Security and observability for teams without a security team.

One SRE, two regions, one security platform in production. What the architecture looks like, what the AI agents did, where they burned me, and what I would not do again.

We gave the deploy pipeline the same deal a human operator gets: file a change, get a window, do the work, get locked out again. This week a build rode the whole loop with zero human touches.

A customer asked for your SOC 2 report and you have no security team. Here is the order I would do things in, from someone who builds compliance tooling and runs production for a living.

A monitoring agent is supposed to be the lightest thing on the box. Ours ate a small host alive - and the command path that could have fixed it remotely was broken in the same binary. A post-mortem.

eBPF gives you every exec on a host, far more than anyone can read. How our agent DDoSed itself with docker inspect, why container healthchecks are the loudest thing on a server, and the filtering that turned a firehose into a signal.

We shipped SSH auto-blocking and it promptly banned our own ops IP. A staging story about automation that locks you out, an unnecessary server reset, and designing auto-response you can survive.