Selected engagements

Engaged as Solution Architect on the New Style of Information Technology (Deployed) programme, designing and costing infrastructure solutions to deliver a replacement modern IT platform for Army and Maritime deployed forces across multiple classifications from OFFICIAL to SUKEO.

The solutions exploited design patterns and vendor relationships from the existing programme to maintain consistency across the estate, while uplifting hardware, virtualisation, and software technologies to provide the latest available capability and performance. A key design constraint was reducing the physical footprint to conform to strict Size, Weight and Power (SWaP) limits for each deployment type, while still increasing return on investment. This was achieved through significant collaborative work with the internal client, cross-functional teams, and vendors — the design gained assurance on component compatibility, integration with existing platform services, and deliverability inside tight timescales.

Key technology uplifts included HPE ProLiant servers and storage, Cisco network components (ISR routers, Nexus and Catalyst switches, ASA and Firepower firewalls), and the VMware suite (vSphere 6.7, vSAN 6.7, NSX 6.4, Horizon 7).

The programme received commendation from a 3-star Lieutenant General in recognition of its continued successful delivery, and the recognition that the new systems would make a significant difference to deployed forces.

I led the original network services review that established the technical debt baseline at UKSBS and made the case for investment in a full network redesign. The pre-existing estate had grown organically over many years, was physically segregated at the switch layer, ran on outdated security models, and operated thirteen firewalls across multiple vendors. In the worst case, getting traffic from one part of the network to another required rules to be deployed across up to eight firewalls spanning four different vendor platforms.

My review became the foundation for what grew from a project into a multi-workstream programme, on which I served as senior architect. I designed the new network end-to-end in collaboration with the client's network SMEs and the chosen vendors, produced the full set of design artefacts from high-level topology through to cabling schematics, built the bill of materials and costings, and put the project plan together. When the original project manager offboarded early, I took on much of the project management work directly, and continued in that capacity until a technical delivery lead was brought in once the firewall migrations were running steadily.

Beyond design and project leadership, I worked at the coalface throughout delivery. I physically deployed and cabled network devices, ran cable-pull failure tests against scenarios I had drafted, drafted the routing topology changes required for each firewall migration, and identified that approximately a quarter of the existing subnets could be decommissioned immediately. I worked the firewall migration weekends to provide technical expertise, troubleshoot issues as they arose, and recover migrations when problems occurred.

The outcome is a unified switching topology coupled with a heavily rationalised, single-vendor firewall estate. The firewall count reduced from thirteen to eight logical firewalls (four per site) running on a virtualised hardware platform of approximately five physical devices. Each site now operates a single firewall policy rather than a separate policy per logical firewall, making rule deployment significantly faster than the team has ever been able to achieve. Approximately eighty devices were removed from the legacy network during the programme, and around twenty-five new switches were deployed to operate the new fabric. Every component is highly available, and the deficiencies of the old estate have been resolved.

I was the architect on the restoration of UKSBS's disaster recovery capability for its business-critical service estate. The starting position was a partially operational DR posture that would have breached SLAs in the event of a real invocation, lacked automation, lacked repeatable test procedures, and had no evidence base proving services could actually be recovered. In-scope services covered the two production Oracle E-Business Suite estates that UKSBS operates as a shared service for multiple client departments, the IBM Cognos EPM platform hosted on behalf of a client department, and the supporting business-critical services that underpin them.

I set the technical direction and produced the design for the deployment, working alongside a delivery lead and the technical teams responsible for build. The new solution introduced Oracle Data Guard for database-level protection, VMware Site Recovery Manager for orchestrated recovery of the virtualised estate, and replication across heterogeneous storage platforms including NetApp, Pure Storage, and Tegile IntelliFlash. Inter-site connectivity was upgraded from 1 Gbps to 10 Gbps to support the data movement required for the improved recovery objectives. Recovery automation was supplemented by repeatable testing scripts to provide assurance and consistency across invocations.

The result was a move from an unknown RTO position to evidenced recovery within the contracted three-day SLA for the Oracle ERP estates, with the majority of VMware-based services recoverable within hours. A formal isolated DR test was successfully executed and signed off by the business — isolated rather than full failover, to ensure no risk of poisoning live production. The engagement ran approximately six to nine months.

