Securing Rural Colorado with Open Source: Running a Student-Led SOC on Kubernetes
Nov 10 • 11:30 AM • Salt Palace, Ballroom BDF
How a four-VM emergency build turned into a multi-cluster Kubernetes SOC platform for ~$1,000/month: Keycloak, ArgoCD, OPA Gatekeeper, Envoy Gateway, cert-manager, and OpenSearch all run by students (and now apprentices), for underserved Colorado organizations. Architecture decisions, the VM-to-Kubernetes migration, and the mistakes along the way.
- Cybersecurity Platform Architect at the Cybersecurity Center at MSU Denver
- Building the Centurion SOC platform: production Kubernetes where student analysts investigate live threats and student developers run the GitOps pipeline
- Building custom observability and security tooling in Rust and Python for experiential learning
- Early riser who may or may not put meme videos on office TVs (⌐■_■)
- Centurion SECURED 2.0 SOC platform (private): Wazuh, DFIR-IRIS, MISP, and Keycloak SSO on DigitalOcean Kubernetes all provisioned with OpenTofu, reconciled by Flux, reached over a NetBird overlay. No human ever types a runtime secret.
- Management cluster: ArgoCD hub, OPA Gatekeeper in deny mode, Falco runtime detection, Loki/Grafana, mapped against NIST 800-207.
- otel-amdgpu-metrics: A Rust library that exports AMD GPU metrics through OpenTelemetry
- ubiquitous-cube-game: A Minecraft-style voxel engine in Python + ModernGL with infinite terrain, caves, and water
- Open Source Contributions: Giving back to the open source projects that power our infrastructure at work
- mwal.dev: My personal site, recently restyled with Frutiger Aero vibes