Read as
Technical
Business
Recruiter
Career · technical view
Critical systems moved without downtime.
Infrastructure engineer and solution architect. Unix since 1988. Telecoms first, then banking. Based in Auckland, working alongside teams in Melbourne, Sydney, Singapore and Bengaluru. This page shows how the work was done: the problem, the mechanism, the result.
2022–2025
Banking · cloud
A regulatory separation platform on AWS
Problem
The regulator’s BS11 policy requires the New Zealand bank to be able to operate separately from its Australian parent. A cloud-native platform automates that separation for Markets and Treasury. It runs in the NZ AWS tenancy while its operational clients are on-prem in Australia, New Zealand, Singapore and Bengaluru.
Approach
Operated the platform on EKS. Kafka connections governed by real-time state machines. Trans-Tasman traffic operated over Kafka, secured with internally issued certificates through an Istio mesh and Vault. Deployments automated as code. Synchronised Active Directory populations between the Australian and New Zealand tenancies. Managed Artifactory and cluster operations in the New Zealand tenancy, and IAM within the application’s footprint. Wrote as-built documentation and the triage runbooks. Supported offshore teams.
Incident
An unannounced overnight network rationalisation cut every overseas Kafka agent’s data flow. Traced the cause, documented the requirement, and guided the regional teams as they worked with their network teams to the fix.
Result
All agents restored. No data loss.
AWS EKS · Confluent Kafka · Istio · HashiCorp Vault · Terraform · Argo CD · Codefresh · Python · Bash
2022
Banking · security
Security event logging across the whole Unix fleet
Problem
Operating system security events had to be visible on both sides of the Tasman in real time. If a host was compromised, the bank needed to know where and when. The fleet had been built over years by many provisioners, so no single host state could be assumed. The practice elsewhere was manual root logins, a few hosts a night.
Approach
Sole designer. Extended syslog on every host to capture, segregate and forward security events. Provisioned local caching so a flood of noise could not mask a detection. Events replicated to the monitoring hub via Kafka, new to the bank at the time. Automated with Ansible and bash across RHEL 5 to 8 and Solaris 10 and 11, in four network and Active Directory domains.
Rollout
The first pilot showed why others had done this by hand, an approach that could not scale. Reworked until resolved. Then scaled, non-production first, production last.
5 hosts
Pilot. Reworked until resolved.
200 per batch
Up to 200 hosts per batch, 2 to 4 hours each.
000’s of hosts
On 4 domains.
Result
No implementation issues. Real-time sync with the monitoring hub. Vulnerability statistics reported to the CTO.
RHEL 5–8 · Solaris 10–11 · Ansible · Bash · syslog · Kafka · Active Directory
2017–2018
Banking · separation
A finance division extracted overnight
Problem
A division was to be sold whole. Entwined with the parent bank’s infrastructure, it needed packaging as working and saleable. The source servers ran an older, uncommon Unix and were hosted in Australia. Everything had to land in a new datacentre before the sale.
Approach
As sole technical lead, built a RHEL gateway on VMware as the secure intercompany link. Commissioned the encryption and the network peering to the destination datacentre. Evaluated and automated every transfer by network, protocol and verification.
Scope
It grew. Each addition went through the same gateway.
Unix filesystems, multi-GB, segmented by script.
Oracle and MSSQL, moved as scheduled backups.
NTFS corporate shares, added to the gateway.
User home directories, each permissioned differently.
Exchange mail extracts and SharePoint, defined, batched, automated.
Cutover
Transfers chunked to business priority. Transmission sequence and data load timing automated between the two companies. Tested end to end before the night.
Result
Batch started 4pm Friday. Transfer complete by 2am. The division ran from its new datacentre after the weekend. The sale later closed at $762M.
RHEL · VMware · IPSec · Oracle · MSSQL · Exchange · SharePoint · Bash
2014–2022
Banking · fleet
1,400 hosts repointed with no production issues
Problem
An Exchange 2010 to 2016 migration moved the SMTP gateway that every Unix host relied on. No impact on customer-facing email was acceptable.
Approach
Sole designer and lead. Analysed the fleet, wrote the Ansible to connect each host directly to the Exchange cluster, and guided each application team through its own remediation and policy compliance.
Result
1,400+ hosts reconfigured. No production issues. Policy compliance established. Code handed over for maintenance.
RHEL · Ansible · ServiceNow · Jira · Confluence
1998–2000
Banking · London
Queue status over IRC
Problem
A reconciliation engine matched trades for several divisions. Runs queued. Traders phoned the team to ask where their run was. Each call meant logging in to the database, checking the queue, and reporting back.
Approach
A multi-process Bourne shell coordinator between the team’s IRC channel and the database. A trader types a command in the channel. The coordinator turns it into a query, runs it, and posts the answer back.
Resilience
Each leg handles its own signals. When one leg dies it signals the others to exit, and the coordinator respawns whole. Nobody stops work to restart it.
Result
45 minutes a day returned to the team. On-site work with the Swiss and US teams followed.
Bourne shell · signals · IRC · SQL
1997
Publishing · London
A set difference in three commands
Problem
One process was consuming far too much CPU and memory. Its author had spent months writing it, then left. It had been running for hours. Nobody knew what it did, only that the next deliverable needed its output.
Approach
Did not kill it. Asked the owner first, then read the Java source. It found every item in list B that was not in list A.
sort a.txt > a.sorted
sort b.txt > b.sorted
comm -13 a.sorted b.sorted # lines only in B
Result
A few minutes to write. Estimated five minutes to run. Took three.
sort · comm · Java (read, then retired)
1988–1997
Telecoms · Wellington
Telephone exchange software, from the documentation up
Start
Fourteen months writing the documentation for exchange code. Then Assembler and PLC: structure, modules, subsystems, all under close review on large projects.
Then
Built exchange subsystems. Led small teams developing features using CCITT SS7 signalling. Installed the core hardware for New Zealand’s first 0800 service. Seconded to Japan for 3 months for tech transfer.
Result
Proposed, championed and supervised the build of an HTML IDE for exchange code development. Training time fell from 3 months to 3 weeks.
Assembler · PLC · CCITT SS7 · exchange hardware
Method
What repeats
How I work
Read before acting. Find the owner and the source before killing anything.
Pilot on five hosts. Scale only when the output is right.
Remove the manual step. If people phone to ask, give them a command.
Build for failure. A process that dies should restart itself.
Hand over. Runbooks, documentation, and operations staff trained to use it.
Toolchain
Current
What I work in
Cloud and containers AWS (EKS, EC2, IAM, Secrets Manager), Kubernetes, Docker, VMware vSphere and ESX
Infrastructure as code Terraform, Argo CD, Codefresh, Ansible, GitHub
Security and compliance BS11 separation, Istio service mesh, HashiCorp Vault, DevSecOps audit, IPSec VPN
Messaging and data Confluent Kafka, PostgreSQL, Oracle, Oracle RAC, Exadata, MSSQL
Observability Dynatrace, Splunk
Operating systems RHEL, Debian, Oracle Solaris, Windows Server
Languages Bash, sh, ksh, zsh, Python. Earlier: Assembler, Perl, Java, C, C++
Contact
Want the detail behind any of these?
hugh@earlyautumn.co.nz
linkedin.com/in/hughmcneill