I architected the relocation of the UKSBS DR estate from a site that was no longer fit for purpose to a fully resilient commercial datacentre hosting facility. The previous facility lacked resilient power, lacked fire suppression, and did not provide the level of access required to support a credible DR posture. The new facility provides resilient building infrastructure, power, fire suppression, and cooling, served by major telecommunications carriers.

The relocation was a full DR site move covering seven racks at the destination — fewer than the source site because the new layout consolidated a well-engineered traditional estate into a denser footprint. The architectural challenge was that the new physical network kit had been deployed at the destination ahead of the relocation, but the network had not yet been migrated onto it. The rack design therefore had to physically accommodate equipment landing cabled to the legacy network, with a known future cutover onto the new fabric, so that cable runs, port allocations, and physical adjacency would work for both states without requiring re-work at cutover.

I produced the rack elevations and structured cabling schedule as part of the design artefact set. A third-party fit-out partner implemented the cabling and rack build to my design, and I coordinated delivery across the datacentre operator, network carriers, and the fit-out partner. DR posture was degraded during the weekend migration window — an accepted risk approved at business level — and the success of the relocation has since been confirmed by the decommissioning of the old site's equipment as part of the network simplification programme completing.

I was central to the migration of the UKSBS contact centre from its legacy platform to a cloud CCaaS service (8x8), working as architect alongside an architect colleague. We initiated an early tender process to identify a provider ahead of formal project governance, on the basis that the timelines required by the business could only be met by doing so. Although our formal role on the programme was architect, the project lacked a project manager for a substantial portion of its duration, and the two of us effectively ran project management for most of its life.

My contributions covered design oversight, supplier engagement, and governance catch-up, alongside leading several delivery-critical workstreams directly. I drove the communications approach for the rationalisation and retirement of legacy numbers, including phased messaging and stakeholder alignment across the affected client departments. I led and coordinated UAT readiness, including structured test planning, issue logging approaches, and operational readiness checks. I owned the security review of the supplier's build documentation, including role modelling, permissions, and the differences between client and desktop usage models, and I embedded security validation into the broader test plan. I owned the network and identity considerations for real-time voice and data, including interpretation and remediation of network test results, and the SSO and provisioning dependencies that needed to be resolved before go-live. I also supported the broader telephony modernisation intent, including planning for the decommissioning of legacy platforms as migration milestones are reached.

I am working as an architect on the Workday ERP programme, through which UKSBS will onboard six new government departments as customers of its shared service. Workday will sit alongside the existing Oracle Fusion ERP platform that supports current client departments, rather than replacing it.

I am part of the architecture team providing oversight on the enabling services that support the programme — including the AWS-deployed infrastructure, several security aspects of the programme, and identity and security architecture more broadly. Within that, I have specific design and delivery ownership for the Joiner/Mover/Leaver processes that will onboard client departments into the Workday platform.

I designed the JML processes and I run the team delivering them. I run the weekly internal workshops and the workshops with Cognizant, the system integrator delivering the Workday ERP platform, to ensure the design is delivered as written, that programme stakeholders are kept up to date, and that the collateral required from Cognizant to support development is captured and progressed. My role on this strand spans both architecture and technical delivery leadership.

I have been involved in the change governance transformation and CIR portal initiative since its inception, as one of the key stakeholders and the architect on the project. While I was not the formal lead on the revised change model, I have been influential in shaping it and have driven the platform implementation directly.

I built the JPD-based front-door portal that replaces the previous fragmented intake model, designing the structure in conjunction with my knowledge of and input into the new process. I produced the comprehensive training material and operational collateral covering both the why — the behavioural and process change, responsibilities, and quality expectations — and the how, taking users end-to-end from submission through triage, discovery, approval, and transition into delivery. I owned the go-live readiness activities, including acceptance criteria and readiness checklists, the licensing and access model (operator versus contributor), data migration and reporting continuity, and integration considerations with existing delivery tracking and financial recharge processes. I also contributed to the wider Jira and JPD structuring guidance to ensure that demand governance and delivery tracking remain coherent and scalable across teams and portfolios.

The new portal is in live pilot and is in production use as the single front door for change demand across UKSBS.

I authored the design for a secure out-of-band management network service for UKSBS, where no out-of-band capability had previously existed. The design was taken through peer review, remediation, and approval, and the service has been built and is in operation, providing secure management access and a resilience capability aligned with the wider network modernisation work.

