Well again there were several journalistic pieces at the time that summarized his work both for the CIA and as a contractor that (taken together) make it pretty clear that, while he's not like some domain expert, his crypto and security skills (before the leak) went significantly beyond that of a typical sysadmin. And again, they're pretty easy to find my keyword searching and the like.

I flubbed the detail about the VPN though -- apparently all he did for Poitras was set her up with a (significantly) enhanced mail drop.