stevenreyes.dev

Steven Reyes

Network operations engineer. Incident response, network infrastructure, and security operations.

Remote or on-site in the Tampa Bay area steven@stevenreyes.dev open to work

Sixteen years in enterprise network operations at an MSP that was acquired three times between 2009 and 2025. Each acquisition brought new tooling, new process, and a new client portfolio, so the job I started and the one I left had little in common beyond the protocols. The constant was the scale: Fortune 500 clients running hundreds of sites apiece, where a single site down meant a store, a clinic, or a distribution center offline.

Roughly half the work was reactive. I ran incidents from first alert through triage, carrier ticket, field dispatch, and Cisco TAC escalation, up to the client bridge call with an IT director or higher on the line. P1 through P3, on client networks, with someone else’s revenue on the clock.

The other half was planned: approved change requests, executed inside the maintenance window on production switches, routers, and firewalls. BGP and OSPF, MPLS and SD-WAN, policy across Palo Alto and Fortinet, DNS and IPAM in Infoblox.

Now I’m building security operations on top of that foundation.

Background

Routing and switching BGP, OSPF, MPLS, VLANs, 802.1Q, IPsec and SSL VPN, Cisco IOS, Meraki
Security Palo Alto Networks, Fortinet, Cisco ASA, Zscaler, firewall policy review, Wazuh, Suricata
Monitoring and incident management SolarWinds, LogicMonitor, ServiceNow, P1/P2/P3 incident management, Linux (Debian), Proxmox, Infoblox DNS and IPAM, Python and Bash
WAN and carrier SD-WAN (Silver Peak, HPE Aruba EdgeConnect), multi-circuit failover, Cradlepoint cellular, carrier escalation with AT&T, Verizon, Spectrum, and Lumen
Voice SIP trunking and Cisco Unified Communications incident support in production; CUCM 14, Unity Connection 12.5, dial plan and class-of-service design built and run in the homelab

Projects

My homelab runs under the same rules a client network would get. It’s also where I go deeper than the day job allowed.

Security monitoring stack

wazuh 4.14 · suricata 6.0 · graylog 7.1 · 8 agents · 3-node proxmox

Wazuh as the SIEM, Suricata feeding it, Graylog as a syslog tier for what can’t run an agent. The role boundaries are written down so the two never overlap.

The writeup covers what you’d need to rebuild it: verification you can re-run packet to alert, the gotchas that cost real time, and an honest account of a sensor that captured nothing for six months because a quiet feed and a blind feed look identical.

Wazuh Suricata Graylog OpenSearch pcap validation
published Writeup

CUCM 14 and Unity Connection 12.5 homelab

proxmox-01 · cucm-pub 14.0.1 · cuc-01 12.5 · SIP trunk · 2× 8845

A full Cisco UC stack built from the installer up, on Proxmox rather than VMware: call control, Unity Connection for voicemail over a SIP integration, and a dial plan that enforces calling privileges through partitions and calling search spaces. Includes the failures, which are the useful part.

CUCM 14 Unity Connection 12.5 SIP trunking dial plan design Proxmox
published Writeup

Alert to verdict: one Suricata detection

suricata · pcap · triage walkthrough

One alert off my own sensor, taken end to end: what fired and why, what the packet capture actually showed, what I ruled out, and how I reached a verdict. The reasoning is the point, not the tooling.

Suricata pcap analysis triage Wireshark
writeup in progress

Ansible homelab automation

ansible-core · 3-node proxmox inventory · role-per-service

Playbooks and a multi-node Proxmox inventory structure for the parts of the lab I got tired of doing by hand.

Ansible Proxmox Debian role-per-service
writeup in progress

Certifications

Microsoft Azure Fundamentals AZ-900 active
CompTIA Security+ SY0-701 in progress, exam September 2026
CompTIA CySA+ CS0-004 planned, target December 2026
CCNP Collaboration planned, CLCOR first, target Q1 2027
Cisco CCNA expired, renewing via CCNP Collaboration

Contact

steven@stevenreyes.dev github.com/reyes01101 linkedin.com/in/steven-reyes-tampa