I authored the business case for the assessment and migration of the UKSBS Swindon datacentre, covering risk and compliance posture, operational constraints, options appraisal, dependencies, assumptions, and the delivery considerations required to underpin a governance-approved migration decision. The business case explicitly addressed cross-programme scheduling dependencies, organisational and operational impacts including access and process changes, and the pragmatic delivery conditions required to execute a controlled migration.

The recommendation was to migrate out of the existing datacentre to a fully resilient hosted facility, and the business case has been approved in principle. Execution is currently held pending the financial position required to fund the upfront capital expenditure; the business case sits on the shelf and will be picked up for execution once funding becomes available.

I introduced new and improved design document templates into the UKSBS architecture practice, established the hierarchical structure for architectural documentation, and produced the index documents required to support that structure. The work has lifted the consistency and usability of the architecture team's strategic content and provided a reusable standard for ongoing design activity.

I implemented the continued enhancement and expansion of the UKSBS private cloud infrastructure (running VMware vSphere 6.1) to ensure capacity for UKSBS and its customers. I remediated storage tiering on multiple Dell Compellent SANs to ensure aging equipment was removed and high-performance SSDs were introduced. I produced numerous solution designs for their customers looking to onboard onto the new secured estate, and implemented many of the builds.

I also migrated a key client component from the incumbent provider (EduServ) to an on-premise platform as the provider was removing their service offering, and provided technical guidance and support for migrating a key client system from an incumbent hosting platform onto AWS running IaaS. I analysed the providers' implementations and uplifted the security model to assure compliance with internal policies, supported the delivery team with testing of database and application interfaces, traced network traffic, and reconstructed database queries to determine issues.

I implemented a new three-tier private cloud hosting platform using VMware 6 to provide UKSBS with the scalability, security, and resiliency to support its own requirements and those of its customers.

My involvement included review of the high-level designs for the proposed solution and gap analysis against existing resources, which resulted in a number of redesigns to the HLD in conjunction with all the technical teams to finalise the best solution. I implemented three vCenter 6 appliances to manage the three tiers from an isolated Management Zone. I built the VMware hosts into each tier using Distributed vSwitches on 10Gb networks and 8Gb Fibre Channel storage to the Dell Compellent storage platform. I upgraded firmware on the core Brocade Fibre Channel switches and extended the fabric with additional Brocade switches, and reconfigured a number of servers into MPIO to ensure resiliency where it was missing. I also reviewed and resolved a security issue with the core Cisco MDS 9100 series Fibre Channel switches.

I developed and executed a migration plan for over 600 VMs, and re-provisioned twelve ESXi hosts from the legacy clusters into the new hosting platform.

The Windows Server 2003 project was a major undertaking for UKSBS and included over 260 servers with tight timescales. I acted as the key resource on the project, which included the review of all UKSBS servers, technical planning, and implementation for many of the upgrades and decommissions. I was also the liaison between the technical department, the business and its customers, other technical teams, and project teams from different areas. I ensured the overall Project Manager and key stakeholders were kept up to date throughout, that appropriate Change Requests were written and submitted, and arranged third-party support companies where required for specific application upgrades.

This project had the added benefit of removing over 140 physical servers from the datacentre, which is estimated to have saved the business several thousand pounds per annum in power, cooling, and support costs.

Key upgrades I undertook directly included replacing Domain Controllers to Windows 2008 (non-R2 due to Oracle support limitation), migrating two separate Windows 2003 DHCP servers from different parts of the network into a new pair of Windows 2012 R2 servers with Load Balanced Failover configured, upgrading a production Windows 2003 Certificate Authority to Windows 2012 R2, planning and migrating a client Microsoft Exchange Server 2007 onto Windows Server 2008 R2, and deploying a high number of VMs for clients to test and migrate their applications.

I provided the design, planning, and implementation of a new automated DR solution for AHRC and its partners, by utilising existing hardware and network infrastructure where possible.

The solution predominantly comprised Dell Compellent SANs and VMware Site Recovery Manager, alongside a review and redesign of the backup services to improve the recovery process and further enhance the DR solution. I deployed secure and isolated VMware infrastructure in a multi-tiered architecture at the DR datacentre, restructured storage to support replication to the DR site and integration with VMware SRM, installed and configured three pairs of VMware SRM servers to provide automated bi-directional failover between the two datacentres, designed, implemented, and tested Failover Recovery Plans, and implemented a cost-effective backup solution to reduce backup, restore, and administration times whilst reducing storage requirements.

