R. Meurlin
$ contact --now
$ contact --now
● available for select engagements

Robert Meurlin
keeps regulated
platforms online.

Infrastructure Lead & Architect — Network · Security · Observability

I design and operate the networks, firewalls, and monitoring stacks behind financial platforms — then document the architecture clearly enough that the next engineer doesn't have to reverse-engineer it at 2am.

View case studies → Book a conversation
8+ yrsARCHITECTING PROD INFRA
4 countriesMULTI-BRAND ROLLOUTS SHIPPED
2TUNNELS, ZERO SINGLE POINTS
What I do

Four disciplines, one production system.

Network, security, observability, and automation aren't separate projects — they're the same platform, looked at from different angles.

NET

Network Architecture

Site-to-site VPNs, on-prem switching fabric, and the AWS side of the wire — designed so a single tunnel or AZ loss never becomes a 2am page.

SEC

Cybersecurity & Compliance

WAF, mutual TLS, and least-privilege IAM built into the pipeline — with the audit trail regulators ask for, not bolted on after the fact.

OBS

Observability & Monitoring

Grafana, Zabbix, OpenSearch, Wazuh — dashboards and alerting tuned so the first sign of trouble isn't a customer support ticket.

AUT

Automation & IaC

Terraform, GitLab CI, config-as-code backups — the boring, repeatable path from "it works on my firewall" to production.

Selected builds

Documentation from real production work.

Company-identifying details are anonymized — the architecture, trade-offs, and failure handling are exactly as implemented.

01

Resilient site-to-site VPN — AWS ↔ next-gen firewall

A redundant, non-BGP VPN connecting an on-prem next-gen firewall to AWS over two independent IPSec tunnels, each terminating in a separate Availability Zone — with automatic failover driven by tunnel health, not routing protocol convergence.

AWS VPCPalo AltoIKE/IPSecPolicy-Based Forwarding
  • Two IKEv1 gateways with pre-shared key authentication, each mapped to its own tunnel interface and virtual router.
  • Baseline crypto profile of AES-128 / SHA-1 / DH Group 2, matching the minimum the far-end device supported.
  • Policy-Based Forwarding bound to a tunnel-monitor profile — when the active tunnel's health check trips its threshold, the PBF rule is withdrawn and traffic is re-forwarded over the standby tunnel automatically.
  • Static routing was a deliberate choice for a two-tunnel, non-BGP topology — simpler to reason about and audit than dynamic routing for this scale.
Read the full write-up →
02

Zero-touch configuration backup for a multi-vendor network

A daemonised pipeline that pulls running configs from every core switch, firewall, and edge router — Juniper, HP Aruba, Cisco IOS-XE, Palo Alto — on a schedule, and pushes them straight into a version-controlled Git repository. No manual exports, no personal access tokens.

OxidizedGitLabJuniperArubaCisco IOS-XE
  • Runs as a systemd-managed service under a dedicated, non-personal service account — restart-on-failure and boot-persistent.
  • Authenticates to Git over an SSH deploy key scoped to a single repository, rather than a personal access token tied to an individual account.
  • A post-cycle hook force-pushes the backup set to a protected branch configured to explicitly allow force pushes from the automation account only.
  • Carved out a dedicated least-privilege "view" class on Juniper devices specifically so the backup account's exports don't get redacted with ACCESS-DENIED placeholders — a common trap that silently produces useless backups.
Read the full write-up →
03

Mutual TLS at the edge for regulated integrations

Client-certificate-authenticated endpoints for integrations with national tax and credit-registry authorities, terminated on an internet-facing load balancer that validates the full client cert chain before a single request reaches the application layer.

