs by up to 20% through instance right-sizing, migrating multi-pod workloads from ARM to AMD instances for optimized indexing throughput, and implementing OpenSearch Index State Management policies to transition aging indices to warm and cold S3 storage tiers.

Restored security visibility and cluster stability for enterprise customers during production outages caused by ingestion bottlenecks, disk pressure, persistent volume exhaustion, split-brain states, and indexer cluster degradation.

Engineered declarative GitOps deployment workflows for EKS clusters versioned in GitHub with pod disruption budgets, rolling updates, and health-checked automated rollbacks when ingestion lag or worker queue saturation breached predefined SLI/SLO thresholds. Instrumented Prometheus, Grafana, and OpenSearch telemetry around cluster queues, memory pressure, and index write latency with automated runbook routing to resolve pipeline stalls before log loss occurred.

• AWS
• Google Cloud
• Azure
• Active Directory
• Microsoft 365
• Google Workspace
• Okta
• FortiGate
• Sophos
• Cisco

Maintained the Wazuh public integrations repository as core maintainer, authoring and shipping detection rules, decoders, IOC lookups, alert enrichment, threat intelligence feeds, active-response scripts, SCA policies, and custom integrations for AWS (SQS, CloudTrail, VPC Flow Logs), Azure (Microsoft Graph), Microsoft 365, Okta, Entra ID, Active Directory, Google Workspace, LDAP, FortiGate, Sophos, and Cisco.

Built Wazuh response playbooks where correlation rules identify temporal patterns across shared attributes, IOC and enrichment scripts append threat context, and active-response commands execute against targeted endpoints with strict execution timeouts and circuit-breaker rate limits to prevent alert storms. Channeled alerts and automated ticketing through enterprise integrations while reserving host isolation and credential actions for analyst review, maintaining high detection fidelity through frequency thresholds, exception grouping, and benign-case baseline validation.

• PCI-DSSPayment Card Industry Data Security Standard
• CJISCriminal Justice Information Services
• ISO 27001Information security management
• HIPAAUS health data privacy and security
• GDPREU General Data Protection Regulation
• NISTNIST Cybersecurity Framework

Developed SCA baselines mapped to PCI-DSS, CJIS, ISO 27001, HIPAA, GDPR, and NIST, assigned by agent group, and ingested device telemetry with rsyslog over TLS into internal Network Load Balancers inside air-gapped VPCs with egress strictly restricted to proxy allowlists for OS updates and vulnerability feeds. Enforced least-privilege separation across Wazuh APIs and OpenSearch index patterns using role-based access controls and identity provider synchronization, deploying detection content only after staging validation, backup verification, and approved change windows.