Secure AI on Azure
AI Foundry and Fabric landing zones with private networking, managed identity, data-exfiltration controls and auditable RBAC — architected so that adopting AI does not widen the attack surface.
Available for advisory engagements, architecture reviews and workshops
Secure AI platforms
on Microsoft Azure.
I design secure, large-scale Azure platforms — and the governance that keeps them compliant once AI workloads land on them.
Independent Cloud & Security Architect · Tampa, Florida — working globally, remote-first
- 20+
- Years in infrastructure & architecture
- $3M+
- Documented infrastructure cost savings
- 12
- Current industry certifications
- ISO 27001
- Led certification end to end
About
Enterprise architecture, applied to AI.
Twenty years of building the platforms that regulated organisations actually run on — now focused on the security and governance problems that AI adoption creates.
Infrastructure, cloud and security architect with 20+ years of experience delivering large-scale, secure and cost-efficient technology platforms for international organisations.
I work at the intersection of three things that rarely sit together well: enterprise-grade Azure architecture, regulatory compliance, and production AI. My engagements typically involve designing landing zones that satisfy auditors and enable data science teams at the same time — private networking, identity governance, policy-as-code and the operational evidence to prove it all works.
I have led organisations to ISO/IEC 27001 certification, designed GPU-enabled ML platforms, rebuilt enterprise network topologies for 10x growth, and delivered infrastructure cost efficiencies measured in millions. I now bring that experience to clients as an independent consultant.
Memberships
- Association of Information Technology Directors of Ukraine
Languages
- English Fluent
- Ukrainian Native
- Russian Native
How I help
Four areas where I do my best work.
Engagements usually start as an architecture review and turn into a delivery programme. These are the problems clients bring me in for.
Cloud Security Architecture
Defender coverage, ingress security with NVA/WAF, SOC integration at scale, PIM/JIT access models and policy-as-code guardrails across an enterprise tenant.
Regulatory & Compliance Engineering
Translating ISO/IEC 27001, NIST CSF 2.0, GLBA and FFIEC expectations into enforceable technical controls, version-controlled change management and audit-ready evidence.
Platform Engineering & IaC
Tiered Terraform and Bicep module architectures, blue-green and canary release automation, and Azure DevOps pipelines that give developers velocity without loosening the guardrails.
Selected work
Programmes, not tickets.
A selection of architecture and delivery work. Open-source implementations and detailed write-ups are being published progressively.
AI & Data Platforms
AI Foundry & Microsoft Fabric in production
Bringing AI Foundry and Fabric into a federally regulated environment without breaking auditability.
- Azure AI Foundry
- Microsoft Fabric
- NIST CSF 2.0
- GLBA
- Private networking
AI & Data Platforms
GPU-enabled Kubernetes for AI/ML workloads
Kubernetes platform for machine-learning workloads that cut $1.7M in annual operating expenditure.
- Kubernetes
- GPU
- MLOps
- Cost optimisation
AI & Data Platforms
Azure Data Explorer for log storage at scale
An 8x reduction in log storage cost by moving high-volume telemetry to ADX clusters.
- Azure Data Explorer
- Log Analytics
- Observability
- FinOps
Security & Compliance
External SOC integration — security data collection at scale
Tenant-wide log and security-data collection exposed to a third-party SOC in real time.
- Azure Policy
- Event Hubs
- Log Analytics
- SOC
- SIEM
Security & Compliance
RBAC as code with PIM and just-in-time access
Declarative, Git-backed RBAC across an entire Azure tenant — access reviews become automatic.
- Entra ID
- PIM
- JIT
- RBAC
- Terraform
Security & Compliance
ISO/IEC 27001 in IT operations
Took IT operations from ad-hoc to certified, enabling a multimillion-dollar transaction.
- ISO/IEC 27001
- Governance
- Audit readiness
IaC & Automation
Tiered, modular Terraform architecture
Developer freedom in tier 2, hard guardrails in tier 1 and tier 0 — enforced by module topology.
- Terraform
- Terraform Enterprise
- Platform engineering
- Governance
IaC & Automation
Blue-green deployment automation
Blue-green for Azure services that do not support it natively — container apps and static web apps.
