# Noa Matout | Systems, network and security engineer Language: en I operate. I measure. I write. I run 150 virtual machines Linux and 30 Windows, on VMware vSphere. I am available for a job or a freelance mission. ## I sort out what matters. Sentinelle, my triage tool for Windows logs. The rules detect; the model only explains. - Windows server : EVTX logs. 5,486,961 events read. - Event store : none discarded. 185,232 evaluated. - Sigma rules : 1,762 variants. 1,111 detections. - Noise reduced : 9 alerts in. 5 visible alerts. - Local LLM : cases and verdicts. - Incident story : on demand. What is left to read : 5 visible alerts, once the noise is handled by justified, dated exceptions. No threat. Two are my own administrator actions, run to check the logging. Three concern executions whose parent process Sysmon had lost: an exception based on the parent cannot hide them, and that is intended. The command line of created processes went from 0% to 100% after hardening, a switch visible to the hour. One Windows test server, exported twice. The dotted steps are planned: no figure appears on them. Detection decides, AI explains. ## 01 My articles [I split my assistant in two](/en/articles/personal-agent-two-profiles/) I split my personal agent into two profiles. I found six failures, five of them silent. [I scored my own MCP server](/en/articles/auditing-my-own-mcp-server/) Everyone audits other people's servers. I measured mine, and a good score did not mean a closed door. [A protection I never saw refuse anything does not exist](/en/articles/negative-control/) I built a private site, then tried to prove it was leaking: two of my protections did not hold. [My watch talks to Claude, on conditions](/en/articles/garmin-mcp-server/) I wrote an MCP server to query my Garmin training data. Real data broke three things my tests could not see. ## 02 My projects ### I bound contractor access I had to replace contractors’ VPN access with access limited to their intervention. I led the project alone, from the study to maintenance. I chose Apache Guacamole for browser-based access with session recording. 100% of contractor access goes through the bastion. I have neither the commercial support nor the secret discovery and rotation features of paid privileged access management products. ### I take back control of an inherited access I had to replace an unsecured VNC access, deployed long ago by an old script. I replaced that access with centralised remote control. I chose MeshCentral, with named accounts and multi-factor authentication. I migrated about 1,300 workstations, with one month of coexistence and a deployment through group policy. I also have to maintain the agent installed on the workstations, and check how it behaves when it loses contact with the console. ## 03 My background - Systems, network and security engineer, freelance, Supplay : October 2026 / Today - Network and systems engineer, Supplay : October 2024 / October 2026 - Co-founder, ZON : January 2026 / Today - Network and systems administrator, Supplay : October 2023 / October 2024 - IT maintenance and support officer, Supplay : September 2021 / September 2023 23 years old. Age declared on September 21, 2026. Before 2021, I did a civic service in digital inclusion and a three-year apprenticeship in winegrowing. I retrained in IT in 2021. - Master’s degree in IT security (Mastère) (French level 7 certification: IT Engineering Expert), ESGI, 2024 / 2026 : Awaiting validation - Bachelor’s degree in IT security (French level 6 certification: Systems, Network and Security Project Manager), ESGI, 2023 / 2024 - Systems and networks training, CESI, 2021 / 2023 - Vocational baccalaureate in vineyard and winery management, CFA d’Avize, 2017 / 2020 TOEIC 800 self-reported, taken on January 10, 2026. ## What I work on - Systems and network operations - Automating procedures with AI - Security applied to automation I automate the management of the Linux fleet with Ansible. I do not use declarative management on the Windows side. ## 04 Contact me For the details, write to me. [Contact me by email](mailto:noamatout@gmail.com) [See my professional profile](https://linkedin.com/in/noa-matout) [See my freelance profile](https://www.malt.fr/profile/noamatout) [See my public repositories](https://github.com/NoaMatout) ## Verifiable facts - person:noa-matout:/fullName : Noa Matout - person:noa-matout:/localized/en/jobTitle : Systems, network and security engineer - person:noa-matout:/city : Reims - person:noa-matout:/declaredAge : 23 - person:noa-matout:/declaredAgeOn : September 21, 2026 - person:noa-matout:/estate/virtualMachines/0/count : 150 - person:noa-matout:/estate/virtualMachines/1/count : 30 - person:noa-matout:/estate/virtualMachines/0/operatingSystem : Linux - person:noa-matout:/estate/virtualMachines/1/operatingSystem : Windows - person:noa-matout:/earlierCareer/en : Before 2021, I did a civic service in digital inclusion and a three-year apprenticeship in winegrowing. I retrained in IT in 2021. - person:noa-matout:/availability/status : I am available - person:noa-matout:/availability/engagements/0 : a job - person:noa-matout:/availability/engagements/1 : a freelance mission - person:noa-matout:/estate/virtualization : VMware vSphere - person:noa-matout:/estate/linuxAutomation : Ansible - person:noa-matout:/estate/windowsDeclarativeAutomation : I do not use declarative management on the Windows side. - person:noa-matout:/education/0/localized/en/title : Master’s degree in IT security (Mastère) - person:noa-matout:/education/0/localized/en/certification : French level 7 certification: IT Engineering Expert - person:noa-matout:/education/0/institution : ESGI - person:noa-matout:/education/0/status : Awaiting validation - person:noa-matout:/education/0/startYear : 2024 - person:noa-matout:/education/0/endYear : 2026 - person:noa-matout:/education/1/localized/en/title : Bachelor’s degree in IT security - person:noa-matout:/education/1/localized/en/certification : French level 6 certification: Systems, Network and Security Project Manager - person:noa-matout:/education/1/institution : ESGI - person:noa-matout:/education/1/startYear : 2023 - person:noa-matout:/education/1/endYear : 2024 - person:noa-matout:/education/2/localized/en/title : Systems and networks training - person:noa-matout:/education/2/institution : CESI - person:noa-matout:/education/2/startYear : 2021 - person:noa-matout:/education/2/endYear : 2023 - person:noa-matout:/education/3/localized/en/title : Vocational baccalaureate in vineyard and winery management - person:noa-matout:/education/3/institution : CFA d’Avize - person:noa-matout:/education/3/startYear : 2017 - person:noa-matout:/education/3/endYear : 2020 - person:noa-matout:/experience/0/localized/en/title : Systems, network and security engineer, freelance - person:noa-matout:/experience/0/organization : Supplay - person:noa-matout:/experience/0/start : October 2026 - person:noa-matout:/experience/1/localized/en/title : Network and systems engineer - person:noa-matout:/experience/1/organization : Supplay - person:noa-matout:/experience/1/start : October 2024 - person:noa-matout:/experience/1/end : October 2026 - person:noa-matout:/experience/2/localized/en/title : Co-founder - person:noa-matout:/experience/2/organization : ZON - person:noa-matout:/experience/2/start : January 2026 - person:noa-matout:/experience/3/localized/en/title : Network and systems administrator - person:noa-matout:/experience/3/organization : Supplay - person:noa-matout:/experience/3/start : October 2023 - person:noa-matout:/experience/3/end : October 2024 - person:noa-matout:/experience/4/localized/en/title : IT maintenance and support officer - person:noa-matout:/experience/4/organization : Supplay - person:noa-matout:/experience/4/start : September 2021 - person:noa-matout:/experience/4/end : September 2023 - person:noa-matout:/credentials/0/score : 800 - person:noa-matout:/credentials/0/takenAt : January 10, 2026 - project:bastion-prestataires:/localized/en/problem : I had to replace contractors’ VPN access with access limited to their intervention. - project:bastion-prestataires:/localized/en/role : I led the project alone, from the study to maintenance. - project:bastion-prestataires:/localized/en/choice : I chose Apache Guacamole for browser-based access with session recording. - project:bastion-prestataires:/localized/en/coverage : 100% of contractor access goes through the bastion. - project:bastion-prestataires:/localized/en/limit : I have neither the commercial support nor the secret discovery and rotation features of paid privileged access management products. - project:acces-distance:/localized/en/problem : I had to replace an unsecured VNC access, deployed long ago by an old script. - project:acces-distance:/localized/en/role : I replaced that access with centralised remote control. - project:acces-distance:/localized/en/choice : I chose MeshCentral, with named accounts and multi-factor authentication. - project:acces-distance:/localized/en/scale : I migrated about 1,300 workstations, with one month of coexistence and a deployment through group policy. - project:acces-distance:/localized/en/limit : I also have to maintain the agent installed on the workstations, and check how it behaves when it loses contact with the console. - graph:sentinelle:/flows/serveur : 5,486,961 - graph:sentinelle:/flows/base : 185,232 - graph:sentinelle:/flows/regles : 1,111 - graph:sentinelle:/flows/bruit : 5 - graph:sentinelle:/remaining : 5 - graph:sentinelle:/caption : Detection decides, AI explains. - article:controle-negatif:/measurements/controls/value : 2