What we're hired for
Four things we've done long enough to be boring about. Every engagement is scoped to deliver something measurable, and documented so your team can run it afterwards.
Network architecture
I analyse your existing network — configs, topology, dependencies, undocumented assumptions — and produce a clear path to where you need to be. That covers Cisco Nexus/ACI/Catalyst environments, BGP/OSPF redesigns, SD-Access deployments, and full-stack migrations with rollback plans. Every assessment produces findings backed by live configuration data, not diagrams or audit-tool output alone.
What you get
- Clear understanding of current-state risks and undocumented dependencies
- Target architecture aligned to 3–5 year growth projections
- Phased migration plan with tested rollback procedures
- Consistent configuration standards across all sites
- Architecture assessment report with prioritised findings
- High-Level Design (HLD) and Low-Level Design (LLD) documents
- L2/L3 topology diagrams with VLAN and IP addressing schemes
- Migration runbooks with change windows and rollback triggers
- Post-migration validation reports
3–10 weeks depending on scope
Security & compliance
I architect and validate security controls across perimeter, internal, and cloud environments. Engagements cover Palo Alto and Panorama policy consolidation, Zscaler ZIA/ZPA deployments, Check Point gateway hardening, F5 application delivery security, and network segmentation. I bring a structured analytical method — multi-source correlation, evidence classification, and architectural truth prioritisation — so findings are backed by config data rather than assumptions. Compliance validation is automated, not manual spreadsheet work.
What you get
- Consolidated, auditable security policy across all enforcement points
- Reduced attack surface through systematic policy rationalisation
- Evidence-based compliance posture backed by live configuration data
- Measurable reduction in lateral movement paths
- Security architecture assessment with risk register
- Firewall rule base analysis and optimisation reports
- CIS benchmark compliance reports per platform
- Zero-trust segmentation policy matrix
- Executive presentation with remediation roadmap and ROM
4–14 weeks depending on platform count
AI infrastructure
Most network engineers can't touch ML infrastructure. Most ML engineers can't design a leaf-spine fabric. I do both, and run it in production daily rather than as a demo. I help organisations design and build the infrastructure that makes AI work at scale: GPU cluster networking (NVLink, InfiniBand, RoCE), model serving platforms (vLLM, Triton), RAG pipelines with vector databases, and the monitoring that keeps it all running. I also build the automation that makes AI infrastructure maintainable — config management, drift detection, and compliance for AI workloads.
What you get
- Production AI infrastructure designed for scale and reliability
- GPU cluster networking optimised for training and inference
- RAG pipelines with measurable retrieval accuracy and latency
- Observability for AI workloads alongside traditional infrastructure
- AI infrastructure architecture assessment and design
- GPU cluster networking design (topology, switching, fabric)
- Model serving platform deployment and optimisation
- RAG pipeline design with vector database integration
- Monitoring and observability stack for AI workloads
- Automation tooling for AI infrastructure management
4–16 weeks depending on scope
Automation
I build automation that removes manual toil and reduces human error in network and security operations. The tooling handles config extraction and normalisation across multi-vendor environments, automated compliance validation against CIS benchmarks, drift detection against approved baselines, and dashboard generation for operational visibility. Everything is version-controlled, documented, and designed to be maintained by your team after handoff. I've built compliance platforms that assess 2,000+ devices in under 4 hours, replacing 6–8 week manual audit cycles.
What you get
- Config extraction and normalisation across multi-vendor estates
- Automated compliance checks running on schedule or on demand
- Configuration drift detection with automated alerting
- Audit evidence generated programmatically, not manually
- Python automation packages with documentation
- Ansible playbooks and roles for compliance and remediation
- API integration modules for target platforms
- Configuration normalisation and diff tooling
- Dashboard templates and data pipeline configurations
- CI/CD pipeline definitions for automated runs
3–8 weeks per automation module
Ready to scope an engagement?
Tell us about the environment, the goals and the timeline. We'll come back with a preliminary scope and an approach.