AWS & Azure Architecture
- Designed cloud standards frameworks including security baselines, network patterns, identity controls, and approved blueprints
- Built and governed landing zone designs with hub-and-spoke network models and policy enforcement
- Delivered Azure API Management as a strategic platform governing API standards, lifecycle, and security
- Led AWS API Gateway design for real-time public transport APIs and NGT services
- Designed Azure Virtual Desktop, Azure Functions, AWS Lambda, and AWS EKS workloads
Azure Identity & Integration
We have extensive experience across the Azure identity and integration stack, covering everything from enterprise SSO to application-level API integration using Microsoft Graph.
- Azure Entra ID (formerly Azure AD). extensive experience across B2C, B2B, and workforce identity; SSO configuration, Conditional Access, and identity governance
- Entra Application Proxy. secure remote access to on-premise applications without VPN, including connector configuration and pre-authentication
- App registrations. design and management of application registrations for system-to-system integration, API permissions, certificate and secret lifecycle, and managed identity patterns
- Microsoft Graph API. strong working knowledge of Graph API for identity operations, user management, group management, and application integration scenarios
- Azure Data Gateway. configuration and governance of on-premise data gateway for connecting cloud services (Power BI, Power Apps, Logic Apps) to on-premise data sources
- Enterprise SSO. end-to-end SSO design using SAML and OIDC across cloud and on-premise applications, including AWS IAM Identity Centre federation with Entra ID
- API integration architecture. extensive experience designing and governing system integrations using REST APIs, SOAP, event-driven patterns, and message queuing across SaaS, PaaS, and on-premise estates
Security & Governance
We apply a secure-by-design approach to every engagement: security is built into architecture from the start, not bolted on afterwards. Our experience spans network perimeter, cloud security posture, application gateway controls, and identity governance across complex multi-cloud environments.
Firewalls & Perimeter Security
- Fortinet FortiGate firewalls and FortiWAF. design, configuration, and governance across enterprise network environments
- Azure Application Gateway with WAF. rule design, custom policies, OWASP ruleset configuration, and integration with backend services
- Azure Front Door WAF. global traffic routing with WAF policy, rate limiting, and DDoS protection at the edge
- AWS WAF. managed rule groups, custom rule design, and integration with CloudFront, API Gateway, and Application Load Balancer
- Sophos firewalls. prior experience with Sophos XG/SFOS policy design and network segmentation in enterprise environments
Cloud Security Posture
- Threat modelling, control selection, and security assurance across cloud and on-premise environments
- AWS. Inspector, Security Hub, GuardDuty, Config, CloudTrail, and centralised SIEM integration
- Azure. Application Gateway, WAF, Fortinet fabric, Event Hub to SIEM, private endpoints, Defender for Cloud
- PCI DSS and P2PE architecture including Kubernetes environments with Calico network policy
- Least privilege IAM design, role separation, and continuous compliance monitoring