I designed, planned, project-managed, and implemented a global on-premise upgrade to Microsoft Exchange 2013 from existing Microsoft Exchange 2007 servers across four geographical sites, ensuring site resiliency in all UK locations using Database Availability Groups on Windows Server 2012 R2, and migrating legacy Public Folders into Modern Public Folders. The upgrade also included migration of Unified Messaging to Microsoft Exchange 2013 and migration of all internal systems onto the new SMTP gateways.

I also rebuilt and virtualised the existing Exchange Server 2007 Mailbox CCR Cluster prior to the upgrade, to increase resiliency, reduce risk of system failures, reduce costs through virtualisation, and recover over 1.5TB of storage following a Mimecast ingestion process.

I integrated the Pro Global on-premise infrastructure with Microsoft Office 365 through implementation of a resilient ADFS 3.0 server farm, proxy servers, and a DirSync server for Single Sign-On. This required a full review of the on-premise Active Directory estate and subsequent updates to existing objects to ensure the successful synchronisation process into Windows Azure Active Directory and successful SSO.

The work was part of a wider Microsoft licensing review I led across all global projects, working with the licence provider to put forward a blended mix of Enterprise Agreement and Office 365 E4 licences that provided additional infrastructure upgrade headroom for Microsoft Lync 2013 and Microsoft SharePoint 2013 (based on high-level design) for the same cost as the original requirements.

I successfully delivered the Gloucester office relocation project for Pro Global, acting as Technical Project Manager. The role covered IT budget management of approximately £250,000, datacentre suite design, new Cisco LAN switch implementation, and installation of a new virtualised Cisco UCM 9.1 VoIP telephony solution including integration with existing Microsoft Exchange 2007 Unified Messaging and Microsoft Office Communicator 2007. I also managed the prior upgrade of the London office Cisco UCM 6.1 to UCM 9.1 during the same period.

In total, the project moved 200 staff, eight server cabinets including the primary VMware cluster and legacy servers, and implemented a new telephony solution — and was fully operational inside a two-day weekend with limited resources.

I project-managed and delivered the integration of over fifteen business acquisitions into the Jelf corporate network during a period of rapid expansion through acquisition. The estate covered 35 sites and 1,100 users across a private MPLS network, with two hosting CoLos, supporting over 100 Windows servers, Exchange, SQL Server, Citrix XenApp and XenDesktop, and VMware vSphere.

Each acquisition required careful planning, training, and management to tight deadlines. The work covered deployment of new servers and user workstations, user data mapping, and email migration, alongside the assessment and integration of acquired infrastructure into the core network. Prior to a number of acquisitions I completed the due diligence process — assessing the existing IT infrastructure of the target business and providing the costs for integration and upgrades back to the leadership team.

I project-managed and delivered over ten office relocations during my time at Jelf, including the company head office and a number of large regional offices. Many of these were back-to-back with limited existing resources. The relocations included implementation of VoIP/SIP telephony to provide improved functionality to the business while reducing revenue costs.

Alongside the relocation programme, I also managed a major upgrade and relocation of the VMware vSphere production environment from one of the main offices to a dedicated CoLo, while simultaneously upgrading vSphere 3.5 over fibre channel disks to vSphere 4.0 on HP LeftHand P4500 SAN iSCSI arrays. As part of the upgrade I implemented Site Recovery Manager using LUN replication to a secondary CoLo for business continuity, via a 100Mb Layer 2 link between the two sites.

I was responsible for all network and system infrastructure across 35 Jelf sites and two hosting CoLos, served by a private MPLS network supporting 1,100 users. Alongside day-to-day management of the existing estate, I designed and led the transition to a new managed MPLS network, implementing a simplified VLAN and IP addressing schema to reduce the complexity of the existing WAN.

I managed the supplier relationship with the provider to ensure good service and cost control, and I was responsible for reviewing contracts and vendor updates to ensure the business was aware of key technology advancements that could enable improved services. The work formed part of a broader infrastructure stewardship role that also covered Citrix XenApp, BlackBerry Enterprise Server, Mobile Iron MDM, Meru Networks corporate Wi-Fi, and the Websense web management estate.