Secure AI on Azure
AI Foundry and Fabric landing zones with private networking, managed identity, data-exfiltration controls and auditable RBAC — architected so that adopting AI does not widen the attack surface.
Available for advisory engagements, architecture reviews and workshops
Secure AI platforms
on Microsoft Azure.
I design secure, large-scale Azure platforms — and the governance that keeps them compliant once AI workloads land on them.
Cloud & Security Architect · Tampa, Florida — working globally, remote-first
- 20+
- Years in infrastructure & architecture
- $3M+
- Documented infrastructure cost savings
- 12
- Current industry certifications
- ISO 27001
- Led certification end to end
About
Enterprise architecture, applied to AI.
Twenty years of building the platforms that regulated organisations actually run on — now focused on the security and governance problems that AI adoption creates.
Infrastructure, cloud and security architect with 20+ years of experience delivering large-scale, secure and cost-efficient technology platforms for international organisations.
I work at the intersection of three things that rarely sit together well: enterprise-grade Azure architecture, regulatory compliance, and production AI. My engagements typically involve designing landing zones that satisfy auditors and enable data science teams at the same time — private networking, identity governance, policy-as-code and the operational evidence to prove it all works.
I have led organisations to ISO/IEC 27001 certification, designed GPU-enabled ML platforms, rebuilt enterprise network topologies for 10x growth, and delivered infrastructure cost efficiencies measured in millions.
Jury appointment
Member of the Jury, Cybersecurity competition — IT-Universe 2026
International Student IT Olympiad IT-Universe
Peer-reviewed publication
A model for automated identity and access management in enterprise cloud systems
Science and Technology Today
DOI 10.52058/2786-6025-2026-2(56)-2323-2335
In the press
The Ukrainian who built the "most advanced" technology platform for a European AI company
Gazeta.ua
Memberships
- Association of Information Technology Directors of Ukraine
How I help
Four areas where I do my best work.
Engagements usually start as an architecture review and turn into a delivery programme. These are the problems clients bring me in for.
Cloud Security Architecture
Defender coverage, ingress security with NVA/WAF, SOC integration at scale, PIM/JIT access models and policy-as-code guardrails across an enterprise tenant.
Regulatory & Compliance Engineering
Translating ISO/IEC 27001, NIST CSF 2.0, GLBA and FFIEC expectations into enforceable technical controls, version-controlled change management and audit-ready evidence.
Platform Engineering & IaC
Tiered Terraform and Bicep module architectures, blue-green and canary release automation, and Azure DevOps pipelines that give developers velocity without loosening the guardrails.
Selected work
Platforms others build upon at scale.
A selection of architecture and delivery work. Open-source implementations and detailed write-ups are being published progressively.
AI & Data Platforms
AI SRE agent with a modular skills and capabilities design
An agent that investigates production incidents on its own, at a median cost of $0.36 per investigation.
- Claude Code
- Azure Foundry
- Container Apps
- MCP
- AI agents
AI & Data Platforms
Enterprise AI foundation on Microsoft Foundry
A hosting platform for models and agents that keeps AI inside the corporate security boundary.
- Microsoft Foundry
- AI agents
- Private networking
- Managed identity
- Enterprise architecture
Security & Compliance
Entra app registrations and security groups from git
Identity objects declared in git, applied by pipeline, with no standing privilege in the tenant.
- Microsoft Entra ID
- Terraform
- Restricted administrative units
- Zero standing privilege
- Policy as code
AI & Data Platforms
GPU-enabled Kubernetes for AI/ML workloads
Kubernetes platform for machine-learning workloads that cut $1.7M in annual operating expenditure.
- Kubernetes
- GPU
- MLOps
- Cost optimisation
AI & Data Platforms
Azure Data Explorer for log storage at scale
An 8x reduction in log storage cost by moving high-volume telemetry to ADX clusters.
- Azure Data Explorer
- Log Analytics
- Observability
- FinOps
Security & Compliance
External SOC integration — security data collection at scale
Tenant-wide log and security-data collection exposed to a third-party SOC in real time.
- Azure Policy
- Event Hubs
- Log Analytics
- SOC
- SIEM
Security & Compliance
RBAC as code with PIM and just-in-time access
Declarative, Git-backed RBAC across an entire Azure tenant — access reviews become automatic.
