Portfolio — Irfan Haris

2025 — now · ICT Manager · IT Security & Architecture

Full-stack ICT Modernization — PT SLS Group

Owning the full ICT lifecycle for SLS Group head office and all branches — hybrid infrastructure, cybersecurity, observability, BI, and emerging AI/IoT initiatives.

→Hybrid infrastructure (cloud + on-prem) optimization — reduced IT operational cost
→Inter-site & head-office telecommunication efficiency improvements
→Next-Generation Firewall architecture; server hardening across infrastructure
→Secure remote access deployed via OpenVPN
→Designed S3-based internal storage with security hardening for internal apps
→Built enterprise Data Platform — improved reporting & BI performance
→Open-source BI rollout (Metabase + Superset); embedded dashboards in internal apps
→Centralized observability stack: Zabbix · Grafana · Prometheus · Loki
→Developed Fleet Management System and Intelligent Video Management System (IVMS)

SAP B1OdooMetabase / SupersetZabbixGrafanaPrometheusLokiFortigate NGFWOpenVPNS3IoT

2022 — 2025 · Senior IT Infrastructure — SME

Org-wide Observability, SIEM & Automation — Kawan Lama Group

Subject Matter Expert across a 700+ server estate. Built monitoring, logging, automation, and IoT capabilities; partnered with the SOC on detection.

→Network automation with Ansible + Python — 50% less manual configuration work
→Proxmox VE virtualization cluster (R&D + blackbox) — reduced server utilization cost
→Enterprise monitoring across all stores & servers: Zabbix · Grafana · Prometheus · Loki
→NetFlow analytics on ELK Stack; Graylog cluster centralizing logs from firewall, WAF, server, network, application, EDR
→New Relic APM deployment for application visibility; hybrid observability platform
→R&D for Breach Attack Simulation; PoCs on PICUS, Infection Monkey, Darktrace AI; Cybereason EDR integrated into Graylog cluster
→IoT for smart retail: people-counting sensor, computer vision, IoT gateway + data pipeline, dashboard application

PrometheusGrafanaZabbixLokiGraylogELKWazuhNew RelicAnsibleProxmoxIoTComputer Vision

2010 — 2021 · Network Engineer → IT Section Head

Mining ICT Across 3 Districts — PAMA (ADARO · MTBU · ASMI)

A decade leading IT infrastructure and innovation across three PAMA mining districts: network design, data centers, wireless, security, communications, and IoT for 24/7 mining operations.

→High-availability network across mining sites — 38 km OFDM wireless @ 180 Mbps; later 300+ Mbps over 20 km; Cisco Mesh Aironet 1500 in PIT mining
→FMS network performance: -30% OPEX, +25% real-time data reliability, +5% optimization
→Dynamic routing & load balancing; SD-WAN site-to-HO with FortiGate NGFW
→MPLS migration: VSAT → MPLS → VPN/dedicated internet via ASTINET
→Built/upgraded multi-site data centers — dual-source power failover, high-cap UPS, PAC, raised floor, fire suppression
→Data center rejuvenation: recabling, rewiring, SOP & documentation
→Smart Mobile Tower (IoT-based); Telkomsel partnership for 4G in mining areas; tower-lamp wireless optimization
→Cisco NAC + ASA 5500 integration with PT Adaro Energy; load-balanced segmentation
→Cisco VoIP rollout multi-site (CUCM + Cisco Router 2800)
→Cacti-based monitoring with custom server/network reports
→Integrated surveillance (pit, office, mess); IoT — refueling digitalization (quota by HM/KM), PH Meter system
→Sub-1-min geotechnic alerting at District ASMI (Leica + Node-RED + Telegram) → ~IDR 2.4B net quality income
→Backcharge automation, 26-channel Telegram alerts, self-service fueling FM LCR600 → avoided ~IDR 1.1B/month potential loss

Cisco EIGRPCisco NACCisco ASA 5500Cisco Aironet WLC/NCSCisco Mesh Aironet 1500Cisco CUCMFortigate NGFWInfinet OFDMVSAT/MPLS/ASTINETCactiIoTSolar PVLeica + Node-RED

2025 — now · Maintainer (open-source)

mcp-pentest — Claude AI ↔ Offensive Toolchain

A Model Context Protocol (MCP) server that bridges Claude AI to a full pentest toolchain — nmap, nuclei, ffuf, sqlmap, hydra, Metasploit, and more — so an LLM can drive recon, fuzzing, and exploit workflows under operator control.

→30+ pentest tools exposed as MCP primitives — recon, fuzzing, brute-force, exploit
→Claude AI orchestrates scan → analyze → next-step decisions in natural language
→Sandboxed execution with structured results — no raw shell handed to the model

MCPClaude AIPythonNmapNucleiMetasploitsqlmapDocker

2026 — now · Builder (personal)

AI Workflow Automation — n8n + Hermes Agent

Self-hosted automation suite combining n8n for visual workflow orchestration with the Hermes Agent for autonomous task execution — bridging APIs, internal apps, and AI agents to remove repetitive operational work.

→Visual workflow design with n8n — connect APIs, databases, messaging, and AI agents
→Hermes Agent drives autonomous multi-step tasks across the workflow graph
→Self-hosted to keep data, secrets, and triggers under direct control

n8nHermes AgentDockerWebhooksLinux

2026 — now · Builder (personal)

9Router — AI Gateway Provider

A self-hosted AI gateway that routes requests across multiple LLM providers with load balancing, fallback, and unified observability — giving downstream applications one stable API surface.

→Provider-agnostic routing across multiple LLMs (OpenAI · Anthropic · open-source)
→Built-in fallback, retry, and rate-limit handling
→Unified OpenAI-compatible API for downstream apps; usage and cost observability

PythonOpenAI APIAnthropic APIDockerReverse Proxy

ongoing · Maintainer (personal)

Self-hosted Security Stack

A practitioner-scale homelab — Wazuh and Graylog for monitoring, Cloudflare Tunnels for zero-trust ingress, automated backups, and a reproducible compose layout.

→Inbound ports = 0 — every service behind a Cloudflare Tunnel
→Wazuh agents reporting to a private Graylog cluster
→Nightly off-site backups with object lock

WazuhGraylogCloudflare TunnelProxmoxBorgDocker

Discuss a similar engagement NDAs respected · references on request