Solutions & Security Architecture · AI Strategy

I make infrastructure boring, on purpose.

Architecture for organisations that cannot afford surprises. Most recently HM Land Registry, CGI's Space, Defence and Intelligence practice, and a database start-up coming out of stealth.

Forty years in — and still the person called when something behaves strangely and the obvious explanations have all been tried.

Start a conversation See the experience Taking new work

Doing this for

40 years

Sectors

Defence · Government
Telecoms · Film

Working

Remote, and on-site
where it matters

Member

British Computer
Society (MBCS)

What I do

01 / the one people call about

Diagnosis

Something behaves strangely and nobody can say why. I find out — from captures and counters, not from an explanation that merely sounds plausible.

AI strategy & enablement

Where it genuinely earns its place, where it does not, and getting a team productive with it rather than nervous about it. I run models locally so I know what the tools actually do.

Cloud & infrastructure architecture

AWS, Azure and on-premises — including the migrations between them, and designs that can move back again. Portability is a requirement, not a nice-to-have.

Security architecture

Zero Trust design, security audit, identity and access, and security operations — including redesigning a SOC and the service built on top of it.

Where this comes from

Titles held

Interim CTO
Lead Infrastructure Architect
Senior Security Architect
Lead Solutions Architect
Senior Solutions Architect
Design Authority
Technical Lead

Responsible for

Redesigned a security operations centre, and the managed service sold on the back of it
Moved a mainframe estate and owned datacentres onto public cloud, prototyping every design before the board ever saw it
Led architecture on removing vendor lock-in — designs that deploy to any cloud and can be brought home again
Authored an organisation-wide cloud security audit
Took a database product out of stealth and through to MVP as technical lead
Built an early-access programme so customers could benchmark against a product inside their own estate
Stood up a Kubernetes platform for virtual production, spanning two clouds
Ran partnerships with silicon and games-engine vendors
Design authority for AWS and Azure workloads
Solution design behind several high-value bid wins
Designed and implemented PKI, back when that was still novel
Built some of the first mobile telecoms ISP services
Infrastructure and monitoring for an exceptionally large datacentre
One of the first large-scale digitalisation programmes at a UK police force
Sat in the CTO chair while revenue quadrupled inside seven months
Rescued a nationwide EPOS estate from Y2K, which is the one somebody always asks about

Companies and clients

Shell Cable & Wireless HM Land Registry CGI Ministry of Defence Microsoft De La Rue London Business School NVIDIA AMD Unity McDonald's General System On-Set Facilities

Deliberately not joined up. Which title did which piece of work, and who it was for, is a conversation — and a better one than a table of dates.

Open source 03

os-webauthn

Released

Passkeys and password-manager-friendly one-time codes for the OPNsense firewall. Auditing it surfaced a timing weakness in the stock TOTP check; the hardening fix now ships in OPNsense core.

PHPFIDO2OPNsense

os-ssoproxy

Source

Single sign-on for anything behind the firewall's reverse proxy, without putting an identity provider on the firewall itself. Knows which API paths each application needs left alone, so protecting a service doesn't quietly break its integrations.

PHPnginxOIDC

gimp-paa

Released

Reads and writes Bohemia Interactive's PAA textures directly in GIMP, so artists can stop round-tripping through tools that stopped being maintained a decade ago.

PythonGIMP

The firewall that ate fragmented UDP

Every small query answered. The one large reply never arrived, and no counter moved anywhere — not the NIC, not the kernel, not the firewall.

9 min

Everything written so far →

About

I have been making computers do things for forty years — long enough to have watched most ideas arrive, leave, and come back wearing a different name.

The shape of the work has changed: development, then infrastructure, then architecture, then the security of both. What has not changed is the part I am actually good at — the unglamorous middle, where a design meets an estate that already exists and has opinions of its own. I am usually brought in when something matters, is complicated, and has to keep running while it changes.

Lately that includes AI: what it is genuinely good for, where it is being oversold, and how to get a team using it well. I run models locally for the same reason I read packet captures — I would rather know than be told.

I write the diagnosis down afterwards, publicly where I can. Partly because it is useful, and partly because a fault you cannot explain is a fault you have not finished.

Something complicated, or something behaving strangely?

Tell me what it does, what you expected, and what has already been ruled out. I will tell you whether I can help before anyone talks about money.

No address published on purpose — spam harvesters read these pages long before people do. This form reaches me directly.