Infrastructure Work
Operations work, shown as it is actually done
Practical infrastructure work presented as capability case studies: the problem each one solves and how we approach it. Pricing and scope are worked out per engagement.
Active Directory & Group Policy active
User/group lifecycle and policy management at scale.
Problem: Manually provisioning users, groups, and policy across a domain is slow and inconsistent, and mistakes here have wide blast radius.
Approach: Direct AD/GPO administration — creating and managing users, groups, OUs, and GPOs, including GPO backup/restore and permission auditing — scripted and repeatable rather than done by hand in the console each time.
Citrix Virtualization active
VM lifecycle management on Citrix Hypervisor.
Problem: Provisioning, resizing, snapshotting, and tearing down VMs by hand through a hypervisor console does not scale past a handful of machines.
Approach: Programmatic control over the full VM lifecycle — create, clone, resize, snapshot/revert, and power operations — against Citrix host infrastructure.
Network & Switch Administration active
Layer 2/3 configuration and visibility on managed switches.
Problem: Network segmentation and port configuration errors are hard to spot after the fact, and there's rarely a fast way to check what's actually plugged in where.
Approach: VLAN creation and port configuration, plus read access to ARP/MAC tables, LLDP neighbors, and interface status for day-to-day network administration and troubleshooting.
Backup Administration (Veeam) active
Backup job health, repository capacity, and restore readiness.
Problem: A backup job silently failing is one of the most common ways organizations discover — too late — that they can't actually restore.
Approach: Monitoring backup jobs, sessions, and repository capacity, tracking failed sessions, and confirming restore points actually exist before they are needed.
Security Monitoring (Wazuh) active
Endpoint visibility, alerting, and file-integrity monitoring.
Problem: Without centralized log and file-integrity monitoring, compromise or misconfiguration on an endpoint can go unnoticed for a long time.
Approach: Wazuh-based agent monitoring across endpoints — alert triage by severity and MITRE mapping, authentication event review, file-integrity monitoring, and security configuration assessment.
Identity & Access: Conditional Access and MFA rollout active
Policy rollouts measured before they are enforced.
Problem: Turning on MFA, blocking legacy authentication, or requiring passwordless sign-in for administrators locks people out if nobody knows in advance who will be affected and why.
Approach: Every policy runs in report-only mode first. Sign-in logs are parsed to show, per policy and per person, who would be blocked and what the fastest fix is. Exceptions go through a controlled group with a validation checklist. Each enablement has a change record with rollback, and a post-enablement watch confirms the result. Covers MFA without SMS, passkeys, legacy-auth blocks, device and session controls, and country-based access.
Azure & Entra tenant management active
The identity platform run as a system, not a settings page.
Problem: A Microsoft 365 tenant accumulates app registrations, SSO integrations, groups, device records and hybrid service accounts faster than anyone documents them, and each one is a way in.
Approach: Tenant administration through Microsoft Graph and PowerShell: app registrations, single sign-on with explicit claims mapping, group automation, privileged-role management and authentication-methods policy. Device posture from joined Entra and Intune inventory, so access policies are designed against what is actually enrolled. Azure platform operations and automation identities with certificate credentials rather than secrets. Hybrid identity across on-premises Active Directory and Entra, with every repair run dry-run first and its rollback stated.
Certificate lifecycle management active
Nothing expires unnoticed, and the right team gets the ticket.
Problem: Certificates are issued by one team, installed by another, and renewed by whoever notices the expiry email. The usual result is an outage on a date everyone could have predicted.
Approach: A daily expiring-certificate report reconciled against the load-balancer and application ownership inventory, so each renewal goes to its owner as a ticket weeks ahead. Key and CSR generation enforces approved key sizes. For environments that want it automated, CertHub, a .NET web app Bryan built, requests and renews certificates through the CA's API or ACME DNS validation, tracks them in one place, and reports on schedule, with access controlled by directory group and every DNS write previewed before it runs.
Microsoft 365 compliance and email security active
Holds, retention, permissions and mail filtering, done read-only first.
Problem: Compliance requests arrive as urgent one-offs: put these mailboxes on hold, find who has access to this site, explain why this sender is quarantined. Done by hand under pressure, they go wrong.
Approach: Discovery scripts that produce a command plan for a human to review and run, rather than executing changes themselves. Retention and permission snapshots before any recommendation. Quarantine analysis that separates bulk-mail classification from authentication failure, so a safelist is scoped to exactly the sender that needs it and no wider.
Change management and audit evidence active
Every change has a record, a rollback, and proof.
Problem: Auditors and change boards ask the same two questions: what exactly did you change, and how do you know it worked?
Approach: Change documents with risk rating, operator steps and rollback. Evidence captured before and after, at timestamps. Server build reports and coverage checks generated by script so the evidence is reproducible. Phase close-outs graded item by item against the original plan, with "could not verify" written where that is the truth.