Principal Cloud & Zero Trust Architect. Practical engineering notes on identity, Zero Trust, cloud platforms, endpoint security, networking and automation — based on lessons learned operating technology in the real world.
Open to conversations about Zero Trust, identity and cloud architecture.Read my CV →
NowRenewing my Google Cloud Architect certification, studying for CEH, and building an AI second brain that runs unattended.
Practical lessons from an enterprise ZTNA deployment: foundations, staged migration, policy automation, legacy applications, change management, and measurement.
Presented at Cloudflare Connect London, 2025 and 2026, as a customer speaker. Speaking record →
A design review measured this site's homepage at 18.1KB. Re-measured cold two weeks later, it was 42KB — partly from changes to the page, and partly from the largest single item on the page, an analytics script that in-page measurement reports as zero bytes.
Prompt caching bills writes at a premium and reads at a discount, so a cache that never reads back is strictly more expensive than not caching at all. How I found one deployment doing exactly that, and what made it visible.
Building an Ubuntu engineering laptop where the disk encryption, credential storage and boot behaviour are decisions rather than defaults: TPM2-backed LUKS unlock, a separate encrypted work volume, and an honest account of what each choice does and does not protect.
