Profile
Senior cloud and infrastructure engineer with 30+ years in IT, across Microsoft, Linux, macOS, networking and virtualisation. I bring organisations' IT up to date from top to bottom. That means Microsoft 365 migrations, moving from hybrid Active Directory to Entra ID, device management with Intune and Autopilot, and the servers, network and security underneath. Then I automate the work so it is done the same way every time.
Recently I have focused on using AI in engineering work. I have built a system that lets AI coding assistants work under clear rules, with a person approving each important step. I also run my own Kubernetes platform, which hosts live public websites. My view of AI is practical. It helps good engineers work faster, but a person still reviews the work, makes the decisions and owns the result.
Career highlights
At a glance
- Delivered infrastructure and Microsoft 365 projects for organisations of 45 to 1,450 seats
- Designed and built an AI engineering platform where a person approves every important step, with 900+ automated tests
- Rebuilt a hosting datacentre as one fully redundant Hyper-V cluster
- Managed a 14-person support team across three countries for a global software company
- Designed, built and run a live public website on my own, from the code to the Kubernetes hosting
Core skills
What I work with
Cloud & identity
- Microsoft 365
- Entra ID
- hybrid AD / Entra Connect
- Exchange Online
- Microsoft 365 tenant migrations
- Azure
- Azure Virtual Desktop
Devices
- Intune
- Autopilot
- automated Windows deployment
- macOS management
Automation
- PowerShell 7
- Microsoft Graph API
- Python
- Ansible / AWX
- REST APIs
- Git
AI engineering
- Claude Code
- OpenAI Codex
- Gemini
- Model Context Protocol (MCP)
- safety rules and human approval for AI agents
- local AI models (Ollama, Open WebUI)
Platform
- Kubernetes (k3s)
- Docker
- Proxmox
- Hyper-V
- VMware vSphere
- CI/CD (Gitea Actions)
- OpenBao / Vault
- Cloudflare Tunnel and Access
Development
- TypeScript
- React
- Next.js
- Python / FastAPI
- PostgreSQL
- C# / .NET
Network & security
- Fortinet
- Sophos
- Cisco
- UniFi
- 802.1X Wi-Fi
- security hardening
- fixing security audit findings
Experience
Where I’ve worked
Senior Engineering Consultant
Business Technology Group (BTG)
Oct 2024 – Present
- Move business clients to Microsoft 365 and update their existing Microsoft 365 setups.
- Move clients from hybrid Active Directory to Entra ID.
- Set up Intune and Autopilot to manage computers from first setup to retirement, replacing manual imaging and older on-premises tools.
- Use AI to write scripts and documentation and to solve problems faster. Every change still goes through human review and change control.
Technical Lead – Infrastructure
Optimus Systems Ltd
Jun 2020 – Oct 2024
- Lead engineer and the escalation point for difficult problems. Scoped, quoted and delivered infrastructure, security and cloud projects, and mentored the engineering team.
- Merged three separate datacentre environments into one fully redundant Hyper-V cluster. It hosts client virtual servers and internal services.
- Helped grow the business from 10 to more than 26 managed clients, mainly organisations of 50 or more seats.
- Projects included Exchange to Microsoft 365 migrations, Azure Virtual Desktop, VMware ESX to Hyper-V migrations, HPE SAN storage, Windows Server 2008 to 2019/2022 upgrades, and SQL Server and Active Directory migrations.
- Deployed Fortinet and Sophos firewalls, secure enterprise Wi-Fi (802.1X), and Intune and Autopilot.
Infrastructure Specialist
Lexel Systems Ltd
May 2013 – Jun 2020
- Designed, deployed and supported Microsoft, VMware and Fortinet systems for clients of up to 1,450 seats in education, manufacturing, retail and aged care.
- Supported a key client's nationwide Cisco network of more than 90 switches.
- Moved clients from Exchange 2007 and 2010 to Office 365, merged Active Directory environments, built VMware disaster recovery on shared storage, and automated Windows desktop builds with MDT and WDS.
- Fixed the issues raised in a KPMG audit of external network security.
- Provided 24/7 support for major incidents, and technical support for sales.
Support Manager – Asia Pacific
Kaseya
Sep 2011 – May 2013
- One of three global support managers in a 58-person team across eight countries, supporting more than 8,000 clients 24/7.
- Managed 14 staff in New Zealand, China and India.
- Cut escalations from the region from daily to one every few months.
NZ IT Manager
George Weston Foods
Feb 2009 – Sep 2011
- Ran IT for a 500-seat business across more than 30 New Zealand sites, and was the main contact for the Australian head office.
- Introduced a SIP phone system that saved about $120,000 a year.
- Worked on the SAP rollout that replaced a 20-year-old system.
- Kept the business running through the Christchurch earthquakes.
Earlier career
2005 – 2009
Senior Systems Engineer, Codeblue (2007–2009). Technical Consultant, Computerland / Gen-i (2005–2007). Work included Citrix, VMware ESX, HP and IBM SAN storage, Exchange and SQL Server migrations, and disaster recovery.
Personal projects · in my own time
AI & platform projects
AI OrchestratorA self-hosted system that lets AI coding assistants do real engineering work safely. Objectives come in from Claude or ChatGPT and go to Codex and Claude, each working in its own isolated sandbox. A person approves every important step, a second AI reviews the work, and a signed record shows what was done. Built with Python (FastAPI), React, PostgreSQL and Kubernetes. It has more than 900 automated tests and over 100 releases.Read more →SouthpawStrings.comA live website for left-handed guitarists that I designed, built, secured and run on my own. Built with Next.js, React and PostgreSQL. It has secure sign-in (OAuth with multi-factor authentication), encrypted user data, and automated testing and deployment (CI/CD). Its servers are not open to the internet. Visitors reach it only through a zero-trust secure tunnel.Read more →Self-hosted platformMy own server platform: Kubernetes (k3s) on Proxmox, with an NVIDIA GPU server to run AI models locally. Gitea holds the source code and runs the builds. OpenBao stores passwords and keys, and uses a cloud key service to unlock itself. Cloudflare Tunnel and Access control who can reach it. The public websites have since moved to a hosted server.Read more →
ULC Platform & AgentA small project for managing Windows computers remotely. A .NET 8 agent on each computer collects approved, signed PowerShell scripts from a web console (FastAPI and React) and runs them. The agent only makes outgoing HTTPS connections, so no computer needs to accept connections from outside.
Guardrails for AI agentsRules and tools that make AI coding assistants follow normal change control. They include written working rules, automatic checks that block unsafe actions, release scripts that show a preview before they change anything, releases locked to an exact build, and practised rollbacks.Read more →