- Entra ID
- PIM
- JIT
- RBAC
- Terraform
Security & Compliance
ISO/IEC 27001 in IT operations
Took IT operations from ad-hoc to certified, enabling a multimillion-dollar transaction.
- ISO/IEC 27001
- Governance
- Audit readiness
IaC & Automation
Tiered, modular Terraform architecture
Developer freedom in tier 2, hard guardrails in tier 1 and tier 0 — enforced by module topology.
- Terraform
- Terraform Enterprise
- Platform engineering
- Governance
IaC & Automation
Blue-green deployment automation
Blue-green for Azure services that do not support it natively — container apps and static web apps.
- Azure DevOps
- Blue-green
- Canary
- PowerShell
- Terraform
IaC & Automation
ARM to Bicep conversion driven by AI agents
A multi-agent pipeline for IaC migration that saved over 90% of the conversion effort.
- Bicep
- ARM
- AI agents
- Migration
Networking
Hub-and-spoke topology for enterprise-scale growth
A Virtual WAN topology designed to absorb 10x growth without redesign.
- Azure Virtual WAN
- Hub & spoke
- Routing
- Segmentation
Kubernetes & Platform
Istio service mesh for AKS
Request-level visibility across NVA, NSG, gateway and sidecar — analysed as big data.
- Istio
- Kiali
- AKS
- Azure Data Explorer
- Observability
Technology
The stack I architect with.
Depth in the Microsoft platform, with the surrounding cloud-native and security tooling that enterprise environments actually require.
Azure Platform
- Landing zone design
- Azure Virtual WAN
- Private Link & Private Endpoints
- Azure Policy
- Management groups & governance
- Azure Stack
- Cost optimisation / FinOps
AI & Data
- Azure AI Foundry
- Microsoft Fabric
- GPU compute platforms
- Azure Data Explorer
- Log Analytics
- AI agent workflows
Security & Identity
- Microsoft Defender for Cloud
- Microsoft Entra ID
- PIM & just-in-time access
- RBAC as code
- SOC / SIEM integration
- WAF & IDS/IPS (FortiGate)
- Threat modelling
Compliance & Governance
- ISO/IEC 27001
- NIST CSF 2.0
- GLBA Safeguards Rule
- FFIEC examination readiness
- Internal security auditing
- Policy as code
IaC & Delivery
- Terraform & Terraform Enterprise
- Bicep & ARM
- Azure DevOps Pipelines
- Blue-green & canary releases
- PowerShell
- DevSecOps / Defender for DevOps
Kubernetes & Networking
- Azure Kubernetes Service
- Istio & Kiali
- Service mesh security
- Hub-and-spoke topologies
- Hybrid connectivity
- Network observability
Credentials
Certifications.
Azure Solutions Architect Expert
Microsoft Certified
Expert AZ-305
CKS — Certified Kubernetes Security Specialist
CNCF · Linux Foundation
Expert CKS
Cybersecurity Architect Expert
Microsoft Certified
Expert SC-100
DevOps Engineer Expert
Microsoft Certified
Expert AZ-400
Azure Administrator Associate
Microsoft Certified
Associate AZ-104
Azure AI Engineer Associate
Microsoft Certified
Associate AI-102
Azure Network Engineer Associate
Microsoft Certified
Associate AZ-700
Azure Security Engineer Associate
Microsoft Certified
Associate AZ-500
CKA — Certified Kubernetes Administrator
CNCF · Linux Foundation
Associate CKA
ICA — Istio Certified Associate
CNCF · Linux Foundation
Associate ICA
Terraform Associate
HashiCorp
Associate TA-003
Information Security Internal Auditor
Bureau Veritas
Professional ISO 27001
Earlier certifications
- Solutions Expert — Core Infrastructure H663-3795
- Solutions Associate — Windows Server 2016 H167-3232
Hobbies
Away from the keyboard.
Two things that keep me curious once the laptop is closed.
Travel
24 countries, 4 continents.
From Magadan to Hawaii — 91 places I have been, each with its flag on a glass globe you can spin, zoom and replay.
Windsurfing
Chasing the wind.
When the wind picks up, I am out on the water.
Contact
Planning an AI workload that has to pass an audit?
I take on a small number of advisory engagements, architecture reviews and workshops at a time. If you are designing an Azure platform that has to be secure, compliant and fast to move on, let's talk.
Tampa, Florida — working globally, remote-first