Subin S.

Overview: I secure and segment the infrastructure businesses cannot afford to lose: industrial control networks, production servers, and the boundary between corporate IT and operational technology. 100% Job Success | Top Rated | 1,700+ hours on Upwork. Most of my recent work is OT/ICS: designing and building the controlled access path between an enterprise network and a manufacturing environment, so engineers and vendors can reach plant systems without exposing them. I also do the underlying Linux work that makes it hold together, identity, DNS, time, storage, monitoring, and I document it to a standard that survives an audit. OT / ICS security: - IT-to-OT network segmentation to the Purdue model (Levels 0-5), aligned to IEC 62443 zone-and-conduit principles - Brokered remote access for OT: Apache Guacamole broker, DMZ jump hosts, session mediation, no direct IT-to-OT reach - OT DMZ design and build: controlled realm transition, vendor access mediation, deny-by-default firewall posture - Separate OT identity infrastructure: Samba Active Directory, BIND9 DNS, chrony NTP, Kea DHCP, independent of corporate IT - Air-gapped and internet-restricted environments: internal package mirrors, offline patching workflows, no-egress operation - SCADA/historian platforms: Ignition Gateway, Microsoft SQL Server historians, OT-to-IT one-way data push - Industrial network hardware: Cisco IE-series switches, Sophos XGS firewalls, VLAN segmentation for production lines - Vendor remote access control: time-bound, logged, restricted to approved systems What I deliver: - Wazuh SIEM/XDR deployment: full setup, agent enrollment, custom rules, dashboards, and alerting across Linux and Windows endpoints - Server monitoring stacks: Wazuh, Zabbix, Nagios, Grafana, deployed and tuned to cut alert noise - High availability for infrastructure services: keepalived/VRRP virtual IPs, PostgreSQL replication, HAProxy ingress - Active Directory integration across Linux and Windows: realmd/SSSD, Kerberos, keytabs, group-based authorisation - Linux server hardening to production-grade standards (Ubuntu, Debian, CentOS) - Firewall policy design and enforcement (UFW, iptables, pfSense) - ZFS storage and immutable backup design: snapshot policy, retention, SMB file services, restore validation - DNS architecture with failover, DNSSEC, and SPF/DKIM/DMARC for email security - Virtualization platforms: Proxmox VE, Scale Computing HyperCore, VMware - Windows Server and SQL Server administration: domain join, role-based access, cumulative update management - Cloud infrastructure security across AWS, Azure, GCP, and DigitalOcean - NGINX and Apache optimization for high-traffic environments - CI/CD pipeline security and infrastructure automation with Docker and Bash - VAPT: vulnerability assessment & penetration testing, with formal reporting and remediation timelines - Log analysis, threat detection, and incident response - Build records, runbooks and validation evidence, every change documented, reversible, and auditable Recent work: - Built the controlled access path between an enterprise network and a manufacturing plant: Guacamole access broker, IT-side and OT-side jump hosts, dual-realm Active Directory, and the firewall rule set to go with it. Engineers and vendors reach production systems through one audited, revocable path instead of direct connections. - Deployed an OT file services platform on Debian with OpenZFS and Samba: six access-controlled shares for PLC projects, vendor files, gauge exports and database backups, with snapshot retention and least-privilege service accounts proven by test rather than assumed. - Found and fixed a realm-wide time service that had never worked: the NTP servers were synchronised but serving no clients, and the build-time validation checked the wrong side. The site firewall and several infrastructure hosts had been silently unsynchronised for months. Kerberos authentication depends on this. - Migrated an industrial database platform to a segmented OT zone: Windows Server 2022 and SQL Server 2022, domain-joined, with group-based sysadmin delegation replacing shared credentials, and a documented single revocation point per host. - Deployed and managed Wazuh SIEM across multi-server environments with real-time alerting and compliance monitoring. - Handled a live credential-exposure incident: hardcoded admin credentials pushed to a public repository. Full key rotation and git history remediation, zero downstream compromise. - Delivered a full VAPT engagement for a mid-market client with a structured draft-to-final reporting cycle. - Rebuilt email security posture (SPF, DKIM, DMARC) for a client domain from a failing state to fully compliant. Experience includes serving as Cybersecurity & Infrastructure Manager for a venture firm, Senior DNS & Network Security Engineer at a security company, and Infrastructure & Security Consultant for a US-based consulting firm. I respond within 5 hours.