Name
greg - staff security engineer; builds the systems analysts work in
Synopsis
greg [-t threat-intel] [-p platform] [-a agents] [--remote] [--hire | --consult | --ask] problem ...
greg --version → 15.5
Description
greg takes intelligence work that currently requires a person with forty browser tabs open and returns a system that does it on a schedule. Fifteen years of this, at five employers, on the same problem approached from different sides: analysts are only ever as fast as the tooling they sit in front of, and somebody has to build the tooling.
Currently staff engineer and tech lead in Google's Threat Intelligence Group. The team owns much of how intelligence moves through GTIG — the connectors that pull sources in, the export paths that push finished intelligence out to the Google Threat Intelligence product and to teams across the company. Lately a growing share of that is LLM agents doing work that used to need a human and a browser.
Runs on caffeine and a three-node Kubernetes cluster in a New Hampshire basement. See ENVIRONMENT for its current state; those numbers are real and were read off the cluster when this page was built.
Options
- -t, --threat-intel
- Intelligence platforms, pipelines, and the analyst workflows on top of them. The through-line since 2011.
- -p, --platform
- Python services, Kubernetes, GitOps, the parts of an organization's plumbing nobody puts on a slide.
- -a, --agents
- LLM agents with real tool access and real blast radius. Interesting precisely because the failure modes are not the ones you expect.
- --remote
- Southern New Hampshire. Boston is reachable when it needs to be.
- --hire
- See SEE ALSO.
- -v, --verbose
- On by default for anything architectural. Will explain the trade-off before the diff, whether or not you asked for it.
History
- Tech lead for the team behind most of GTIG's intelligence data flow.
- Owns the analyst tooling the group works in every day, including the software behind the public GTI Collections released with GTIG research.
- Rebuilt how the group consumes front-line data. Latency went from hours to minutes and it stopped waking people up.
- Led folding Mandiant's continuous threat hunting platform into a larger Google system, and moved the analyst platform twice: to GCP, then onto Google production infrastructure.
- Builds the tools that connect the group's LLM agent platform to the intelligence sources and analyst tooling his team owns.
- Hires and grows engineers, sits on the org's tech-lead design review, runs a monthly technical show-and-tell he started.
- Designed and helped build the intelligence platform for telemetry from FireEye appliances in customer environments. Still in production.
- Built the continuous threat hunting platform: actor tradecraft encoded as scheduled searches that surface new infrastructure and malware.
- Built the analyst toolkit the intelligence org ran on, while that org multiplied several times over.
- Automated the statistics pipeline behind M-Trends, Mandiant's annual threat report.
- Threat-intelligence infrastructure on Synapse: extensible API, RBAC, rate limiting, and the beta interface.
- Moved legacy systems onto containers without downtime.
- Architected the threat-intelligence framework global security operations ran on.
- Level 3 analyst: incident-response escalations, malware analysis, hunting.
- YARA and network detection content; intelligence sharing with ISACs and government partners.
- Kept HA clusters and large HPC environments alive.
- Presented ISR automation research at an internal RSA conference.
- Designed the lab's Splunk deployment for real-time security monitoring.
- Built network threat detection and automated response.
- Reverse-engineered malware and pulled the indicators that fed intelligence.
Files
- ~/cluster/
- Three-node Talos Kubernetes cluster. Flux CD for GitOps, Traefik ingress, Prometheus and Loki, PostgreSQL, self-hosted Gitea running CI, and local model inference on the same boxes so the agents have somewhere to think.
- /dev/lora0
- NHMesh — community LoRa mesh across southern New Hampshire. Meshtastic and MeshCore side by side, MQTT plumbing, live monitoring, a public map, and node enclosures drawn in Fusion 360 and printed for whoever needs one.
- /opt/staff/
- A staff of LLM agents built to sharpen his thinking, not replace it. They gather, watch, and draft; the judgment stays his. Cash-flow forecasting, a camera vision pipeline, health tracking, calendars, the day sheet he works off each morning. Custom MCP server, local and hosted models behind one gateway. Nothing spends money or messages a human without him.
- /sys/class/thermal/stove0
- Thermocouples and OCR reading a wood stove that ships no API, wired into Home Assistant with alerts on his phone. Heating a house in New Hampshire turns out to be a control problem.
- ~/greenhouse/
- Year-round growing at 43°N. Vegetables, herbs, seed starting, and sensors reporting temperature and humidity into the same stack that watches everything else.
- ~/shop/
- Furniture and cabinets for the house and the people in it. Nothing here is abstract and nothing compiles, which is most of the appeal.
Environment
Read from the cluster at build time and frozen into this page. The site is static and makes no outbound requests — a public page with a live socket into a private network is a vulnerability, not a flex.
Last build: 2026-09-23
Exit Status
- 0
- Shipped. Someone else is now using it and has opinions about it.
- 1
- Shipped anyway. See BUGS.
- 130
- Interrupted. Usually by a four-year-old, occasionally by a page.
Bugs
Sixteen pods on the cluster above are in Error as of this build. Ten are the job that verifies the backups, which exists solely to tell him when something else has broken, which means the thing currently broken is the thing that was supposed to report it. He writes alerting for this exact failure mode at work.
Reaches for infrastructure when the honest answer is a shell script. Rewrites things that already work. Has strong opinions about YAML and will share them unprompted.
Report bugs to greg@glsec.us. Patches welcome.
See Also
mail(1), linkedin(1), github(1), resume(5)
Author
Greg LeBlanc. M.S. Information Security and Assurance, Western Governors University, 2013. B.S. Computer Network and Information Systems, Wentworth Institute of Technology, 2010, Merit Award Scholarship.
Most hours belong to his wife and their kids. What is left goes to the cluster, the mesh, and the shop.