jdiaznetworks contact

Network Security Engineer · San Antonio, TX

Jose Diaz

I've spent ten years building and fixing enterprise networks. Aerospace manufacturing, federal law enforcement, cold storage, a national fiber operator in South Africa. The environments change, the job doesn't: design it so it holds, then figure out why it didn't.

Right now I'm the L2 network engineer on Boeing San Antonio's Wi-Fi 6 modernization, moving roughly 98 access points off AireOS onto Catalyst 9800 without stopping the factory floor. When something repeats more than twice, I write Python for it.

I also run SafeDays Security, handling network security for small law firms that don't have an IT department.

See the work jose@jdiaznetworks.com

Currently

ROLE
L2 Network Engineer, Boeing San Antonio
Contract via AZ Penn LLC, since October 2025
ON MY DESK
Site-wide Wi-Fi 6 cutover, ~98 CW9166 APs
First site done in about two months, zero production downtime
ON THE SIDE
SafeDays Security
DBA of Diaz Tech & Taste LLC
STUDYING
B.S. Cloud & Network Engineering, WGU
AWS track, three courses left, finishing November 2026
Open to roles Army Reserve veteran, 91B

What I work with

Ten years of hands-on, sorted by where it lives in the stack.

ROUTING & SWITCHING

Cisco IOS / IOS-XEArista EOS BGPVLANsVRF LACPSTPDHCP / DNS Internet edge

WIRELESS

Wi-Fi 6 / 802.11axCatalyst 9800 AireOS WLCCW9166 Mesh / industrialmGig access

FIREWALLS & SECURITY

Palo Alto PAN-OSPanorama App-ID / User-IDGlobalProtect Cisco FTD / FMCASA FortiGatepfSense Snort / SuricataIPsec / SSL VPN SegmentationNIST

AUTOMATION & SCRIPTING

PythonNetmiko REST APIsPowerShell BashSQL / PostgreSQL Git

SYSTEMS & CLOUD

AWSAzure VNets / NSGs Windows ServerActive Directory M365 / Entra IDVMware ProxmoxEVE-NG Linux

DESIGN & OPERATIONS

LAN / WAN designMigration & cutover Rollback / failoverCapacity planning Network diagramsITIL v4 ServiceNowChange management

Three things I tracked down

A resume bullet says I troubleshoot. These are what that actually looked like at Boeing.

Deployment blocked

Every AP failed to onboard

The whole fleet refused to join. I walked the CDP neighbor table hop by hop and found new subnets that had never been added to the routing domain config. The APs were fine. Nothing could route back to them.

Recurring outage

Ports err-disabling at shift start

Same time every morning. It was DHCP snooping rate limits tripping on the burst of first-shift clients, all of it funneling through one mesh-backhauled switch feeding 12 downstream APs. Re-engineered the limits for the real traffic shape. It hasn't come back.

Bad diagnosis

VLAN flapping blamed on STP

Spanning tree was the accepted answer before I got there. I eliminated it the slow way: swapped optics, moved ports, diffed the config against a peer switch until only the hardware was left standing. It was the switch. Replacement fixed it for good.

Where I've worked

Boeing

L2 Network Engineer

Oct 2025 – present

San Antonio, TX

  • ›Running the site-wide Wi-Fi 6 modernization: roughly 98 CW9166 APs, AireOS 5500 to Catalyst 9800 IOS-XE, with mGig access switching underneath. First site landed in about two months with no downtime to manufacturing.
  • ›Proposed keeping the legacy APs live as a failover tier through the cutover, so there was no rollback to execute if it went sideways. Ran the change on a Saturday window.
  • ›Automated the activation with a ~270-command script covering AP naming, tag assignment and admin-state sequencing. Took it from 30-plus minutes of typing to under two, with no config errors.
  • ›Own monthly preventive maintenance on about 30 production switches, with status reporting twice a week. Currently moving that reporting into Python.
  • ›Scope has since grown into building 91-400, plus network planning for new construction at 91-822.

Switchovr

Network Engineer

Dec 2024 – Oct 2025

LinkAfrica / CloudCover.it

  • ›Tier 2/3 fiber support for LinkAfrica, the largest fiber network operator in South Africa, working multi-wavelength service-affecting outages across a national footprint.
  • ›Optical parameter analysis: transmit and receive power, wavelength management, DWDM drop troubleshooting. Separating equipment failure from fiber degradation from a bad patch is most of the work.
  • ›Coordinated with international NOC teams to restore service after failed maintenance windows.

NEC Corporation of America

Network Field Engineer

Aug 2018 – Nov 2024

San Antonio, TX

  • ›Ran LAN, WAN, VPN, DNS, DHCP and internet-edge services for state and federal government clients across multiple sites, as tier-2/3 escalation for the complicated network and firewall problems.
  • ›Kept biometric identity systems up for Texas DPS, the U.S. Secret Service and Idaho State Police at 99%+ availability. When those go down, public services stop.
  • ›Migrated firewall policy from legacy ASA to FTD in production law-enforcement environments with no unplanned downtime, and managed FTD deployments and policy through FMC.
  • ›Wrote Python and SQL tooling for firewall policy auditing and compliance reporting, cutting audit cycle time by about 60%. Bash automation for diagnostics and recovery took roughly 40% off incident resolution.

