Cloud & Network Security
- SASE
- ZTNA
- FWaaS
- Secure Web Gateway
- CASB
- DLP
- DNS Security
- IPS
- RAVPN
- VPN — IPSec / SSL
- TLS decryption & inspection
- Generative-AI security & guardrails
- Traffic analysis
Field Dossier — Cloud Security
Chris Baker
Cloud & network security engineer.
- Location
- Vancouver, BC
- Focus
- SASE escalation, tooling & agentic AI
- Tenure
- 14+ yrs — Cisco, Sophos
- Status
- Open to opportunities
01
Profile
Cloud and network security engineer with 14+ years at Cisco and Sophos, specializing in high-severity escalation engineering across SASE platforms and the tooling that accelerates resolution at scale. Increasingly focused on designing agentic AI systems for security work.
I specialize in diagnosing high-severity issues across SASE platforms — ZTNA, FWaaS, secure web gateway, DNS security, IPS, and RAVPN — and in bridging engineering and support to drive root cause to resolution. Beyond escalations, I build the infrastructure that makes the team faster: a cloud lab for reproducing customer environments, diagnostic tooling in Bash, Python, and JavaScript, a Webex automation bot (Python async, Docker, EC2) for case routing and severity alerting, internal documentation, and mentoring and training programs.
Lately I design and ship agentic AI systems. At Cisco I built a human-in-the-loop tool on Claude Code and AWS Bedrock, now in active use by my team, that drives end-to-end triage on high-severity escalations through MCP tool-calling and skill-based modules pulling live logs and internal state. Outside work I build LangGraph agents for security use cases where safety is structural rather than prompt-based — destructive actions hard-blocked behind human-approval gates the model cannot skip, and the reasoning layer kept separate from the tools that act.
What motivates me is the full loop — taking a difficult technical problem to a deeper understanding of the product, then scaling that understanding across teams through documentation, labs, and hands-on teaching.
02
Capabilities
Agentic AI & Skills
- Claude Code Skills
- Model Context Protocol (MCP)
- Agentic workflows
- Planner–executor patterns
- Human-in-the-loop
- Tool calling
- Prompt engineering
AI Tooling & Platforms
- Claude Code (primary)
- GitHub Copilot
- Anthropic API
- AWS Bedrock
- LangGraph
- LangChain
- LangSmith
- claude-agent-sdk
Cisco Products
- Cisco Secure Access
- Cisco Secure Client
- Cisco Umbrella
- Cisco ThousandEyes
- Cisco ASA
- Meraki MX
Firewalls & Gateways
- pfSense
- Sophos UTM
- Sophos Web Appliance
- Sophos Email Appliance
Identity & Access
- SAML
- SSO
- OIDC
- OAuth
- SCIM provisioning
- RBAC / group-based access
- Joiner-mover-leaver workflows
- Active Directory
- LDAP
- IdP integration — Okta / Entra ID / Duo / Google Workspace / Ping / ADFS / OpenAM
Security & Compliance
- SOC 2 Type 2
- ISO 27001 / 27017 / 27018
- PCI-DSS
- HIPAA
- Operated within certified-compliance environment
Logging, Detection & SIEM
- Splunk
- Grafana
- Loki
- Grafana Alloy
- Prometheus — node / snmp / cAdvisor
- DataDog
- Fail2Ban
- Snort / IPS event triage
- Log analysis
- Packet capture — Wireshark / tcpdump
Scripting & Automation
- Bash
- Python
- PHP
- JavaScript
- Expect
CI/CD & Release Automation
- GitHub Actions
- Gitea Actions
- Scheduled pipelines
- Semantic-version releases
- SLSA build provenance — OIDC attestation
- Signed-artifact verification — minisign
- Supply-chain hardening — pinned SHAs, least-privilege tokens, injection-resistant workflows
CI Security Scanning
- Trivy — container CVE scanning
- SARIF to code scanning
- gitleaks — secret detection
- hadolint
- zizmor + actionlint — Actions SAST
- ShellCheck
Operating Systems
- Linux — Alpine / RHEL / Ubuntu / Debian
- FreeBSD
- Windows Server
- macOS
Cloud & Virtualization
- Azure
- AWS
- VMware
- Docker
- Multi-arch builds — QEMU / Buildx
- GitHub Container Registry (GHCR)
- Kubernetes
Networking
- TCP/IP
- DNS — BIND / MS DNS / Unbound / DNSCrypt
- Routing & switching
Web & Mail Infrastructure
- NGINX
- HAProxy
- Postfix
- MS Exchange
Practice
- Technical documentation
- Training & mentorship
- Technical interviewing
- Escalation management
- Incident response
03
Experience
May 2023 — Present
Software Engineer — Cloud Security
Cisco · Vancouver, BC
- Own high-severity technical escalations for Cisco Secure Access — driving root-cause analysis and cross-functional resolution across ZTNA, FWaaS, SWG/CASB, DLP, TLS decryption, IPS, RAVPN, DNS security, generative-AI security controls, and identity provisioning (SCIM user/group lifecycle, SAML/OIDC SSO) within a SOC 2, ISO 27001, and PCI-DSS certified SASE platform.
