IT Solutions & Cybersecurity

Collection & detection

• SIEM: Splunk/QRadar/ELK for log aggregation (firewalls, IDS/IPS, endpoints)
• EDR: CrowdStrike/SentinelOne for advanced endpoint threats
• NTA: network traffic analysis (DarkTrace, behavioural anomalies)
• Correlation rules & threat intelligence feeds (MISP, STIX/TAXII)

Orchestration & response (SOAR)

• SOAR: Cortex XSOAR/Demisto for response workflow automation
• Playbooks: pre-defined scenarios (phishing, malware, DDoS, data leak)
• Ticketing: ServiceNow/JIRA integration for incident tracking
• Forensics & post-mortem for continuous improvement

Response SLA

• Critical (P1): Detection <15 min, containment <30 min
• Major (P2): Detection <1 h, resolution <4 h
• Minor (P3): Detection <4 h, resolution <24 h
• Weekly/monthly reporting: incidents, false positives, MTTD/MTTR

Tier 1: Critical

RTO: <30 min | RPO: <5 min

• Synchronous active-active multi-site replication
• High-availability cluster (Pacemaker/DRBD, VMware FT)
• Automatic failover with no human intervention
• e.g. core banking, real-time billing, 911 emergency

Tier 2: Important

RTO: <4 h | RPO: <1 h

• Asynchronous replication to a remote site (50-200 km)
• Hourly snapshots (ZFS/LVM, storage replication)
• Semi-automated failover procedures (runbooks)
• e.g. ERP, CRM, e-commerce portal, enterprise email

Tier 3: Standard

RTO: <24 h | RPO: <24 h

• Daily backups (Veeam/Bacula, 3-2-1 rule)
• Offsite storage (LTO tapes, S3/Glacier cloud)
• Manual restore on cold environment
• e.g. data warehouse, archives, internal tools, dev/test

Phase 1-3: Code → Build

• 1. Code (Git): GitLab/GitHub with branch protection, MFA, signed commits
• 2. SAST: SonarQube, Checkmarx — source code scan (vulns, hard-coded secrets)
• 3. Build (CI): Jenkins/GitLab CI — compilation, unit tests, Docker image

Phase 4-5: Test → Scan

• 4. DAST: OWASP ZAP, Burp Suite — deployed app scan (XSS, SQLi, CSRF)
• 5. SCA: Snyk, Dependabot — third-party library vulns (CVE tracking, SBOM)

Phase 6-7: Deploy → Runtime

• 6. Deploy (CD): ArgoCD/Spinnaker — K8s deployment with OPA/Gatekeeper policies
• 7. Runtime protection: Falco/Sysdig — abnormal container behaviour detection

Metrics (RED/USE)

• Stack: Prometheus + Grafana for infra & application metrics
• RED: Rate (req/s), Errors (%), Duration (latency) — services
• USE: Utilisation, Saturation, Errors — infrastructure
• Multi-channel alerting (PagerDuty, Slack, SMS) with escalation

Logs (ELK Stack)

• Stack: Elasticsearch + Logstash/Fluentd + Kibana
• Structured log parsing (JSON), searchable full-text indexing
• Threshold alerts: HTTP 5xx error rates, Java/Python exceptions
• Retention policies (hot/warm/cold tiers) for cost optimisation

Traces (Distributed Tracing)

• Stack: Jaeger/Zipkin for tracing micro-service calls
• Spans with context propagation (W3C Trace Context headers)
• End-to-end latency analysis, hot paths, bottlenecks
• Trace ↔ logs ↔ metrics correlation (Grafana Tempo)

Key deliverables

• LAN/WAN, Wi-Fi, datacenter & SOC blueprint
• DRP/BCP dossiers, runbooks and procedures
• Security remediation & governance plan

KPIs & outputs

• Target RTO/RPO and availability levels
• Mean time to remediate incidents (MTTR)
• Patching & hardening compliance rate
• Application capacity & performance

Methodology

• Risk diagnosis & business priorities
• Secure design, POC/MVP and tests
• Production rollout, MCO & handover

Network & systems infrastructure

LAN/WAN, SD-WAN, Wi-Fi, datacenter, server, storage and SOC design.

• Flow mapping and segmentation
• Automation & observability
• Integration with OSS/BSS platforms

Virtualisation & private cloud

Workload modernisation, hyper-convergence, containerisation and DRP/BCP.

• Feasibility & energy ROI study
• VMware/KVM cluster deployment
• Operations runbooks & 24/7 support

Development & automation

Business applications, APIs, customer portals, DevOps scripts and document digitisation.

• Functional analysis & UX
• CI/CD software factories
• User training and adoption

Certified teams

ITIL, PRINCE2, ISO 27001, Scrum engineers and DevSecOps experts.

Security at the core

Zero Trust strategies, SOC, threat intelligence and incident response.

Flexible models

Turnkey project, T&M, service centre or full handover to internal teams.