Jonathan Joly · cloud cybersecurity engineer at Saint-Gobain
Secure.
Document.
Demonstrate.
I design, secure and run hybrid infrastructure, from Active Directory hardening to GitOps on Kubernetes.
This site applies the practices I use every day. Its configuration, services and their status are detailed below, and anyone can check them with independent public tools.
This site's configuration
HTTP headers · curl -I https://jjoly.eu
- Content-Security-Policy✓ applieddefault-src 'none' · no unsafe-inline
- Strict-Transport-Security✓ appliedmax-age 2 years · includeSubDomains · preload
- Permissions-Policy✓ applied17 browser APIs denied
- Origin isolation✓ appliedCOOP · CORP · COEP
- TLS certificate✓ appliedLet's Encrypt via cert-manager, renewed automatically
- security.txt✓ appliedRFC 9116 · /.well-known/security.txt
- Trackers and cookies✓ applied0 · no third-party resource
7 / 7 good practicesDetails and verification (FR) →
tldrIn 30 seconds
- Role
- Cloud cybersecurity engineer (work-study) at Saint-Gobain, Paris
- Experience
- Since 2022: systems & network administrator, then Head of Information Systems at engIT
- Education
- MSc Cybersecurity & Cloud, IPSSI Nice · Google Cloud Digital Leader
- Proof
- 3 services in production on my own Kubernetes cluster, this site included
pipelineFrom commit to production
This site ships through the same pipeline as my applications: no manual step, and the CI has no access to the cluster.
- Commit to mainThe site's GitHub repository
- CI checksTemplates, diagrams, FR/EN consistency, probes
- ImageBuilt and pushed to GHCR
- Tag in jjoly-infraThe CI only writes to Git
- Flux CDThe cluster pulls and applies the state
- LiveNon-root nginx behind Traefik, TLS
skillsSkills
🛡Security
- Active Directory / GPO hardening
- Internal PKI, SSL/TLS (Let's Encrypt)
- VLAN network segmentation
- Vulnerability assessments (OpenVAS, Nessus)
- EDR (CrowdStrike), Fortinet VPN/firewall
☁Cloud & Containers
- Docker, Kubernetes (k3s), GitOps (Flux CD)
- CI/CD: GitHub Actions, GitLab CI
- Azure, AWS, OVH Cloud
- Infrastructure as code: Terraform, Ansible
- Encrypted secrets (SOPS/age)
📡Monitoring & Resilience
- Prometheus, Grafana, Node Exporter
- 3-2-1 backup strategy (Burp)
- Disaster recovery plan & regular restore tests
- Proxmox: clustering & high availability
⌨Systems & Scripting
- Windows Server (AD, GPO, PKI)
- Linux (Debian), UFW / iptables
- Bash, PowerShell, Python, SQL
- IS documentation & governance (BookStack)
experienceExperience
Cloud Cybersecurity Engineer (work-study)
Saint-Gobain, Group Digital & IT International — Paris · hybrid
- Day-to-day monitoring of the group's cloud environments against internal cybersecurity policies
- Operating and following up the group's cloud security tooling, supporting the existing security teams
- Automation and infrastructure as code: Terraform, Ansible, GitHub Actions pipelines
- Scope: the entire group, Azure environments
Head of Information Systems (apprenticeship)
engIT — Valbonne, France
- Designed and deployed a hybrid on-premise ↔ cloud architecture
- Hardened security policies: VLANs, internal PKI, CrowdStrike EDR, UFW/iptables firewalling
- Ran vulnerability assessments (OpenVAS/Nessus) and remediated critical findings
- Built CI/CD pipelines (GitHub Actions, GitLab CI) and containerised workloads
- Prometheus/Grafana monitoring, 3-2-1 backups, tested disaster recovery plan
- IS governance: centralised documentation, budget, reporting to management
Systems & Network Administrator
engIT — Valbonne, France
- Windows Server administration: AD, hardening GPOs, certificates
- Secured remote access (Fortinet VPN/firewall), audited permissions
- Linux (Debian) maintenance, Proxmox virtualisation
- Bash/PowerShell automation, end-user training
Academic background
- 2025+ · MSc Cybersecurity & Cloud — IPSSI Nice
- 2024-2025 · BSc Network Administration & SecOps, DevOps track — IPSSI Nice
- 2022-2024 · Two-year technical degree in Computer Science (work-study) — IUT Sophia Antipolis
- 2023 · Google Cloud Certified — Cloud Digital Leader
- 2019-2022 · French Baccalauréat, awarded with merit
projectsProjects
Frigo Adaptatif
Self-hosted food-waste tracker: fridge inventory (barcode, photo, receipt), fully local meal planning, run-out forecasting, cost & seasonality, guests & dietary requirements. AI optional and clearly labelled. Single-binary Go backend, PWA, GDPR by design.
Coach Adaptatif
Self-hosted strength-training coach that models physiology in real time (Banister model, Kalman filter, MEV/MRV volume landmarks). Single-binary Go backend, GDPR by design, mandatory 2FA.
k3s GitOps infrastructure
The platform serving this page: single-node Kubernetes tuned for 1.8 GB of RAM, Flux CD, SOPS/age encrypted secrets, cert-manager, NetworkPolicies, full CI/CD — push to main means deploy.
Agent Cockpit
A local-first AI agent orchestrator built as a Mac app: task queue, one isolated git worktree per task, explicit permission scope, and nothing executed without human approval. 148 tests, 13 agent roles.
Securing a corporate IS
End-to-end modernisation of a hybrid infrastructure: internal PKI, EDR, VLAN segmentation, disaster recovery, monitoring and 3-2-1 backups. Delivered at work, presented in anonymised form.
Verifiable
| Service | Version in production | At last build | Response time | TLS certificate |
|---|---|---|---|---|
| Frigo Adaptatif | v4.2.1 |
returned 200 | 789 ms | valid until 2026-12-13 |
| Coach Adaptatif | v0.2.5 |
returned 200 | 906 ms | valid until 2026-12-11 |
| jjoly.eu | sha-bd8fa59 |
returned 200 | 859 ms | valid until 2026-12-11 |
contactContact
Collaboration, a technical exchange, or just an infra/security question — my inbox is open.
The technical notes are written in French and not machine-translated here: a stale translation would be worse than none. The stack write-up and the case studies are available in English. Happy to walk through the notes in English too.