Immad Khan

Principal Network and Security Architect, London

Networks in four countries. The automation that keeps them running.

Fourteen years designing and securing carrier and enterprise networks in Pakistan, Saudi Arabia, Iraq and the UK, from national IP backbones to a regulated UK full‑fibre network. Today I bring automation and AI to how networks like these are run and changed.

Immad Khan. CCIE, HCIE and CISSP, now focused on network automation and AI.

See my work Get in touch

CCIE #56917, HCIE #12309, CISSP #2358421, PMP, Azure Architect Expert

Fig. 1 The dashboard, simulated

Sources6 of 6
Alerts48
Open issues1
P1, core9 alerts, 4 sources

BGP session flapping on core‑02

Grouped because every alert points at the same circuit.

  1. Latency rising on core‑02 (Zabbix)
  2. BGP neighbour down and up six times (Graylog)
  3. Receive power low on Te0/0/3 (device check)
  4. All on one circuit (NetBox)
Suggested fixMove traffic to the backup path, then replace the degrading optic on Te0/0/3.
Waiting for the engineer on duty

A simulated example of the kind of dashboard I have built. Every name and number is illustrative, and no real network data is shown.

  • Certified
  • CCIE #56917
  • HCIE #12309
  • CISSP #2358421
  • PMP
  • Azure Solutions Architect Expert
  • PCNSE
  • ISO/IEC 27001 Lead Auditor

Career

Fourteen years, four countries, one line of work.

I started by building networks by hand and have spent every year since on bigger, more critical ones. The automation came from doing the same careful checks hundreds of times.

  1. 2012Islamabad
  2. Dammam
  3. Riyadh
  4. Islamabad
  5. Erbil
  6. Sulaymaniyah
  7. NowLondon
  1. Oct 2022 to now
    Principal Network Engineer, G.Network

    Core network lead for peering, capacity and architecture across the national network, supporting 99.99% availability. Led the high‑risk vendor remediation to Cisco and Nokia for full Telecommunications Security Act compliance, designs the Zero Trust perimeter on Cisco Firepower, and directs the Python automation toolkit now used in daily operations.

    London, UK
  2. Feb 2021 to Jul 2022
    IP Planning Expert, Asiacell

    Led IP backbone modernisation for the 5G rollout with SR‑MPLS and EVPN, and optimised MPLS core capacity for a multi‑million subscriber base.

    Sulaymaniyah, Iraq
  3. Aug 2018 to Jan 2021
    Senior Datacom Engineer, Huawei

    Nationwide IP backbones on IS-IS and BGP for tier‑1 operators, legacy‑to‑IP and IP‑RAN projects for LTE expansion, and fast reroute for millisecond failover.

    Pakistan and Iraq
  4. Feb 2014 to Jul 2018
    Access Network Engineer, Mobily

    IP and FTTx infrastructure across eight major cities for a tier‑1 operator: MPLS Layer 2 and 3 VPNs, redundancy testing, and field teams led through installation and acceptance.

    Riyadh, Saudi Arabia
  5. Jun 2012 to Jan 2014
    IT Support and Network Engineer, Ized Group

    Enterprise routing, switching and firewalls for mid‑scale operations.

    Islamabad, Pakistan

Selected work

Three pieces of work, told properly.

What needed doing, how I went about it, and what changed afterwards.

01/ 03

One dashboard instead of six monitoring tools

My role: designed and built it for a live carrier network, with no third‑party licence.

ResultOne view of the whole network, with a suggested fix next to each issue instead of a pile of alerts across six tools. It needed no commercial AIOps subscription.

6 to 1tools into one view
0third‑party licences
Livecarrier network

Challenge

Zabbix, SolarWinds, Graylog, NetBox and Cisco FMC each held part of the picture. None of them said what was actually wrong, so the first minutes of every fault went on switching between tabs.

