Selected engagements

Infrastructure
built to survive.

A selection of projects across critical infrastructure, enterprise networking, security, and virtualization. Client names are not disclosed — introductions happen at the right stage of a conversation.

01 Government · Critical Infrastructure

VMware Metro Cluster — National Tax Authority

Geo-redundant compute infrastructure for a national government tax authority — a system that cannot go offline during business hours and cannot lose data. Stretched vSAN across two physically separated datacenters, zero RPO, sub-minute RTO.

Scope Full design, deployment, and live workload migration to a vSAN stretched cluster across two geographically separated government datacenters. No maintenance windows — migration executed in parallel with live operations.
Stack VMware vSphere · vSAN Stretched Cluster · vCenter HA · NSX-T · witness appliance
Outcome Full datacenter failover tested and validated under load. Production cutover executed with zero downtime. Automated DR exercises pass without manual intervention. Infrastructure has remained operational through subsequent crisis periods.
02 Energy · Critical Infrastructure · VDI

VDI Platform — National Hydroelectric Power Operator

Virtual desktop infrastructure for a national energy operator running 8 hydroelectric power plants — replacing physically distributed workstations with a centrally managed, GPU-capable environment accessible from any plant or control room. Operational continuity requirements shaped every architectural decision.

Scope Architecture, deployment, and user migration across distributed plant sites. Profile management, application layering, printing and peripheral redirection, Citrix policy hardening, and high-availability session brokering.
Stack Nutanix AHV · Citrix CVAD · Citrix ADC · Nutanix Files · Citrix Provisioning · NVIDIA vGPU
Outcome Session launch under 8 seconds from any plant location. Centralized patch cycle reduced from 3 weeks to 4 hours. Physical workstation dependency at remote sites eliminated. Infrastructure producing ~10% of national electricity output maintained continuous operational access throughout migration.
03 Municipal Government · Network Security

FortiGate Security Fabric — City-Wide Government Network

Full-stack Fortinet Security Fabric across a mid-sized Eastern European city's administrative, emergency services, and utility networks — 800+ managed devices, centralised policy and visibility, SD-WAN replacing legacy WAN links between city facilities.

Scope FortiGate deployment across city hall, district offices, emergency services, and utility facilities. FortiManager for centralised orchestration. FortiAnalyzer for log aggregation and threat correlation. SD-WAN policy design with dual-ISP redundancy across all sites.
Stack FortiGate · FortiManager · FortiAnalyzer · FortiClient EMS · FortiSwitch · FortiAP · SD-WAN
Outcome Single pane of glass across 800 devices spanning the entire city administration. Policy deployment time reduced from days to minutes. WAN costs reduced 40% through SD-WAN consolidation. Part of a broader city infrastructure programme — see case 04.
04 Municipal Infrastructure · Networking

MPLS Backbone — City Infrastructure Network, 1,500 Nodes

City-scale MPLS backbone for the same Eastern European municipality as case 03 — 1,500 network nodes spanning administrative buildings, emergency dispatch, utility infrastructure, and public services. Delivered as part of a unified city infrastructure programme.

Scope Network architecture, hardware selection, ISP peering, QoS policy design for voice/video/data prioritization, redundancy topology, and phased migration from legacy infrastructure.
Stack Cisco IOS-XE · MPLS/LDP · BGP · OSPF · QoS · Metro Ethernet · Carrier-grade redundancy
Outcome 99.97% uptime SLA maintained across all critical services including emergency dispatch. Zero service degradation during backbone failover exercises. Network remains the operational foundation for city infrastructure.
05 National Infrastructure · Cybersecurity

Security Operations Architecture — National Railway Infrastructure

Full security operations stack for one of Europe's largest railway networks — sensor deployment, log aggregation, threat detection, and incident response architecture across a system spanning thousands of kilometres, hundreds of facilities, and tens of thousands of endpoints.

Scope SIEM platform design and deployment across a geographically distributed rail infrastructure. Log source integration across network, endpoint, identity, and operational systems. Custom detection rule library developed for rail-specific threat scenarios. IR playbooks and tabletop exercises conducted under simulated nation-state attack conditions.
Stack Wazuh · Elastic SIEM · Suricata · Zeek · Velociraptor · EDR integration · Custom detection rules
Outcome Mean time to detect reduced from days to under 15 minutes. Full asset visibility achieved for the first time across the network estate. Threat actor TTPs mapped to MITRE ATT&CK. The architecture was operational when coordinated cyberattacks targeted Ukrainian transport infrastructure in 2022 — and the network stayed up.
06 Provincial Government · Network Architecture

Network Redesign — Provincial Conservation Authority

A provincial government body operating across 9 Ontario sites — field offices, conservation areas, and administrative facilities — inherited a flat, unsegmented network where all traffic shared the same broadcast domain. We are rebuilding the architecture from the ground up: proper segmentation, tiered access control, and a network designed for the organisation's actual operational footprint.

Scope Full network architecture redesign across 9 geographically distributed sites. VLAN segmentation separating operational, administrative, field device, and guest traffic. Firewall policy rebuild, secure inter-site connectivity, and phased migration from a flat legacy network without disrupting day-to-day operations.
Stack Cisco switching and routing · FortiGate firewalls · VLAN segmentation · 802.1X NAC · SD-WAN inter-site connectivity · Network access policies
Outcome Ongoing engagement — phased migration in progress. Operational and administrative segments isolated. Field and IoT devices moved to dedicated network zones. Each phase is tested and validated before cutover — the organisation continues to operate normally throughout.
07 OT Security · Critical Infrastructure

OT Network Visibility — City District Heating Infrastructure

Cisco Cyber Vision deployment for a city-scale district heating operator — passive OT network monitoring across industrial control systems that supply heat to a major urban population. The environment had no visibility into its operational technology network prior to this engagement.

Scope Cisco Cyber Vision deployment across OT network segments. Passive asset discovery and inventory of industrial control systems, PLCs, and SCADA components. Anomaly detection baseline configuration. Integration with IT security infrastructure for unified visibility.
Stack Cisco Cyber Vision · Industrial network sensors · SCADA/ICS asset discovery · OT/IT convergence architecture · Anomaly detection and alerting
Outcome First complete OT asset inventory produced for the operator. Anomalous communications identified and investigated within the first 30 days. Security operations team gained visibility into a network segment that had been effectively blind — in infrastructure that cannot be taken offline.

Engineering credentials

Verified. Not claimed.

Our engineers hold certifications across security, networking, virtualization, and cloud — all publicly verifiable. A selection below.

CISM CISM ISACA CCNP Security CCNP Security Cisco SSCP SSCP (ISC)² Nutanix NCP NCP Nutanix HPE ASE HPE ASE HPE VMware VCP VMware VCP VMware
CISSP CISSP (ISC)²
CISA CISA ISACA
CCNP Enterprise CCNP Enterprise Cisco
CCDP CCDP Cisco
CCNP Collaboration CCNP Collab Cisco
Aruba ACP Aruba ACP HPE Aruba
NSE 4 NSE 4 Fortinet
NSE 7 NSE 7 Fortinet
Nutanix NCM NCM Nutanix
Scality Certified Architect Scality Architect Scality

Founder's badges link to verified Credly records · Team credentials verified at onboarding

Have a project that needs this level of work?

No sales process. You talk to an engineer from the first conversation.

Start a Conversation →