Stephane Seloi

Technical lead for the design and deployment of a secure CaaS Cloud solution compliant with CIS/NIST/ISO 27001 standards. * Designed and deployed Cloud native architecture for cloud RAN CNFs based on OpenShift/Kubernetes with defense-in-depth approach, including TLS encryption, encryption at rest, granular RBAC (Keycloak), and cluster hardening. * Network security: isolation through namespaces, NetworkPolicies, and micro-segmentation. * Automated compliance using Helm, Ansible, and Prowler, Kube-bench to audit and enforce NIST CSF / SP 800-53 standards, remediating misconfigurations. * API security and monitoring: protected ingress APIs via OAuth2/OIDC (Keycloak) and implemented proactive anomaly detection with Prometheus/Grafana. * Technical Environment: Red Hat OpenShift, Kubernetes (RBAC, PSA, PSS, NetworkPolicies, namespaces), Docker/Podman, REST/gRPC APIs, Nginx Ingress Controller (OAuth/OIDC, mTLS), Ansible, Helm, IPsec/PKI, SELinux, firewalld, CIS Benchmark, Prometheus/Grafana/ELK, Prowler, Kube-bench Keycloak, cert-manager, NIST CSF, SP 800-53, ISO 27001 compliance.

Designed hybrid, scalable, Zero-Trust cloud-native architecture using AWS EKS Multi-AZ and on-prem data plane via EKS Outposts. * End-to-end security: TLS/KMS encryption, granular RBAC, Network Policies, micro-segmentation, and * IPsec VPN for secure hybrid infrastructure compliant with NIST/ISO 27001. * Authored detailed HLD/LLD documentation ensuring resilience, security, and scalability. *Technical Environment: AWS EKS, EKS Outposts, VPC, Security Groups, KMS, AWS Config, Multi-AZ, NACLs, Pod security, namespace segmentation, encryption, AWS Well-Architected Framework.

-Context * Design and implementation of secure Zero Trust network architectures for multi-tenant environments, integrating identity governance, micro-segmentation, and regulatory compliance (NIST/ISO 27001). -Missions: * Zero Trust Secure Architecture: Secure design from the outset: micro-segmentation, end-to-end encryption, least privilege principle. PKI automation and TLS/SSL certificate management with IPsec VPN integration Compliance with NIST/ISO 27001 standards and close collaboration with Cyber IT teams -Multi-Platform IAM Governance: * Granular RBAC on OpenStack/Kubernetes/vSphere with strict environment isolation * Automation of IAM workflows via Python/Ansible to reduce human error * Enhanced authentication and continuous permission auditing -Threat detection & forensics: * Advanced network traffic analysis (Wireshark/Zeek/Tshark) for anomaly detection Log correlation and intrusion detection via SIEM Wazuh/ELK

-Context: Orange/Nokia Technical Leader: Orange FaBRIC Project * Secure, real-time, cloud-native AI/ML platform for dynamic optimization of the 5G network. -Tasks Architecture and security of a cloud platform for AI/ML: * Automation of the creation and security of a Kubernetes/OpenShift cluster via Ansible playbooks, with integration of CIS Benchmarks, NIST, and GDPR standards. * Data encryption (TLS 1.3), RBAC, workload isolation (Network Policies). * Secure ingestion of massive data: Pipeline for real-time data ingestion from VIAVI simulator (reproducing full 5G traffic) to Kubernetes ingestion pods (Fluentd - Kafka), via encrypted gRPC (TLS 1.3). Granular access control (RBAC) - workload isolation (Network Policies) - protection of data in transit and at rest. Integrity validation via JSON schemas. * Secure integration and governance of containerized AI/ML solutions: Use of signed images Cosisign, SAST:Trivy, DAST:Falco and deployment via ArgoCD-Helm, with NIST/GDPR compliance validation. Real-time data processing to dynamically optimize the 5G network. -Automated audits and proactive monitoring: * Continuous compliance auditing via automated Ansible templates integrating Prowler and kube-bench for CIS Benchmarks validation. * Monitoring via Prometheus/Grafana, with proactive detection of anomalies and vulnerabilities. -Working with multidisciplinary teams: * Collaboration with technical teams (Nokia) and Orange business teams to validate the interoperability and security of solutions. -Results * Demo presented at Orange O-RAN PlugFest, validating interoperability and O-RAN WG3/WG11 Security compliance. -Technical environment Red Hat OpenShift, Kubernetes (PSS, Network Policies, namespaces), Helm, Docker/Podman, ArgoCD, Gitea, ELK, Trivy, Cosisign, Falco, Vault-Raft, cert-manager, Fluentd, Kafka, TLS 1.3, RBAC, Prowler, Prometheus/Grafana, O-RAN E2/O1, gRPC, O-RAN WG3/WG11 compliance, NIST, GDPR.

-Context: Bytel Project (Bouygues) * Modernization of RAN infrastructure via secure Zero Trust private OpenStack cloud: * Virtualization of critical telecom network functions with end-to-end encryption, strict isolation, high availability, and compliance with security standards. -Responsibilities: * Secure OpenStack Cloud Architecture IaaS infrastructure deployment: * High availability: Deployment in HA mode (redundant compute and controller nodes) with load balancing for critical services (Keystone, Neutron, Nova). * Network isolation via VLANs/VXLANs and security groups (Neutron). * Data encryption (TLS for API endpoints, Cinder volume encryption). -Automation and Orchestration: * Heat for resource orchestration (compute, networks, volumes) via validated and reproducible templates. * Virtualization of RAN network functions with guaranteed performance and low latency. * Compliance with telecom standards (security, resilience, interoperability). -Security and Governance: * Secure API endpoints (TLS 1.2+), granular RBAC to limit access to resources (IAM Keystone). * Centralized logs and retention policies to meet regulatory requirements. -Technical Environment: * Keystone, SDN Neutron, Nova, Horizon, Cinder, Glance, HEAT, TLS, RBAC, VLANs, OpenStack CLI.

- Context * Client: AT&T, Verizon, Orange * Technical leadership for secure VMware OSS architectures at critical telecom operators. -Responsibilities * Secure design: control/data plane segmentation, NSX micro-segmentation, partitioning by sensitivity. * Integration of security requirements (network segmentation, access control, data encryption, ESXI hardening, vCenter security in line with internal customer policies and industry standards. -Governance and technical documentation: * Drafting technical specifications (HLD/LLD) and security guides for implementation teams and customers. * Serving as the primary point of contact with customers to translate their business needs into secure technical solutions, while ensuring compliance requirements are met. -Monitoring and innovation: * Analysis of technological developments (virtualization, cloud) to propose architectural improvements aligned with security best practices and operators' operational needs. -Technical environment VMware/vCenter security, OSS architecture security, high availability, network segmentation, encryption, VM security, ESXI hardening.