- Designed and shipped an internal agentic AI tool on Claude Code + AWS Bedrock — integrates live with Jira and Cisco's case-management system via Model Context Protocol (MCP) and runs skill-based debugging modules that pull logs and internal state from Secure Access to enrich each case, auto-generating the technical RCAs TAC relays to customers plus dev-facing Jira tickets while engineers validate and refine the findings.
- Built and operate a cloud-based lab environment used by support and engineering to reproduce customer issues in isolated conditions, reducing time-to-diagnosis on the most technically complex cases.
- Built and deployed a Webex automation bot (Python async, Docker, EC2) for the escalation team: monitors the live case feed via outbound WebSocket, relays new cases with severity banners, routes SEV 1 @all and SEV 2 @manager alerts, and tracks case ownership — operating with zero open ports via outbound-only WebSocket connection.
- Authored diagnostic and automation tooling adopted across the team — DNS resolver diagnostics (EDNS packet decoding, name-server chain consistency testing, in-rotation resolver mapping), a comprehensive Virtual Appliance toolkit (DNS testing across all ports and protocols, ephemeral port profiling, query volume analysis), Active Directory Connector event parsing, Teleport infrastructure access automation, and Cisco case-management browser automation (Tampermonkey).
- Build lab reproductions across the Secure Access stack — FWaaS, ZTNA, IPsec, BGP, DNS and web-filter paths, resource connectors (AWS / Azure / VMware / Docker), plus identity integrations: SAML/OIDC SSO and SCIM user/group provisioning across Okta, Microsoft Entra ID, Duo, Google Workspace, Ping Identity, ADFS, and OpenAM — to isolate failures and validate fixes before delivery.
- Author internal technical documentation on advanced product behavior, lab procedures, and testing methodology — used as the primary reference by both engineering and support teams.
- Conduct technical interviews, onboard new hires, mentor existing staff, and run knowledge-sharing sessions to raise team-wide capability across the Secure Access stack.
Dec 2021 — Apr 2023
Senior Technical Support Engineer — Cloud Security
Cisco · Vancouver, BC
- Subject matter expert on Cisco Umbrella escalations; resolved the most complex technical issues facing the support organization.
- Built customized test environments and diagnostic scripts that became standard tooling for staff training and issue reproduction.
- Partnered with Development on bug fixes and enhancements; delivered training and conducted technical interviews.
Dec 2016 — Dec 2021
Technical Support Engineer III — Cloud Security
Cisco · Vancouver, BC
- Handled escalated cases across DNS security, secure web gateway, and proxy components.
- Created Umbrella test environments in VMware and Azure used company-wide for training and reproduction.
- Wrote support scripts and internal documentation; partnered with Development on bug fixes and product improvements.
Mar 2015 — Dec 2016
Global Escalation Engineer — Email Security
Sophos · Vancouver, BC
- Subject matter expert for Sophos Email Appliance and PureMessage Unix; handled cases escalated from Tier 2 teams worldwide.
- Worked directly with Development on bug fixes, enhancements, new-feature testing, and release planning.
- Authored internal and public-facing knowledge base documentation; trained and mentored Tier 1 and Tier 2 engineers.
- Delivered a one-week onsite training course in Tokyo and led remote deep-dive sessions for the Philippines and India teams — building escalation expertise across global support centers.
Jan 2014 — May 2015
Technical Support Engineer II & Technical Account Manager — Web & Email Security
Sophos · Vancouver, BC
- Provided tiered support (Tier 2 → Tier 3) for Sophos Web Appliance, Email Appliance, and PureMessage Unix/Exchange — appliance config, Unix/Linux back-ends, AD integration, DNS, and traffic flow.
- Served concurrently as Technical Account Manager for large enterprise customers — health checks, incident response during critical outages, and cross-team coordination.
Apr 2013 — Dec 2013
Technical Support Engineer — Web & Email Security
Sophos · Vancouver, BC
- Frontline technical support for Sophos Web Appliance, Email Appliance, and PureMessage Unix/Exchange. Promoted to Tier 2 and Technical Account Manager within 9 months.
Nov 2011 — Apr 2013
Technical Support Engineer — Endpoint Security
Sophos · Vancouver, BC
- Supported the enterprise Sophos endpoint suite — admin server components on Windows Server with MS SQL, and clients across Windows, macOS, Linux, Unix, NetWare, and NetApp.
- Created scripts and knowledge base articles to streamline support delivery.
04
Open Source
Active open-source contributor. Recent work centers on agentic AI for security — LangGraph agents with structural safety (destructive actions gated behind human approval, the reasoning layer separated from the tools that act) — alongside network and DNS security tooling, encrypted DNS, and upstream fixes to platforms I run. Primarily Python, with JavaScript, PHP, and Shell, and supply-chain-hardened CI/CD throughout.
Project details and repositories available on request.
05
Education & Certifications
Network Administration & Security Professional Program
BCIT — UBC Joint Program
Graduated with Distinction. Coursework in VMware virtualization, Active Directory, Postfix/Dovecot, pfSense, Cisco routing & switching, Linux, and Windows Server — with strong standing in security theory and applied practice.
Certifications
- CompTIA Security+
- CompTIA Network+
- CompTIA Linux+
- Cisco CCNA