Joseph Miller · Infrastructure / Security / AI

I make difficult systems work.

I build, secure, recover, and modernize the systems people depend on.

I’m Joseph Miller, a hands-on systems engineer in Oregon. I’m drawn to migrations, failures, and inherited environments where the answer crosses virtualization, storage, identity, networking, cloud platforms, security controls, or recovery.

This portfolio is the record of work I have completed, systems I have built, and technical problems I have learned to make safer and more understandable.

Infrastructure Virtualization · storage · identity · recovery
Cybersecurity Monitoring · segmentation · investigation
Cloud Azure · AVD · Microsoft 365
AI systems Local inference · agents · model serving

Selected successful work

Projects that show how I operate

Virtualization · SAN · Recovery

Enterprise VMware-to-Hyper-V migration

Moved production workloads to Windows Server 2025 Hyper-V while preserving VM identity, networking, application availability, source SAN safety, and a recoverable starting point.

Evidence: Isolated boot, identity, storage, network, and application checks

Read the project →

Private AI · GPUs · Agents

Local AI agent platform

Built a high-memory professional NVIDIA GPU environment for local models, OpenAI-compatible APIs, agent gateways, model routing, and controlled remote access.

Evidence: Authenticated APIs, model routing, and controlled access

Read the project →

Security monitoring · Forensics

Network threat monitoring lab

Built repeatable Security Onion, Zeek, DShield, SiLK, PCAP, and IDS workflows for investigating activity across multiple evidence sources.

Evidence: Correlated packet, flow, log, and IDS evidence

Read the project →

Containers · CI/CD · Security

socket23.com delivery platform

Rebuilt this site around protected changes, multi-architecture images, non-root containers, health checks, runtime verification, and rollback.

Evidence: Protected PR, immutable image, runtime, and public-path checks

Read the project →

Azure · PowerShell · Recovery

Azure Virtual Desktop recovery automation

Deployed and repaired AVD session hosts, then turned the recovery sequence into staged scripts with discovery, tracking, registration, and validation logs.

Evidence: Discovery, registration, agent, profile, and session validation

Read the project →

Data recovery · HFS+ · Linux

Legacy Mac data recovery

Recovered data from an old PowerPC-era disk image by identifying and repairing HFS+, mounting encrypted sparse images, and copying data to modern storage.

Evidence: Mounted the repaired source and copied recovered data safely

Read the project →

What connects the work

I follow the problem across boundaries

I find the real dependency

A symptom in one system often begins in DNS, identity, storage, networking, certificates, tokens, virtualization, or time.

I protect the way back

Before a risky change, I identify the authoritative source, the recovery point, the irreversible step, and the evidence that will prove the new state is healthy.

I verify the complete function

A running VM or green job is not enough. I check boot, identity, data, networking, applications, dependencies, and the outcome people actually need.

How I approach a hard system

Inspect. Map. De-risk. Build. Verify. Document.

  1. Inspect reality I start with observed state instead of trusting an old diagram or assumption.
  2. Map dependencies I follow identity, data, network, application, and recovery paths.
  3. Control risk I separate reversible work from changes that need a stronger checkpoint.
  4. Verify the result I test the real function, not only the component I changed.
  5. Capture the lesson I leave a clearer record and a safer next step.

Public engineering artifacts

Selected source you can inspect

This is a deliberately public, sanitized repository—not a feed from private systems or current infrastructure activity.

Security telemetry · public repository

So-dshield

A documented DShield sensor log collection and Elasticsearch ingestion workflow for security analysis.

Shell DShield Elasticsearch Log analysis
Inspect the repository →

What I’m building now

A read-only Network Assistant architecture

I’m designing an agent that can maintain a source-of-truth view of infrastructure, correlate telemetry and prior incidents, explain likely failure paths, recommend fixes with evidence, and verify recovery.

The boundary is architectural: source access is read-only, remediation stays human-controlled, and nothing from the assistant is exposed through this public site.

Read the preliminary project →

The Socket23 lab

My environment for infrastructure, monitoring, local AI, recovery, and agent experiments that I can test directly and document honestly.

See the lab