← Back to home Work

What I Work On

Platform-engineering work that came out of real customer engagements. Every claim links to a repo, blog post, or talk.

Azure Landing Zones at Scale

End-to-end ALZ Corp deployments with automated compliance validation and 135+ checklist queries.

  • azure-analyzer: bundled assessment runner that unifies azqr, PSRule, AzGovViz, and 135 ALZ graph queries into one portable JSON + HTML report
  • alz-graph-queries: automated ALZ checklist validation via Azure Resource Graph queries that take coverage from 49 to 135 items
  • Azure Landing Zones 2025: blog post on ALZ governance patterns, network topology, and compliance automation

Networking, Capacity & Resiliency

The network and capacity groundwork under regulated Azure platforms, where routing, segmentation, and regional capacity decide whether a platform ships.

  • Virtual WAN with routing intent, hub-and-spoke peering, UDRs and NVAs, checked against documented platform limits before design sign-off.
  • Private endpoints, private DNS, and IPAM with Azure Virtual Network Manager and Azure Policy working together instead of fighting over route tables.
  • Capacity and quota planning across regions and subscriptions, quota monitoring, and multi-region and disaster recovery designs.

GitHub Runners on Azure (Private Networking)

GitHub-hosted and self-hosted runners with Azure VNet integration, Container Apps, and ALZ Corp firewall egress.

  • terraform-azurerm-avm-ptn-cicd-agents-and-runners: official AVM pattern module for self-hosted ADO agents and GitHub runners with PAT and UAMI auth, no public IP egress
  • ghec-vnet-runners-azure: GitHub-hosted runners with Azure VNet integration for GHE.com, EU data residency and private endpoint connectivity
  • terraform-azurerm-github-runners-alz-corp: self-hosted GitHub Actions runners inside ALZ Corp landing zones with central firewall egress
  • Keyless pipelines: workload identity federation and managed identities from developer machines through CI/CD, with no stored secrets.

AKS Automatic with azapi

AKS Automatic clusters with ALZ Corp networking, BYO VNet, and multiple ingress patterns documented with full Terraform parity.

Terraform AVM Patterns

Official Azure Verified Modules (AVM) pattern modules built to run inside ALZ Corp landing zones with network isolation.

AI Platforms in Regulated Industries

Azure AI Foundry and Azure OpenAI deployments for defense contractors and government bodies with sovereign cloud requirements.

  • Defense contractor: Azure AI Foundry proof-of-concept with Azure Machine Learning private link, VNet-isolated compute, and data exfiltration prevention.
  • Government bodies: Azure OpenAI reference architecture with Azure Front Door, Azure Firewall, and Azure Policy guardrails for data residency.
  • Agents for operations: SRE-style agents for incident investigation, scheduled health checks, and controlled remediation, with MCP servers and API Management in front of the models.

GitHub Copilot Adoption

GitHub Copilot enablement for enterprise customers, from technical onboarding to usage analytics and productivity measurement.

  • Building with GitHub Copilot: blog post on Copilot adoption patterns, prompt engineering, and productivity gains
  • Tier-1 Nordic bank: GitHub Copilot Enterprise rollout with Copilot Knowledge indexing over internal documentation, custom instructions, and usage tracking via Azure Log Analytics.
  • Defense contractor: GitHub Copilot Business proof-of-concept with GitHub Enterprise Managed Users, audit log streaming to Azure Monitor, and network egress control via Azure Firewall.

Speaking & Evangelism

Technical evangelism at industry events and Microsoft internal sessions, covering Azure Landing Zones, AKS, GitHub Copilot, and AI agents for infrastructure.

  • Nordic Infrastructure Conference (NIC) 2026, October: "No More Spec-ulation: AI Agent Teams Building Production-Grade IaC", spec-driven IaC with Speckit and Squad agent teams, Terraform and Bicep on Azure.
  • Agentic AI & DevOps Days, June 2026: "Where does code generation stop and InfraOps start?"
  • Nordic Infrastructure Conference (NIC): a Level 300, live-streamed session on Terraform, GitHub Copilot, and infrastructure-as-code security (94% approval, 200+ attendees).
  • Microsoft customer sessions and workshops on GHAS, GitHub and Azure DevOps, Azure Arc and Azure Local, and Azure OpenAI for enterprise and regulated-industry customers.
  • Microsoft internal events: 50 to 100 in-person sessions, 200+ virtual sessions on Azure Landing Zones, AKS Automatic, and GitHub Copilot.