Networks that stay up. Attackers that don't get in.
Infrastructure and network security engineer with 22 years in the field, more than a decade of it designing and running Fortinet environments: SD-WAN, zero trust access, segmentation and deception.
Engagements
Client names are withheld. Filter by discipline, then open any engagement for the problem, the change and the result.
- ProblemExpensive MPLS circuits and slow point-of-sale traffic at peak hours.ChangeDual-broadband SD-WAN with SLA steering and zero-touch provisioning from FortiManager.ResultAdd the outcome in the editor.
- ProblemAny laptop with VPN credentials could reach the whole internal network.ChangeZTNA with EMS posture tags and certificate identity, rolled out one user group at a time.ResultAdd the outcome in the editor.
- ProblemOT devices shared a flat network with office users.ChangeNAC-driven segmentation on FortiSwitch, with decoys placed on the OT side.ResultAdd the outcome in the editor.
- ProblemCoverage gaps and guests on the same broadcast domain as staff.ChangeFortiAP redesign with dynamic VLANs, guest isolation and FortiLink-managed switching.ResultAdd the outcome in the editor.
- ProblemPer-device configs drifting across dozens of FortiGates.ChangeADOM layout, templates and meta variables so every site deploys from one source of truth.ResultAdd the outcome in the editor.
- ProblemNo early warning of lateral movement inside the network.ChangeFortiDeceptor lures placed along real admin paths, alerts routed through FortiAnalyzer.ResultAdd the outcome in the editor.
- ProblemYears of policy sprawl nobody wanted to touch.ChangePolicy clean-up, logging fixes and a hardened baseline across the Fabric.ResultAdd the outcome in the editor.
What I build, as policy
Design, deployment and tuning across the Fortinet stack. I stay through cutover and hand over documentation your team can run with.
SD-WAN design
Move off MPLS without a flag-day outage.
- SLA probes that match real application health
- FortiManager templates for repeatable rollouts
- Phased cutover with rollback at every step
Zero trust access
Access based on who the user is and the state of their device.
- EMS tagging and posture tied to policy
- FortiAuthenticator SSO, MFA and certificates
- ZTNA gateways and staged VPN retirement
Segmentation
Limit how far an attacker can move.
- VLAN and policy design on FortiSwitch
- FortiAP wireless with guest isolation
- NAC for IoT and unmanaged devices
Deception
Decoys that only an attacker would touch.
- Lure placement from real traffic patterns
- Alert routing into FortiAnalyzer and your SOC
Everything else
If it isn't explicitly allowed, it doesn't pass.
Lab notes
Field-tested write-ups from real deployments and the home lab: configs, gotchas and the reasoning behind the design.
The first lab notes are on the way.
Credentials
Management certifications to translate risk for leadership. Vendor depth to build what I recommend.
Security leadership
Fortinet
Cisco
About
22 years in infrastructure and network security, more than ten of them building and running Fortinet environments: FortiGate, FortiSwitch, FortiAP, FortiManager, FortiAnalyzer, FortiAuthenticator and SD-WAN, and more recently EMS and FortiDeceptor.
I work best with teams that want a network they understand. Every engagement ends with documentation and a walkthrough, so your engineers can operate and change what I built. Résumé available on request.