Name
greg - staff security engineer; builds the systems analysts work in
Synopsis
greg [-t threat-intel] [-p platform] [-a agents] [--remote] [--hire | --consult | --ask] problem ...
greg --version → 15.5
Description
greg takes intelligence work that currently requires a person with forty browser tabs open and returns a system that does it on a schedule. Fifteen years of this, at five employers, on the same problem approached from different sides: analysts are only ever as fast as the tooling they sit in front of, and somebody has to build the tooling.
Currently staff engineer and tech lead in Google's Threat Intelligence Group. The team owns much of how intelligence moves through GTIG — the connectors that pull sources in, the export paths that push finished intelligence out to the Google Threat Intelligence product and to teams across the company. Lately a growing share of that is LLM agents doing work that used to need a human and a browser.
Runs on caffeine and a three-node Kubernetes cluster in a New Hampshire basement. See ENVIRONMENT for its current state; those numbers are real and were read off the cluster when this page was built.
Options
- -t, --threat-intel
- Intelligence platforms, pipelines, and the analyst workflows on top of them. The through-line since 2011.
- -p, --platform
- Python and Go services, Kubernetes, GitOps, the parts of an organization's plumbing nobody puts on a slide.
- -a, --agents
- LLM agents with real tool access and real blast radius. Interesting precisely because the failure modes are not the ones you expect.
- --remote
- Southern New Hampshire. Boston is reachable when it needs to be.
- --hire
- See SEE ALSO.
- -v, --verbose
- On by default for anything architectural. Will explain the trade-off before the diff, whether or not you asked for it.
History
- Tech lead for the team behind most of GTIG's intelligence data flow.
- Built the group's continuous threat hunting platform, plus the workflow automation and internal tooling the team owns.
- Rebuilt how the group consumes front-line data. Latency went from hours to minutes and it stopped waking people up.
- Writes datasource connectors on the group's LLM agent harness — the same tooling behind the public GTI Collection.
- Hires and grows engineers, sits on the org's tech-lead design review, runs a monthly technical show-and-tell he started.
- Automated the intelligence workflows the analyst org ran on, while that org multiplied several times over.
- Built the threat-analysis platform behind global intelligence operations.
- Embedded with engineering to turn analyst requirements into shipped tools.
- Threat-intelligence infrastructure on Synapse: extensible API, RBAC, rate limiting, and the beta interface.
- Moved legacy systems onto containers without downtime.
- Architected the threat-intelligence framework global security operations ran on.
- Level 3 analyst: incident-response escalations, malware analysis, hunting.
- Kept HA clusters and large HPC environments alive.
- Presented ISR automation research at an internal RSA conference.
- Designed the lab's Splunk deployment for real-time security monitoring.
- Built network threat detection and automated response.
- Reverse-engineered malware and pulled the indicators that fed intelligence.
Files
- ~/cluster/
- Three-node Talos Kubernetes cluster. Flux CD for GitOps, Traefik ingress, Prometheus and Loki, PostgreSQL, self-hosted Gitea running CI, and local model inference on the same boxes so the agents have somewhere to think.
- /dev/lora0
- NHMesh — community LoRa mesh across southern New Hampshire. Meshtastic and MeshCore side by side, MQTT plumbing, live monitoring, a public map, and node enclosures drawn in Fusion 360 and printed for whoever needs one.
- /opt/staff/
- A staff of LLM agents built to sharpen his thinking, not replace it. They gather, watch, and draft; the judgment stays his. Cash-flow forecasting, a camera vision pipeline, health tracking, calendars, the day sheet he works off each morning. Custom MCP server, local and hosted models behind one gateway. Nothing spends money or messages a human without him.
- /sys/class/thermal/stove0
- Thermocouples and OCR reading a wood stove that ships no API, wired into Home Assistant with alerts on his phone. Heating a house in New Hampshire turns out to be a control problem.
- ~/greenhouse/
- Year-round growing at 43°N. Vegetables, herbs, seed starting, and sensors reporting temperature and humidity into the same stack that watches everything else.
- ~/shop/
- Furniture and cabinets for the house and the people in it. Nothing here is abstract and nothing compiles, which is most of the appeal.
Environment
Read from the cluster at build time and frozen into this page. The site is static and makes no outbound requests — a public page with a live socket into a private network is a vulnerability, not a flex.
Last build: 2026-08-23
Exit Status
- 0
- Shipped. Someone else is now using it and has opinions about it.
- 1
- Shipped anyway. See BUGS.
- 130
- Interrupted. Usually by a four-year-old, occasionally by a page.
Bugs
Eighteen pods on the cluster above are in Error as of this build. Ten are the job that verifies the backups. Three are the deadman switch on the inference stack. Both of those exist solely to tell him when something else has broken, which means the two things currently broken are the two things that were supposed to report it. He writes alerting for this exact failure mode at work.
Reaches for infrastructure when the honest answer is a shell script. Rewrites things that already work. Has strong opinions about YAML and will share them unprompted.
Report bugs to greg@glsec.us. Patches welcome.
See Also
mail(1), linkedin(1), github(1), resume(5)
Author
Greg LeBlanc. M.S. Information Security and Assurance, Western Governors University, 2013. B.S. Computer Network and Information Systems, Wentworth Institute of Technology, 2010, Merit Award Scholarship.
Most hours belong to his wife and their kids. What is left goes to the cluster, the mesh, and the shop.