HiTechnology

Network Administrator

Oct 2016 – Jul 2019

San Antonio, TX

  • ›Designed and delivered a greenfield network for Hidalgo Cold Storage supporting 90+ devices across IT, physical security and OT, including segmentation between the business and operational sides of an industrial plant.
  • ›Built Palo Alto HA clusters with App-ID, User-ID and Content-ID, managed centrally through Panorama across multi-site deployments in the U.S. and Mexico for cross-border logistics operators.
  • ›Deployed GlobalProtect for secure remote access for an international workforce, and built Python/SQL monitoring for performance analytics and security event correlation.

Focus Restaurant Solutions

Application Support Specialist

Jun 2015 – Oct 2016

  • ›Tier-1/2 support, system upgrades and compliance audits across multi-site restaurant operations. Where I started writing Python to stop repeating myself.

Projects

Automation I've written and networks I've built. The tools came out of problems I had in front of me, not from looking for something to automate.

Open source python · netmiko

Cisco Troubleshooting Toolkit

Multi-vendor device diagnostics in Python. It standardizes health-check execution across IOS, IOS-XE and ASA, then exports the result as JSON or text so it can go straight into a ticket or a report. It's public, and other people have contributed to it.

github.com/xBinaryCodex/cisco-troubleshooting-toolkit
Automation python · ssh

AP discovery and audit tool

Built at Boeing because a site-wide AP audit took about three hours by hand. It logs in over SSH, correlates CDP neighbors against ARP and CAM tables to work out what is plugged in where, and writes it to a persistent Excel workbook. Same audit now runs in under ten minutes.

PythonNetmiko CDP / ARP / CAMExcel export
Automation ios-xe · cli

Wi-Fi 6 cutover activation script

About 270 commands generated ahead of the maintenance window: AP naming, tag assignment, and admin-state sequencing in the right order. Cutover activation dropped from over 30 minutes of live typing to under two, and the errors that come with typing at 2am went away with it.

Catalyst 9800IOS-XE Config generation
Firewall & segmentation fortigate 100f · fortios 7.6

My own edge firewall

I run the edge for my household and my business off a FortiGate 100F. Separate zones with least-privilege policy between them, traffic shaping for the latency-sensitive stuff, and self-hosted services published through VIPs and inbound policy with real certificate management. I handle the firmware lifecycle and backups myself, which is the part most people skip.

Zone segmentation and inter-zone policy
Zone Holds Inter-zone
USERWorkstations, phonespermit to server
IOTCameras, smart devicesdeny east-west
SERVERNextcloud, inventory appVIP inbound only
BUSINESSCompany workloadsdeny from user
Greenfield build it · physical security · ot

Hidalgo Cold Storage network

A complete network from nothing for an industrial cold storage facility, 90+ devices spanning IT, physical security and OT. The interesting constraint was keeping the business network and the operational network genuinely separated while the same staff had to work across both.

SegmentationCapacity planning CutoverDocumentation
Compliance tooling python · sql

Firewall policy audit and compliance reporting

Written at NEC for government environments where firewall policy has to be audited on a schedule and the evidence has to hold up. Python pulls and parses the policy, SQL stores and diffs it over time, and the report comes out the other end. Took roughly 60% off the audit cycle.

PythonPostgreSQL Cisco FTD / FMCNIST

SafeDays Security

Founder · DBA of Diaz Tech & Taste LLC

Network security consulting for small law firms. A two-attorney practice holds the same client confidences a large firm does, with none of the IT staff, and the usual answer they get is a managed service bundle that nobody explains to them.

My methodology maps to Texas Disciplinary Rule 1.05 and ABA Formal Opinion 477R, so the work lines up with the confidentiality obligations a firm is already under rather than a generic checklist. That also means the deliverable is something a managing partner can read.

The technical side is what I do everywhere else: segment the network, write firewall policy that denies by default, get remote access under control, and make sure the backups actually restore.

Ask about an assessment

How an engagement runs

  1. 01

    Find out what's actually exposed

    Firewall rule review, wireless audit, a look at how the network is (or isn't) divided up. You get it written down in plain language, ordered by what a stranger would reach first.

  2. 02

    Separate what shouldn't touch

    Case files, staff machines, the printer everyone forgot is on the internet, guest Wi-Fi. Each in its own segment with policy between them.

  3. 03

    Lock the edge down

    Firewall policy written properly, remote access with MFA in front of it, and backups I've personally watched restore.

  4. 04

    Check on it

    Logging that someone reads, and a periodic review. Configurations drift, staff turns over, and a firewall rule added "temporarily" tends to stay.

Certifications

Eleven, across networking, security, cloud, Linux and service management.

CCNA

Cisco

CCNA Automation

Cisco

ACE-A

Arista

Solutions Architect – Associate

Amazon Web Services

Cloud Practitioner

Amazon Web Services

Security+

CompTIA

Network+

CompTIA

A+

CompTIA

ITIL v4 Foundation

PeopleCert / AXELOS

Linux Essentials

LPI

Python for IT Automation

Certification

In school

B.S. Cloud & Network Engineering

Western Governors University

AWS track, finishing November 2026

Get in touch

I'm open to network and network security engineering roles, and I take on SafeDays work for firms in and around San Antonio. If something on your network keeps breaking and nobody can tell you why, that's the kind of thing I like.

email jose@jdiaznetworks.com linkedin /in/jose-diaz462 github xbinarycodex