JOEL

A standardised Azure landing zone, deployed consistently for every customer. It provides a solid platform foundation covering governance, networking, identity and monitoring, with integrated connectivity to the customer's on-premises environment.

• A single reference architecture applied to every customer, so environments are consistent, predictable and straightforward to operate and support.
• Governance through management groups and dedicated subscriptions, with Azure Policy assigned at the top so that every new subscription inherits the same guardrails.
• Hub-and-spoke network topology: shared services and connectivity in the hub, with each workload isolated in its own spoke.
• Hybrid connectivity to on-premises systems, keeping existing applications, users and domain services available alongside Azure.
• Identity and access management based on Entra ID and role-based access control at the appropriate scope, with centralised logging and security monitoring.
• Designed and implemented end to end, then rolled out using the same approach for each customer.

The workloads hosted on the landing zones: virtual desktops, domain controllers and SQL Server, external access and backup, operated as one coherent environment.

• Azure Virtual Desktop for users of graphics-intensive applications such as CAD.
• Active Directory domain controllers and SQL Server hosted in Azure, close to the desktops that depend on them.
• Secure external access for partner companies over Azure VPN with Entra ID authentication, limited to the resources each company needs (see the external access project).
• Azure Backup and monitoring with alerting, so issues are identified before they affect users.

A Point-to-Site VPN on Azure that lets people from other companies reach only the services they need, signing in with Entra ID instead of certificates.

• Entra ID sign-in through a custom app registration. Old and new Azure VPN Client app IDs are both authorised, so existing external users keep working.
• Separation per company without turning guests into Members, because Members risk accidental SharePoint all-users shares. Sophos ZTNA and a PAM-style approach are being weighed.
• Sophos traffic shaping with three policies (interactive, files, bulk) keeps RDP, DNS, Kerberos and SMB usable.
• iperf3 baselines showed the on-premises uplink, not the VpnGw1AZ gateway, was the limit.

A redesign of a company network that mixes office and operational equipment, from five zones to ten, with a default-deny firewall policy and a 12-week migration plan.

• Found the gaps: printers sharing a VLAN with clients, equipment of mixed trust levels, guests and contractors in one zone, open wall sockets, and no documented inter-VLAN policy.
• New zones for printers, scanners and terminals, external contractors and a quarantine VLAN, with an IP plan that reserves space for VPN and a possible second site.
• A 20-rule default-deny matrix, switch port profiles, SSID-to-VLAN mapping, and 802.1X where a RADIUS server is available.
• Four migration phases over about 12 weeks with gate criteria, starting with hardening that changes no VLAN.

Wi-Fi with no shared passphrase: devices get certificates from Intune Cloud PKI and prove who they are to a FreeRADIUS server before the access points let them on.

• The Cloud PKI root and issuing CAs are in place and the Intune side is configured.
• FreeRADIUS 3.2 validates device certificates, and Aruba Instant On access points act as the authenticators.
• The RADIUS server's own certificate comes from Let's Encrypt, issued over DNS-01 with acme.sh and acme-dns.

A Python tool that backs up and diffs firewall configurations through the Sophos Central API, built so that one customer's data can never be touched while working on another's.

• Explicit tenant scoping: there is no back-up-everything mode across customers.
• Detects configuration changes by diffing the exported Entities.xml between runs.
• Hardened by default: 0700 directories and 0600 files, a host allow-list for *.central.sophos.com, no secrets or pre-signed URLs in logs, and retention control.
• Paired with research on tracing a change to an admin: Fusion audit logs, per-firewall identity logging and the local configuration audit log.

A read-only PowerShell tool for auditing the security of a large, badly degraded Active Directory environment. Scoped to AD only, and built on guidance from CIS, MITRE and Microsoft.

• About 3,300 lines, compatible with Windows PowerShell 5.1 and statically linted.
• Read-only by design: it inspects the directory and never changes it.
• Written for two readers: a technical report that references the frameworks, and a plain-language report for management.

An interactive trainer for the Microsoft Azure, Entra, security and Intune certifications, built as a self-contained browser app.

• Seven tracks from associate to expert level: AZ-104, SC-300, SC-500, MD-102, AZ-305, SC-100 and AZ-400.
• Hands-on simulations: an RBAC scope picker, subnet sizing, an NSG rule engine and a Conditional Access policy engine.
• Content checked against the current Microsoft Learn exam outlines. Progress stays in the browser.

A homelab Kubernetes platform on a single Proxmox host, running Talos Linux, with everything declared in Git and reconciled by Argo CD.

• Cilium for networking, with an L2 load-balancer pool and Hubble Relay for flow visibility.
• Argo CD in HA with an app-of-apps layout, Traefik for ingress and Longhorn for storage.
• Next up: Vault with External Secrets Operator.