Yonatan Harrison

Selected work

Problems, and what I did about them.

Most of my work lives in private systems, so here's the shape of it: what was wrong, what I built, and what changed.

AI triage in the incident channel

Cynet · 2026
Problem
The first minutes of every incident went on gathering context — jumping between dashboards, logs and databases before anyone could form a theory.
Approach
Built AI agents into the incident workflow that triage incidents and recommend likely root causes directly in Microsoft Teams, where the responders already are. The on-call engineer starts from a hypothesis instead of a blank page.
Result
Triage that's consistent no matter who is on call, delivered in the channel where the incident is already being worked.
Stack
  • HolmesGPT
  • MCP
  • Microsoft Teams
  • Kubernetes
  • Prometheus

ML anomaly detection across 300K merchants

Shift4 · 2022 — 2026
Problem
Payment traffic for ~300K merchants swings by hour, day and season. Static thresholds either fired constantly or missed real problems — and an issue affecting one merchant was invisible in the totals.
Approach
Introduced Elastic ML anomaly detection across transaction volumes, approval and decline rates, latency and gateway logs — per merchant and per third-party provider — and wired it into the NOC monitoring stack I owned.
Result
  • Caught issues at the level of a single merchant, including ones the merchant caused themselves.
  • Flagged a slow rise in service time that would have become a full outage.
  • Detected third-party provider incidents before the providers did — we alerted them.
  • Spotted merchants trending down before they told us, giving Sales and Customer Success time to act.
Stack
  • Elastic ML
  • Kibana
  • Grafana
  • SQL
  • MySQL
  • Oracle

From noisy alerts to alerts that mean something

Shift4 · 2022 — 2026
Problem
The NOC was drowning in alerts. People learned to ignore them, and that's how real incidents slip through.
Approach
Pushed for fewer, better alerts: tuned and rewrote old ones, retired the rest, and gave every remaining alert a runbook — what it means, what to check, who to contact.
Result
We reached the point where every alert had a real cause behind it. The question changed from "is this noise?" to "which of these real problems matters most, and do we have the people to chase it?"
Stack
  • Elastic
  • Kibana
  • Grafana
  • PRTG
  • Runbooks

Bringing DevOps into an operations team

Shift4 · 2022 — 2026
Problem
The BizOps team ran on manual, repeated work, and reporting to leadership was assembled by hand.
Approach
As the team's technical lead: wrote scripts that automated the team's manual procedures, built every NOC dashboard plus operational and business dashboards, wrote runbooks for incidents and procedures, and automated daily, weekly and monthly reporting for the C-suite, Finance, Fraud and other teams.
Result
Trained ~26 people on the new tooling and practices. Recurring reports arrive on schedule without anyone building them by hand.
Stack
  • Python
  • PowerShell
  • SQL
  • Azure Pipelines
  • Grafana
  • Kibana

This website

Homelab · 2026
Problem
A CV site should load instantly, cost nothing to run, and be something I can actually talk about in an interview.
Approach
Plain HTML and CSS, built by a short Python script. A push to my self-hosted Gitea is built and swapped live within 30 seconds by a sidecar container; nginx serves it from my TrueNAS box through a Cloudflare Tunnel — no open ports, no home IP exposed.
Result
62 KB for the home page including fonts. Pages prerender on hover, so navigation is effectively instant. How it's built →
Stack
  • TrueNAS
  • Gitea
  • Docker
  • nginx
  • Cloudflare Tunnel
  • Python

From the incident log

The log line that kept saving us.

Our main payment gateway writes a lot of logs. Buried in them was one kind of entry that, when it appeared, pointed straight at the cause of a problem — the kind of signal nobody sees by scrolling.

The anomaly detection learned what normal looked like and surfaced that entry when it shouldn't be there. More than once it pinpointed the issue before an incident started. Other times it found it in the middle of one — usually because the original alert had been missed — and turned a long investigation into a short one.

The lesson I took from it: the most valuable monitoring isn't the loudest. It's the signal you trust enough to act on immediately.