Arnaud Lhoest

IT infrastructure, endpoint management and monitoring

I keep ~650 endpoints healthy, monitored and auditable — in a GxP-regulated environment.

IT Support Officer at Trasis (Liège), splitting my time between support and infrastructure. I’m building toward a System Engineer role, with endpoint management and monitoring as my two areas of depth.

See selected work Download CV (PDF)

Based in Liège, Belgium. Working in French and English.

arnaud@nemo: ~
$ whoami
Arnaud Lhoest
IT Support Officer @ Trasis — GxP-regulated
law school → IFAPME → infrastructure
focus: endpoint management, monitoring
Run:

Problems I’ve solved, not just tools I’ve touched

Two projects from production, described at the level I can share publicly.

Security

Ending shared admin accounts across ~650 PCs

Context
One local administrator account was shared across the fleet — no way to tell who did what.
What I did
Wrote Wazuh detection rules — SID-based, so they work on French and English Windows — for that account’s use and for admin-group changes. Then replaced the shared account with AD groups pushed through Endpoint Central, and documented the new practice.
Outcome
Validated in production: admin-account use and admin-group changes now open a service-desk ticket automatically.
  • Wazuh
  • PowerShell
  • Active Directory
  • Endpoint Central

Endpoint health

Scoring fleet health to extend PC lifespan

Context
The IT team wanted to keep PCs in service longer — which first means knowing which machines are actually healthy.
What I did
A PowerShell collector deployed fleet-wide through Endpoint Central. It gives a Healthy/Unhealthy verdict per axis — disk errors and free space, battery state, BSOD frequency — and writes it to each asset in Freshservice.
Outcome
Running on every computer: each asset in Freshservice now carries a health verdict per axis, so replacement decisions rest on data rather than age alone.
  • PowerShell
  • ManageEngine
  • Freshservice API

Hosted for uptime, operated from my homelab

The public site lives on OVH’s managed hosting, so it stays up even while I rebuild my lab. Everything around it — deployment, monitoring, alerting — runs on my own Proxmox server, and nothing on it is exposed to the internet.

Deploy

  1. Git pushprivate repo on NEMO
  2. Deploy jobsystemd, runs on every push, SFTP
  3. OVH web hostingalh.ovh, static, HTTPS
  4. Visitoryou, right now

Watch

  1. Uptime Kumacontainer on NEMO
  2. HTTPS and content checkssite, certificate, deploy job
  3. AlertsDiscord

NEMO runs Proxmox VE on an Intel i7-8665U with 32 GB of RAM. Besides the deploy job and monitoring, it hosts my n8n automation pipelines and DNS filtering.

Hardening

HTTPS redirect, a strict content security policy and security headers, all set in .htaccess and checked by public scanners.

Monitoring

Live figures from Uptime Kuma on my homelab, published as a static file — not a screenshot.

Uptime, 30 days: —
Last check: —

Deployment

Every push to the repo goes live on its own — no manual uploads.

git push → systemd job on NEMO → SFTP → OVH

What I work with every day

Endpoint management

  • ManageEngine Endpoint Central — ~650 endpoints
  • SentinelOne EDR
  • Microsoft Entra ID and M365
  • PowerShell automation

Monitoring and security

  • Wazuh SIEM — custom detection rules
  • PRTG
  • NXLog and syslog
  • FortiAnalyzer

Infrastructure

  • VMware vCenter/ESXi — 62 VMs, 4 hosts, 2 sites
  • Proxmox VE
  • FortiGate
  • Veeam

Process and compliance

  • GxP-regulated environment
  • ITIL practices
  • Freshservice ITSM
  • Confluence documentation

Experience

  1. Oct 2024 – now

    IT Support Officer, Trasis (Ans)

    Radiopharmaceutical equipment manufacturer. Formal 50/50 split between support and infrastructure since September 2025.

  2. Feb 2023 – 2024

    IT Infrastructure, Trasis

    Joined as an infrastructure intern.

  3. 2022 – 2024

    IT infrastructure administration, IFAPME

    Work-linked program, completed alongside my internship at Trasis.

  4. Before IT

    Law studies (LLB)

    Started in law before switching to IT — reading regulations still comes naturally, which helps in GxP.

Certifications and training

  • Scripting with PowerShell — U2U2026
  • Professional English — Cefora2026
  • ITIL 4 Foundation — PeopleCert2023

Next up

A Fortinet certification, then Azure Administrator (AZ-104)

Want to talk infrastructure?

The fastest way to reach me is by email. My full CV is one click away.

arnaud.lhoest [at] hotmail.com LinkedIn CV in 30 seconds