ALB mTLSAWS ACMAWS WAFEKS
  • Application Load Balancer validates incoming client certificates against a CA bundle held in an S3-backed AWS trust store — invalid chains never reach the backend.
  • Validated traffic is forwarded to an internal load balancer and on to ingress-nginx inside an EKS cluster, keeping the mTLS boundary strictly at the edge.
  • AWS WAF sits in front of the ALB for OWASP Top-10 and bot coverage, with request logging shipped to an OpenSearch cluster for investigation.
  • Separate DEV / TEST / PROD hostnames per integration partner allowed each government-facing integration to be staged and signed off independently.
Read the full write-up →
04

WAF + CDN rollout across a multi-brand, multi-country domain portfolio

Migrated every public-facing brand domain across four countries onto CloudFront + AWS WAF — geo-fencing against a sanctioned/high-risk country list, OWASP managed rules, and centralized logging — as a scheduled, reversible cut-over that never touched how internal traffic reached the same backends.

CloudFrontAWS WAFTerraformRoute 53ACM
  • Infrastructure defined as a single reusable Terraform module, tested first against DEV/TEST domains before touching production DNS.
  • Internal DNS was left completely untouched, still resolving straight to the internal load balancer, while public DNS records were cut over to CloudFront — internal and external traffic take genuinely different, independently-verifiable paths.
  • Wildcard ACM certificates provisioned per brand domain in us-east-1, validated in Terraform ahead of the cut-over window.
  • Cut-over scheduled for a low-traffic window with a written rollback plan (revert Terraform, restore the previous public IP) and a pre-live checklist that gated go/no-go on DNS propagation checks and WAF rule verification.
Read the full write-up →
05

Resilient multi-cloud network backbone

An HA firewall pair anchoring a physical datacenter, several regional offices reached over ISP-provided MPLS, and multiple AWS accounts plus Azure — with environment-scoped tunnels and DDoS scrubbing upstream of the edge.

Palo Alto HAAWS multi-accountAzure VPN GatewayMPLS / L3VPNDDoS mitigation
  • Active/passive HA firewall pair is the single termination point for every tunnel — datacenter, offices, and every cloud account — giving one place to see, log, and fail over the whole network.
  • Tunnels are scoped per environment, not per provider: separate paths for AWS prod (split across two regions), test, and dev, so a dev-side issue can't touch production traffic.
  • Regional offices connect back over carrier-provided MPLS/L3VPN rather than public internet, terminating on a redundant, VRRP/LACP-protected edge router pair.
  • A cloud DDoS scrubbing service sits upstream of the firewall pair, keeping volumetric attacks off the firewalls' own throughput budget entirely.
Read the full write-up →
06

Monitoring & alerting: a practical framework

A monitoring philosophy built on one rule — monitoring ≠ paging. Every alert maps to a defined action, notifications and pages live on separate channels, and backups get checked by a human every morning.

ZabbixLibreNMSGrafanaOpenSearchDarktraceVeeam
  • Each tool is chosen for a specific job — Zabbix and CloudWatch for infra metrics, LibreNMS for network device discovery, Grafana as the shared pattern/trend front end, Darktrace for anomaly detection and SOC coverage, Pingdom for external synthetic checks.
  • Notifications (email, non-intrusive) and pages (SMS, emergency-only) are kept on deliberately separate channels to avoid alert fatigue and "crying wolf" fatigue.
  • No alert exists without a defined, owner-authored action behind it; automatable responses are automated, but the root cause still gets fixed, not just the symptom.
  • Backup status is reviewed by a person every morning — illustrated with a real resolved incident: a VSS snapshot failure traced to a specific writer and fixed with a targeted service restart.
Read the full write-up →
07

HAProxy as a self-healing internet gatekeeper

An active/passive HAProxy pair handling every inbound web request, with keepalived-driven Elastic IP failover, SELinux hardening, and fully automated certificate renewal across both nodes.

HAProxykeepalivedAWS Elastic IPSELinuxLet's Encrypt
  • Both an external and an internal Elastic IP move together on failover, so HAProxy is reachable as one logical entity from the internet and from the internal network alike.
  • The failover script runs as a dedicated IAM user scoped only to Elastic IP association — not general EC2 administration.
  • A specific SELinux boolean (haproxy_connect_any) has to be enabled, or HAProxy loses upstream connectivity the moment the Elastic IP changes on the interface after a failover.
  • Let's Encrypt renewal is synced identically to both nodes with an automatic reload hook, so a failover never exposes a stale certificate on the standby.
Read the full write-up →
08

Patch visibility and control with PatchMon

Fleet-wide Linux patch visibility with an outbound-only agent — no inbound port opened on any managed host — plus a dry-run → approve → deploy workflow that leaves a real audit trail.

