I help organisations land securely on Azure: Landing Zones, AKS, Terraform, and the governance layer that holds it all together.
I'm a Lead Cloud Solution Architect at Microsoft, focused on Azure Landing Zones, AKS Automatic, Terraform, IaC security, and sovereign cloud deployments. Before this I ran datacenters for nearly a decade - experience that shaped how I think about reliability and security from the hardware layer up.
Most of what I ship is built with GitHub Copilot. I steer the architecture and review the output; the agent writes most of the code. I believe AI should be held to the same review standards as human contributors.
On the side I co-founded two craft breweries. Turns out fermentation and infrastructure have more in common than you'd think: both need the right environment, the right controls, and patience.
End-to-end ALZ Corp deployments with Terraform and Bicep. 135+ automated checklist validations via Azure Resource Graph. Security and compliance built in from day one, not bolted on.
See deployment patternsAKS Automatic clusters with ALZ Corp networking. BYO VNet, Application Gateway for Containers, NGINX, Istio with multiple ingress and egress patterns documented with full Terraform parity.
See AKS patternsTerraform modules built to run inside ALZ Corp landing zones: no public IPs, central firewall egress, managed identity everywhere. PSRule and azqr integrated into CI pipelines.
See security patternsGitHub-hosted and self-hosted runners with Azure VNet integration, Container Apps, and ALZ Corp firewall egress. GHE.com EU data residency patterns.
See runner patternsTerraform modules, ARG queries, and tooling that came out of real customer engagements.
Official AVM pattern module: self-hosted ADO agents and GitHub runners with PAT and UAMI auth, no public IP egress
GitHub-hosted runners with Azure VNet integration for GHE.com: EU data residency and private endpoint connectivity
Self-hosted GitHub Actions runners that run inside ALZ Corp landing zones with central firewall egress
AKS Automatic with ALZ Corp networking: BYO VNet, multiple ingress options (AGC/NGINX/Istio), managed identity everywhere
Official AVM pattern module for Azure AI Foundry (formerly AI Studio) with network isolation and private endpoints
NIC speaker (94% approval, Level 300, live-streamed) on Terraform, GitHub Copilot, and IaC security. Nordic Infrastructure Conference →