Most IT leaders manage technology.
I build the system around it.

A manufacturing company running five Windows servers and two NAS units on-prem, OneLogin for SSO alongside on-prem Active Directory, and line-of-business CAD, labeling, and accounting apps tied to local infrastructure. One aging server existed only to feed a legacy MS-DOS CNC machine over SMB1 and NTLMv1, protocols that should have been retired a decade earlier.

An aging on-prem footprint with security liabilities baked in, identity split between OneLogin and on-prem AD, and every cloud-first ambition blocked behind hardware nearing end of life. The reflex answer was the expensive one: replace the servers with newer servers and reset the clock on the same problems.

Scoped a transition to the Microsoft 365 cloud stack instead of a hardware refresh. Migrated identity off OneLogin into Entra ID and consolidated SSO; moved Active Directory to Entra and brought workstations under Entra join and Intune with device-based Conditional Access; moved the CAD and labeling software to the vendors' own cloud licensing; relocated working file shares to SharePoint and OneDrive and cold NAS archives to Azure blob storage; and isolated the unavoidable legacy CNC share on a segregated VM so its ancient protocol requirements couldn't touch anything else. The aim throughout was elimination, not replacement: retire each liability rather than rehost it.

The migration came in roughly cost-neutral against simply buying a new host and storage, but bought far more availability, security, and scalability. The payoff proved itself when the client opened a production facility overseas (see Case 03): because the foundation was now cloud-based, the new site needed only a connectivity layer, so no one had to fly out or rebuild a server stack on site.

A construction company running a Windows Server 2008 R2 VM that hosted SQL databases for an archival ERP/accounting platform and an in-house-developed job-tracking system. The newest data was approaching three years old, but open and unpaid jobs still had to be referenced regularly, so the system couldn't simply be switched off.

An unsupported, end-of-life server can't safely sit on a production network, but it also couldn't be decommissioned. I scoped a clean upgrade of the OS and SQL instances on new hardware, but it was cost-prohibitive: the ERP vendor required roughly nine years of back-dated support licensing to move to a supported release.

Chose containment over replacement and solved a licensing-and-hardware problem with networking. I segregated the VM onto its own isolated segment with tightly restricted access, permitted only to authenticate against Active Directory and back up to the BDR appliance. Controlled remote access runs through a separately segmented Windows 7 jump VM that can communicate only with AD and the 2008 R2 server, and nothing else.

Business-critical reference data and access preserved at a fraction of the upgrade cost, with the unsupported system removed as a lateral-movement risk to the rest of the environment. The right answer wasn't the expensive one.

The overseas expansion of the manufacturer from Case 01: a brand-new international production location of roughly 10 users and 30 devices, with no existing infrastructure beyond cabling. Because Case 01 had already moved the business onto Microsoft cloud services, the new site needed a secure local network and direct cloud access rather than a tunnel back to headquarters.

Stand up a secure, supportable, centrally managed network for a remote international site with no local IT, while the ISP and static IP stayed unknown until the building lease was signed and all physical install would be done by non-technical staff on site.

Designed the full architecture and bill of materials around a cloud-first access model. Early scoping assumed a site-to-site VPN back to headquarters, but as the cloud migration completed that requirement fell away: users reach company resources directly through Microsoft 365, with access gated by device-based Conditional Access so only managed, compliant devices connect. That removed an entire international VPN boundary from the attack surface. On site, a Sophos XGS firewall provides the security edge, the LAN is segmented into three VLANs (wired, internal WiFi, and isolated guest) with explicit inter-VLAN policies, UniFi switching and access points are centrally managed, and a UPS is sized for graceful shutdown. The whole stack was staged, configured, and lab-tested in the US before shipping, with an installation runbook and diagnostics checklist written for non-technical hands.

A remote international site that came online securely with minimal on-site technical intervention and a smaller attack surface than a traditional VPN-connected branch, plus a documented, repeatable model for the next site the business opens.

A behavioral health clinic running 373 managed workstations on a split identity model: 158 were Entra ID joined but authenticated through Azure AD Domain Services, while 215 authenticated natively through Entra ID. A finance server and file shares sat behind the same AAD DS dependency, with DNS configurations drifting across devices to accommodate it.

The mixed model produced two parallel authentication paths: different sign-in behaviors per device, troubleshooting that required knowing both models, and Conditional Access and device compliance that couldn't be enforced consistently. The AAD DS dependency was also the blocker holding back every cloud-first security initiative behind it.

Scoped the standardization end to end: audit the authentication state of all 373 workstations, validate Intune enrollment and policy readiness, and test Conditional Access in report-only mode before enforcing. Then a phased migration, a 20 to 30 device pilot validated against critical resources followed by staged waves with rollback triggers, moving every endpoint to native Entra ID authentication, unifying Conditional Access and compliance baselines in Intune, decommissioning AAD DS for workstation auth, and standardizing DNS back to Entra-aligned patterns. Profile migrations were sequenced carefully to avoid corruption, with support enablement and runbooks delivered alongside.

A single, standardized authentication path across all 373 endpoints, AAD DS retired as a dependency, consistent security policy enforcement, and a measurably simpler support and troubleshooting workflow, with the legacy blocker to further cloud and security work removed.

A municipal client running a SCADA system for critical infrastructure, alongside a multi-building HVAC and building-automation (BMS) environment monitoring systems across several facilities. The control systems themselves, the PLCs, controllers, and application logic, are owned and operated by specialist OT vendors, as is standard in this space.

Operational technology lives or dies at the boundary between the corporate IT network and the operational network. That boundary, the segmentation, the remote access, and the availability, is where these environments are actually attacked or fail, and it is the layer the system vendors don't own. The work is to secure and sustain that boundary without getting in the way of the vendors who run the systems inside it. Get it wrong in either direction and you either leave critical infrastructure exposed or you stop the people who keep it running from doing their job.

The network architecture and security boundary around the vendor-managed OT systems. I design and maintain the segmentation that isolates the SCADA and BMS networks from the corporate environment, define and govern the controlled remote-access model the vendors use to reach their systems, and build the high availability the monitoring and control require so nothing goes dark. I set the demarcation of responsibility, what the vendor controls inside the system versus what I govern around it, and I hold the security posture at that line. The control logic itself stays with the OT specialists, by design.

Critical municipal infrastructure and multi-building systems that stay monitored and available, with the highest-risk layer, the IT/OT boundary and remote access, segmented, governed, and owned rather than left flat or over-trusted to a vendor. The right model for OT isn't doing the vendor's job; it's owning the part the vendor can't.