Senior Linux Systems Administrator HRL Laboratories (IBM Research) Thousand Oaks, CA
I keep hardened Linux fleets and HPC clusters running in an environment where every host is audited, every binary is allowlisted, and downtime is expensive.
RHEL and Oracle Linux under STIG, SELinux enforcing, Active Directory identity, Ansible everywhere. At home the same instincts point at Raspberry Pis, sensors, and a garden that waters itself.
Day job at HRL Laboratories, now IBM Research. Regulated environment, so specifics stay general.
RHEL, Oracle Linux, and Rocky built and maintained against DISA STIG and SCAP baselines, with SELinux enforcing, fapolicyd allowlisting, FIPS mode, and Duo MFA on privileged access. Built the scanning and remediation pipeline on OpenSCAP and SSG with per-host weighted scoring, fleet-wide dispatch, worst-first ranking, and a documented exception set. New builds went from roughly 79 percent to 95 percent.
Patch automation for around 90 Enterprise Linux hosts on Foreman and Katello pull-mode remote execution, with no standing privileged credential and no MFA exemption. The Ubuntu counterpart runs on self-hosted Canonical Landscape across 80 hosts: a six-phase monthly orchestrator driven through the API, with pre-snapshot capture, dispatched reboots, and post-reboot verification.
Carried Foreman and Katello from 3.17 to 5.0 across three sequential major hops on 2,037 repositories, and Landscape from 24.04 to 26.04, which meant dropping and rebuilding the entire published mirror estate. Also recovered an airgapped Red Hat Satellite 6 that had been offline for months.
Slurm with munge authentication and Warewulf stateless provisioning across CPU and GPU compute fleets, login nodes, and shared NFS home and scratch storage. HPE ProLiant and Synergy hardware, NVIDIA GPU and NVSwitch systems, out-of-band management, firmware and driver lifecycle, and the unglamorous root-cause work when a node starts locking up at 3 a.m.
Active Directory integration across the Linux estate with SSSD and Centrify/Delinea, Kerberized file shares through autofs with sec=krb5 and multiuser, and Duo MFA and SSO over SAML and OIDC. Single sign-on for the Atlassian stack delivered with mod_auth_mellon at the TLS front end.
Established before the first patch window that a full-upgrade policy would silently replace FIPS-certified crypto, OpenSSH included, on FIPS-enabled hosts, because the standard builds outrank the FIPS ones in package ordering. Caught HTML markup from a STIG rule’s fix text written verbatim into kernel arguments on EL8 hosts, which GRUB parses as a redirect and which would have stopped every affected host booting at its next reboot.
Found that Ubuntu Pro ESM content was not reaching an 80-host fleet while every host reported the services enabled, and traced it to two independent causes at the source rather than the clients. Then found the same remediation was being defeated by cloned machine identities: 30 target hosts presenting only seven distinct IDs, so each attach silently overwrote the last.
Recovered roughly 80 TB of research data after a storage controller failure left an array unreadable. The volume was too large to back up, automated rebuild had already failed, and the configuration was rebuilt by hand to restore full access. Also brought back Hadoop master and secondary nodes from boot failures, a JFrog Artifactory instance after database lock corruption, and a Jira Data Center login outage traced to a JVM truststore gap in the LDAPS chain.
Confluence and Jira Data Center across separate application and PostgreSQL tiers with staging parity, Mattermost on RHEL 9, and NoMachine with VirtualGL for GPU-accelerated remote desktops. A self-hosted GitLab at enterprise scale: 3,000+ projects, 460 seats, and roughly 140 registered runners. Laboratory instrumentation hosts running National Instruments PXI driver stacks against wafer-probe hardware.
FlexLM and OpenLM behind the EDA and simulation tooling, keeping expensive seats available to the engineers who need them and visible to the people paying for them. Tracked down long-unnoticed faults, then added Nagios monitoring across every license so failures surface before users do.
Built because I wanted them to exist. Source on GitHub, mirrored from my own GitLab.
Raspberry Pi Flask KiCad
A seedling controller on a Pi Zero 2 W. PWM grow light with daily light integral tracking against a target, Camera Module 3 timelapse with an alignment viewfinder, soil moisture probes, and non-contact reservoir sensing that refuses to run the pump dry and pings me when it does. Health reports are generated from the sensor history.
Currently laying out its first custom full-size Pi HAT in KiCad, USB-C powered, assembled at the fab.
Raspberry Pi ESP32 MicroPython
Monitoring and automatic watering for two raised strawberry beds. Wireless ESP32 sensor nodes report moisture and climate to a Flask dashboard backed by SQLite, and the irrigation decides for itself when the beds need a drink.
Formerly openGardener. Same home server, same nginx, one more thing to keep alive.
Embedded control
An autonomous surface vessel project: navigation, control, and telemetry on small hardware. Developed on my self-hosted GitLab and mirrored out to GitHub.
HomeLab
A Proxmox cluster behind one nginx reverse proxy and a single public IP, fronting about fifteen services: GitLab with runners, NetBox, Proxmox Backup Server, a GPS-disciplined NTP server, and uptime monitoring. Everything runs the same controls I use at work, scaled down: per-vhost CSP and HSTS, Cloudflare origin certs with automated renewal, and nightly config sync to Git so nothing lives only in my head.
Live public
A GPS-disciplined stratum 1 NTP server on a Raspberry Pi, with a live status dashboard for chrony: satellite lock, offset, jitter, and drift over time.
An uptime dashboard for the services on my LAN, exposed publicly so I can check it from anywhere. Some of what it lists is down on purpose.
Open to the internet on purpose. The rest of the lab stays on the LAN.
Break keyboard only
Tap a cell, then a digit.
Boards I design in KiCad. Drag to spin it.
loading the board…
The 3D view needs WebGL, which this browser has turned off.
My first circuit board. It plugs onto the Raspberry Pi that runs my seedling trays and gives its sensors and pump proper connectors on one board.
The grow light runs on wall power, so I kept that off the board and let a smart plug switch it. Everything on the HAT stays low voltage, and JLCPCB builds it fully assembled.
Next is a second version that adds a small motor to move a sensor mast over the trays.
Things I use often enough to have opinions about.
Email is best. I read it more reliably than anything with a notification badge.