Approach

  • Collect from all five tools, plus direct checks on the live devices
  • Correlate related alerts into a single issue
  • Show the likely cause and a suggested fix on one dashboard
ZabbixSolarWindsGraylogNetBoxCisco FMCLive devices EngineDashboard
Fig. 3 Six sources, one engine, one dashboard.
PythonREST APIsEvent correlationObservabilityZabbixSolarWindsGraylogNetBoxCisco FMCBuilt with Claude Code

Inside the dashboard

Forty-eight alerts in. One issue and a fix out.

A failing optic doesn't raise one alert. It raises dozens, in every tool that can see it. This is how the dashboard I built turns them into something an engineer can act on. Scroll through, or pick a step.

Fig. 2 How the alerts become one issue

02/ 03

Firmware upgrades without the 2am change window

My role: designed and built it, for Cisco and Nokia fleets.

ResultRepeatable upgrades that engineers can trust, backed by evidence, with every step logged for change management.

~19,000lines in the Python toolkit
850+automated tests in CI
Team-widedesktop upgrade app

Challenge

Upgrading router and OLT firmware by hand is slow, repetitive and risky. One missed check can take a site down.

Approach

  • Pre‑checks on routing, CPU, memory, storage and redundancy
  • Staged waves that stop automatically at the first failure
  • Post‑checks compared against the pre‑upgrade baseline
  • Automatic rollback and a complete audit trail
Pre-checkUpgradePost-checkDoneRoll back if any check failsCHANGE
Try it: make a post-check fail.
Fig. 4 Every upgrade proves itself before and after.
Network automationPythonCisco IOS XRNokiaChange management
03/ 03
Featured: regulated, live core

Removing a high‑risk vendor under the Telecommunications Security Act

G.Network, London. The core and edge of a live national full‑fibre network.

ResultThe programme reached full Telecommunications Security Act compliance while holding the network to its 99.99% availability target.

Core + edgemoved to Cisco and Nokia
FullTSA compliance
99.99%availability supported

Challenge

UK regulation required high‑risk vendor equipment to come out of the core and edge of a live network, without disrupting customers.

Approach

  • A target architecture on Cisco and Nokia
  • Every step validated before it touched the live network
  • A staged migration with a rollback plan for every step
High-risk vendorCisco and NokiaStaged migration
Fig. 5 Old core out, new core in, customers undisturbed.
Cisco ASR9K and NCSNokiaSegment RoutingBGPTSA

How I work

Three rules I build by.

  1. From the toolkit

    Prove it before it's live.

    Every change to a live network should already have worked somewhere safe. The toolkit I direct runs more than 850 automated tests in CI, and network changes are validated before rollout, so nothing reaches customers untested.

    Seen in case 03
  2. From the upgrades

    Always keep a way back.

    Automation without a rollback just breaks things faster. The tools I build check before they act, check again afterwards, and undo their own work when the results don't match.

    Seen in case 02
  3. From the dashboard

    Show the fix, not just the fault.

    A list of alerts tells you something is wrong. A good tool also tells you what to do next, with the evidence, so the engineer on duty can act instead of starting from scratch.

    Seen in case 01

About

Built by hand first, then automated.

I spent my first decade building carrier networks node by node: fibre across eight Saudi cities, national backbones in Pakistan and Iraq, and Segment Routing for one of Iraq's largest operators. That is where the instinct for automation comes from. After doing a job by hand a few hundred times, you know exactly which checks matter.

Now I specify and direct the tools that do that work: a Python toolkit of about 19,000 lines across Cisco IOS XR and Nokia SR OS, monitoring that diagnoses instead of just listing alerts, and upgrades that check themselves and roll back on failure. I build much of it with Claude Code. AI makes me faster, but it doesn't replace judgement, so everything gets reviewed as a security architect would review it.

Current rolePrincipal Network Engineer, G.Network
Credentials
  • CCIE Enterprise Infrastructure #56917
  • HCIE Datacom #12309
  • CISSP #2358421
  • PMP #3030305
  • Azure Solutions Architect Expert
  • Palo Alto Networks PCNSE
  • ISO/IEC 27001:2022 Lead Auditor
FocusNetwork automation and AI, network architecture and security
Open toRemote or hybrid roles in network architecture, security architecture and network automation
Based inLondon