PatchMonapt / dnf / yumPatch complianceOpenSCAP / CIS
  • Every managed host's agent connects outbound-only to the PatchMon server — nothing to open inbound, no SSH exposure to justify to a security review.
  • One agent binary handles apt, dnf/yum, apk, and pacman, so a mixed Debian/RHEL/Alpine/Arch fleet is one workflow rather than one per distro family.
  • Every patch run previews as a dry-run first; approving it turns the plan into a real run with a per-host audit trail of who approved what and when.
  • OpenSCAP/CIS compliance scanning tracks a score over time, so "prove your patch posture" is already sitting in the dashboard rather than a manual evidence hunt.
Read the full write-up →
Track record

Experience

Twenty years, one thread: keeping infrastructure running, secure, and legible to whoever inherits it next.

2018 — Present

Avida Finans AB · Tech Lead & Architect

Stockholm, Sweden. Own network and security architecture across AWS and on-prem — EKS, OpenSearch, Grafana, Zabbix, Terraform, HAProxy, Palo Alto, Juniper, HP Aruba. Built the Layer 2/3 backbone (RSTP + BGP) linking on-prem sites to cloud across countries.

2017 — 2020

B3 Consulting Group · Consultant

Stockholm, Sweden.

2013 — 2017

SVT · DevOps

Stockholm, Sweden. Infrastructure for public-broadcaster systems including SVT Play, Text-TV, and subtitle pipelines.

2015 — 2017

Init AB · Linux Consultant

Stockholm County, Sweden.

2012 — 2015

Lexher IT · Open Source Consultant, IO Virtualization Engineer

Stockholm, Sweden.

2013

Bahnhof · Linux Consultant, Managed Services

Stockholm, Sweden.

2013

H&M · Linux / RedPrairie Consultant

GWMS project, Stockholm Liljeholmen — Linux and RedPrairie (Java) implementation in production.

2010 — 2013

Mid Sweden University · Teacher, Network Monitoring

Distance-taught and designed a 7.5hp course covering Nagios/OP5, SCOM, Wireshark, SNMP, and MRTG — wrote the material, labs, and exam.

2007 — 2012

Fujitsu · Infrastructure Engineer

2004 — 2006

Unicorn · Technician, Developer

Linux/Slackware platform work, plus development in PHP, Python, and Perl against MySQL, MSSQL, and Oracle.

Education

KTH Royal Institute of Technology

BSc, Computer Science · 2000–2005

Education

Stockholm University

Fil. Kand. 180hp, Data Systemvetenskap · 2001–2004

Languages

Swedish · English · Norwegian

Full professional proficiency

Off the terminal: Chairman, Hjorthagen Tennis Club (2010–2023) and IK Wasa sports club (2005–2010) — running a volunteer organization is its own lesson in incident response and stakeholder management. Also plays tennis, padel, football, and floorball.
Toolbox

Skills & platforms

Cloud & Platform

AWS VPCEKSCloudFront AWS WAFRoute 53 / DNSSECACM CloudWatchAWS Backup

Network & Security

Palo AltoJuniperHP Aruba Cisco IOS-XEIPSec / IKEBGP RSTPHAProxyLet's EncryptWazuh

Observability

GrafanaZabbixLibreNMSOpenSearch / ELK CloudWatchOxidized

Automation & Data

TerraformGitLab CIPatchMonJira ConfluenceSonarQubeMongoDB Atlas PostgreSQLMySQL
Let's talk

Open to select infrastructure & security engagements.

Whether you need a fractional infrastructure lead, an outside review of your network and security posture, or someone to own a cloud migration end to end — I take on a small number of engagements at a time.

  • Fractional Infrastructure Lead / Architect roles
  • Network & security architecture reviews
  • Cloud + on-prem migration projects
  • Observability & automation build-outs
Emailrobert@meurlin.se
LinkedInin/meurlin
LocationStockholm, Sweden
Status● open to select work
Send an email