Principal Cloud & Zero Trust Architect. Practical engineering notes on identity, Zero Trust, cloud platforms, endpoint security, networking and automation — based on lessons learned operating technology in the real world.
Open to conversations about Zero Trust, identity and cloud architecture.Read my CV →
NowStudying for CEH, and most recently writing about Linux endpoint encryption and fail-closed VPN design.
Practical lessons from an enterprise ZTNA deployment: foundations, staged migration, policy automation, legacy applications, change management, and measurement.
Presented at Cloudflare Connect London, 2025 and 2026, as a customer speaker. Speaking record →
Prompt caching bills writes at a premium and reads at a discount, so a cache that never reads back is strictly more expensive than not caching at all. How I found one deployment doing exactly that, and what made it visible.
Building an Ubuntu engineering laptop where the disk encryption, credential storage and boot behaviour are decisions rather than defaults: TPM2-backed LUKS unlock, a separate encrypted work volume, and an honest account of what each choice does and does not protect.
Building a WireGuard tunnel with a real kill switch on a device with no package manager and a read-only root: the bootstrap paradox, the unit-ordering typo systemd accepts silently, and why a watchdog that heals a fault also hides it.