- Azure DevOps
- Blue-green
- Canary
- PowerShell
- Terraform
IaC & Automation
ARM to Bicep conversion driven by AI agents
A multi-agent pipeline for IaC migration that saved over 90% of the conversion effort.
- Bicep
- ARM
- AI agents
- Migration
Networking
Hub-and-spoke topology for enterprise-scale growth
A Virtual WAN topology designed to absorb 10x growth without redesign.
- Azure Virtual WAN
- Hub & spoke
- Routing
- Segmentation
Kubernetes & Platform
Istio service mesh for AKS
Request-level visibility across NVA, NSG, gateway and sidecar — analysed as big data.
- Istio
- Kiali
- AKS
- Azure Data Explorer
- Observability
Technology
The stack I architect with.
Depth in the Microsoft platform, with the surrounding cloud-native and security tooling that enterprise environments actually require.
Azure Platform
- Landing zone design
- Azure Virtual WAN
- Private Link & Private Endpoints
- Azure Policy
- Management groups & governance
- Azure Stack
- Cost optimisation / FinOps
AI & Data
- Azure AI Foundry
- Microsoft Fabric
- GPU compute platforms
- Azure Data Explorer
- Log Analytics
- AI agent workflows
Security & Identity
- Microsoft Defender for Cloud
- Microsoft Entra ID
- PIM & just-in-time access
- RBAC as code
- SOC / SIEM integration
- WAF & IDS/IPS (FortiGate)
- Threat modelling
Compliance & Governance
- ISO/IEC 27001
- NIST CSF 2.0
- GLBA Safeguards Rule
- FFIEC examination readiness
- Internal security auditing
- Policy as code
IaC & Delivery
- Terraform & Terraform Enterprise
- Bicep & ARM
- Azure DevOps Pipelines
- Blue-green & canary releases
- PowerShell
- DevSecOps / Defender for DevOps
Kubernetes & Networking
- Azure Kubernetes Service
- Istio & Kiali
- Service mesh security
- Hub-and-spoke topologies
- Hybrid connectivity
- Network observability
Credentials
Certified, and independently verifiable.
Every credential carries its official certification number and links to the issuer's public validation service. Nothing here is self-attested.
4 Expert-level 7 Associate-level 4 Issuing bodies
Azure Solutions Architect Expert
Microsoft Certified
Expert AZ-305
CKS — Certified Kubernetes Security Specialist
CNCF · Linux Foundation
Expert CKS
Cybersecurity Architect Expert
Microsoft Certified
Expert SC-100
DevOps Engineer Expert
Microsoft Certified
Expert AZ-400
Azure Administrator Associate
Microsoft Certified
Associate AZ-104
Azure AI Engineer Associate
Microsoft Certified
Associate AI-102
Azure Network Engineer Associate
Microsoft Certified
Associate AZ-700
Azure Security Engineer Associate
Microsoft Certified
Associate AZ-500
CKA — Certified Kubernetes Administrator
CNCF · Linux Foundation
Associate CKA
ICA — Istio Certified Associate
CNCF · Linux Foundation
Associate ICA
Terraform Associate
HashiCorp
Associate TA-003
Information Security Internal Auditor
Bureau Veritas
Professional ISO 27001
Earlier certifications
- Solutions Expert — Core Infrastructure H663-3795
- Solutions Associate — Windows Server 2016 H167-3232
Education
An applied mathematics foundation.
-
Master's (Specialist) degree in Applied Mathematics
2002 — 2004National Technical University of Ukraine 'Kyiv Polytechnic Institute'
Course-by-course evaluation by Validential confirms equivalence to a US Master’s degree.
-
Bachelor's degree in Applied Mathematics
1998 — 2002National Technical University of Ukraine 'Kyiv Polytechnic Institute'
-
Junior Specialist in Computer Hardware Engineering
1994 — 1998Kyiv Radio-Electronic Technical College
Contact
Planning an AI workload that has to pass an audit?
I take on a small number of advisory engagements, architecture reviews and workshops at a time. If you are designing an Azure platform that has to be secure, compliant and fast to move on, let's talk.
Tampa, Florida — working globally, remote-first