Portfolio
Twenty years of programmes, grouped by discipline. Client names are withheld; several of these engagements are being distilled into open-source implementations and public write-ups.
Designed cloud infrastructure that simultaneously satisfies federal regulatory requirements, supports AI adoption and maintains production-grade auditability in Azure. Covers private networking for AI services, identity and access design for AI workloads, and the version-controlled change management foundation that regulators expect.
Principal architect for the design of GPU-enabled Kubernetes platforms serving AI and machine-learning teams. The platform reduced operational expenditure by $1.7M annually while enabling scalable, secure internal AI development on shared accelerated compute.
To address significant log ingestion and storage costs, implemented a scalable ADX cluster-based log storage solution. The design retained query performance and analytical depth for security and platform telemetry while achieving an 8x cost reduction versus the previous approach.
As part of third-party SOC vendor onboarding, configured log collection at scale across Azure services using Azure Policy and automation. Data aggregation was performed in the source tenant using Log Analytics workspaces and an Event Hubs integration, with selected auditing data exposed to the partner for real-time SOC monitoring.
Implemented a declarative Infrastructure-as-Code approach to Role-Based Access Control across an entire Azure enterprise tenant. Using Privileged Identity Management just-in-time assignments, the declarative state in Git always matches the actual RBAC state, which effectively automates and modernises the access review process.
Led the evolution of IT operations from an ad-hoc state to full ISO/IEC 27001 compliance. Translated standard requirements into enforceable technical and operational controls, embedded security into infrastructure design, and prepared the organisation for successful external audits and long-term compliance sustainability. The certification became a foundational enabler for a subsequent investment and acquisition cycle.
Full implementation of Microsoft Defender coverage across PaaS and IaaS services in Azure, including Defender for DevOps integrated with Azure Pipelines and Azure Container Registry image scanning. The result is a consistent application and infrastructure vulnerability posture in a single dashboard view.
FortiGate was selected for a global ingress security project following an extensive multi-criteria evaluation covering efficiency, performance and integration complexity. Its integration with Azure Gateway Load Balancer allowed it to slot into the existing network design completely transparently, with no interruptions or reconfiguration, materially strengthening the public perimeter.
Designed and implemented centralised authentication for a third-party application ecosystem using Microsoft Entra ID, supporting SAML and OAuth integrations. This reduced credential sprawl, improved security posture and simplified access lifecycle management.
Developed a consistent methodology for taking managed services across different organisation types onto private networking — private endpoints, service endpoints and VNet integration — and transitioning them with minimal network interruption. Azure Policy was used to enforce implementation consistency.
Designed and implemented IBM XGS intrusion prevention systems as part of the enterprise network security perimeter, integrating deep packet inspection and threat prevention into the existing network architecture without disrupting production traffic.
Designed a tiered, modular IaC system where each tier represents a distinct infrastructure layer and organisational boundary. Developers get full Terraform flexibility to deploy services in tier 2, while infrastructure compliance and consistency are guaranteed by limited access to tier 1 (platform elements) and tier 0 (network and core services). Terraform Enterprise hosts the custom module topology, with features maintained consistently through versioning and access controls.
Implemented blue-green deployment automation using Azure DevOps pipelines for Azure managed services such as web apps, and for services that require extra orchestration because they lack native support — container applications and static web apps. Orchestration is delivered through advanced Terraform modules and custom PowerShell release stages, reducing deployment risk by running automated application testing before traffic is switched.
Transformed legacy ARM templates into modern Bicep, improving infrastructure management efficiency through more readable code, module support and richer iterative logic. Used a multi-agent AI approach — separate agents performing discovery, transformation and quality control — which saved more than 90% of the development effort the conversion would otherwise have required.
Assisted two organisations in meeting the requirements for Microsoft Gold Partnership, including the associated individual membership criteria that the certification portfolio enabled. The partnerships delivered material impact, bringing annual licensing savings ranging from $300K to $1M.
Designed a highly scalable Azure network topology built to maintain efficiency and management consistency against an expectation of 10x growth and beyond. Based on Azure Virtual WAN as a managed hub, moving site-to-site and point-to-site tunnels off virtual gateways. Spoke-to-spoke traffic routes through the hub to avoid chaotic direct peering, with environment isolation enforced. The topology was designed to minimise application migration and executed with minimal downtime where migration was unavoidable.
Designed and implemented a comprehensive failover network architecture spanning on-premises, cloud and hybrid environments. The solution ensured automatic traffic rerouting across network, compute and application layers, significantly improving service availability during infrastructure or connectivity failures.
Designed and implemented geo-distributed network architectures supporting regional failover and low-latency access, addressing routing, redundancy and operational manageability across locations.
Enabled granular traffic-level visibility across all layers to identify application scaling issues, configuration errors and security problems. Implemented Kiali for traffic visualisation and Azure Data Explorer aggregation of traffic logs across layers — Fortinet NVA, network NSGs, Istio gateway and application sidecars. Logging every request and applying a big-data approach produced a wide range of dashboards that dramatically improved observability of application communication.
Designed and implemented a set of managed Azure Kubernetes Service clusters providing an efficient orchestration platform for application modernisation and migration to a microservices architecture.
Designed and deployed GPU-enabled server clusters within the datacenter to support compute-intensive workloads including AI, analytics and specialised processing. Scope covered hardware selection, cooling and power considerations, and integration with existing virtualisation and network environments.
Designed and implemented Storage Spaces Direct clusters providing highly available, software-defined storage for Azure Stack environments — delivering scalable, fault-tolerant storage while reducing dependency on traditional SAN hardware.
Led multiple cloud migration initiatives including lift-and-shift and phased modernisation of VM-based workloads into Azure. Migrations were planned and executed to minimise downtime, preserve security posture and enable gradual optimisation after landing.
Designed and executed a complete live migration from one physical datacenter to another with no business interruption, requiring careful coordination across networking, compute, storage and application layers to maintain continuous service availability.
Planned and executed full-scale disaster recovery scenarios covering the entire company infrastructure, including recovery sequencing, dependency mapping, validation testing and operational readiness against business continuity objectives.
Developed comprehensive Business Continuity and Disaster Recovery strategies combining technical controls, operational processes and organisational readiness, tailored to different business-criticality tiers.
Designed and implemented SQL Server AlwaysOn availability groups providing database-level high availability and failover, ensuring data consistency, minimal recovery time and resilience against infrastructure failures.
Designed and implemented a geo-distributed Active Directory replication topology ensuring identity service availability, consistency and fault tolerance across datacenters.
Designed and implemented tiered enterprise SAN solutions supporting performance-sensitive and capacity-driven workloads, balancing cost, performance and availability requirements across business systems.
Planned and executed migration from on-premises Microsoft Exchange to Microsoft 365, improving system reliability, reducing operational complexity and enabling modern collaboration features.
Implemented Microsoft SCCM to fully automate VM and endpoint enrolment, software distribution, patch management and compliance enforcement across the enterprise environment.