Designing resilient, secure, and compliant infrastructure for regulated environments across Azure hybrid cloud, identity, and OT/IT convergence.
I am a Senior IT Infrastructure Engineer with 8+ years of experience across banking and industrial environments in Europe, currently based in Luxembourg. My work sits at the intersection of Azure hybrid cloud architecture, high availability/disaster recovery, IAM, and regulatory compliance (PCI DSS · PSD2 · GDPR · CSSF).
I am transitioning into an Infrastructure Architect role — and this GitHub is the technical companion to that journey. Every repository here reflects a real architectural decision, constraint, or design problem I have worked through.
What I document here:
- Infrastructure-as-Code (Terraform · Bicep · PowerShell DSC)
- Architecture Decision Records (ADRs)
- Runbooks and automation for regulated workloads
- Design studies across hybrid cloud, Zero Trust, DR, and SecOps
All repositories are independent design studies. Production case studies from regulated environments are excluded for confidentiality reasons.
| Area | Evidence |
|---|---|
| Regulated banking | CSSF-supervised environment (Eurobank Luxembourg) |
| Payment infrastructure | 99.99% uptime on SEPA Instant Payment infrastructure |
| Identity at scale | 10,000+ object AD consolidation with zero downtime |
| OT/IT convergence | Production ICS/OT environment experience (Anthogyr) |
| Compliance | PCI DSS · PSD2 · GDPR hands-on delivery |
| Repository | Description |
|---|---|
azure-hybrid-identity |
Hybrid AD/Entra ID · SSPR · Conditional Access · PCI DSS · PSD2 |
mid-enterprise-hybrid-infrastructure |
Hyper-V + Azure integration · Arc governance · OpenVPN L2 |
hybrid-file-services-dfs |
DFS + Azure File Sync · cloud tiering · dual access model |
azure-vpn-p2s-connectivity |
Azure VPN Gateway P2S · split tunnelling · MFA-secured remote access |
| Repository | Description |
|---|---|
zero-trust-enterprise-network |
Zero Trust security control plane · PIM · Conditional Access · SIEM |
zero-trust-hybrid-workload |
Zero Trust hybrid workload · private-only exposure · Azure Bastion |
azure-confidential-computing |
Confidential computing for financial workloads · hardware-backed isolation |
enterprise-pki-adcs |
Enterprise PKI · Microsoft ADCS · certificate lifecycle · TLS trust |
| Repository | Description |
|---|---|
cloud-native-bcdr-platform |
Cloud-native BCDR · Azure Site Recovery · multi-region · RTO/RPO governance |
azure-bcdr-veeam |
Veeam for Azure · backup automation · FinOps storage governance |
immutable-backup-ransomware-recovery |
Immutable backup · ransomware recovery · logical air-gap · CIS/NIST |
hybrid-backup-compliance |
Compliance retention backup · GDPR · PCI DSS · ISO 27001 |
| Repository | Description |
|---|---|
azure-sentinel-soc |
Cloud-native SOC · Microsoft Sentinel · SOAR · MITRE ATT&CK · KQL |
cloud-vulnerability-management |
Vulnerability management · Azure + Nessus · automated remediation · Sentinel |
secure-file-transfer-gateway |
Secure file transfer · Linux hardening · DLP · integrity monitoring · SIEM |
devsecops-azure-governance |
Security-as-Code · DevSecOps · ASGs · IaC security scanning · managed identity |
policy-as-code-compliance |
Policy-as-Code · multi-subscription governance · Azure Resource Graph · Power BI |
| Repository | Description |
|---|---|
multi-tier-cloud-infrastructure |
Multi-tier Azure infrastructure · hub-spoke · HA/DR · modular Terraform |
terraform-azure-devops |
IaC automation · Terraform + Azure DevOps · GitOps · secure pipeline |
aks-microservices-platform |
AKS microservices · service mesh · observability · polyglot data architecture |
aks-application-factory |
Cloud-native app factory · AKS + GitOps · CI/CD · namespace multi-tenancy |
azure-virtual-desktop |
Azure Virtual Desktop · FSLogix · BYOD · secure hybrid workforce EUC |
Cloud & IaC
Microsoft Azure · Terraform · Bicep · ARM Templates · PowerShell DSC
Identity & Security
Active Directory · Microsoft Entra ID · PIM · Conditional Access · Defender for Cloud · Microsoft Sentinel
Networking
Azure VPN Gateway · ExpressRoute · Hub-Spoke · Azure Firewall · Private Endpoints · Azure Bastion
Containers & DevOps
AKS · Helm · GitOps · Azure DevOps · Terraform Cloud
Monitoring & Ops
Azure Monitor · Log Analytics · Microsoft Sentinel · Azure Automation · KQL
Platforms
VMware vSphere · Hyper-V · Windows Server · Linux · Veeam
- Microsoft Windows Server Hybrid Administrator Associate
- AZ-305 — Designing Azure Infrastructure Solutions (in progress)
- Duke University — Cloud Computing Specialization (Coursera, Feb 2025)
- Johns Hopkins University — Cybersecurity Specialization (Coursera, Feb 2025)
Open to Infrastructure Architect opportunities in Luxembourg · Paris · Remote EU