Capabilities
Infrastructure, the AI that runs inside it, and the software on top. One engineer, end to end, for systems that often cannot depend on someone else's cloud.
Sovereign infrastructure
An air-gapped environment breaks nearly every assumption a normal Kubernetes platform is built on. There is no registry to pull from, no chart repository, no upstream to reach for a CVE fix, and often no way to get a shell in when something breaks at 3am. The platform has to carry everything it needs, and the process around it has to move artifacts across the boundary in a way an auditor will accept.
That is the work. Not a Helm chart, a supply chain you can vouch for and a cluster that can be rebuilt from what is already inside the perimeter.
Air-gapped and sovereign environments
Offline registry mirroring and image promotion across the boundary. Reproducible artifact provenance, so you can prove what is running. A patch and CVE cadence that assumes zero egress. Cluster bootstrap and rebuild from media that is already inside.
Kubernetes, cloud to bare metal
On-premise clusters on your own hardware, managed clusters in GCP and Azure, and the hybrid cases in between. GitOps delivery so the cluster state is reviewable. Multi-cluster topologies designed to fail independently rather than together.
Virtualization platforms
Proxmox and VMware treated as a designed layer, not an accident of history. Storage and network topology, live migration, backup and restore that has actually been tested by restoring something. More on Proxmox consulting and migration.
Hardened Linux
Minimal base images, a controlled and inventoried supply chain, and a hardening baseline you can hand to a security reviewer without flinching.
Cross-cloud and hybrid
Primary depth in GCP and Azure. Identity, network and data paths between cloud and on-premise, designed so that the cloud outage does not become your outage.
Resilience and disaster recovery
Redundancy design, recovery objectives that mean something, and self-healing behaviour that is verified by breaking things on purpose rather than assumed.
Sovereign AI
Every regulated organisation in Europe is being asked for agentic AI, and most of them cannot send their data to an inference API in another jurisdiction. That is not a licensing problem. It is an infrastructure problem, and it is the same one as above.
Running models on your own GPUs, behind a gateway that logs and enforces policy, with retrieval over documents that never leave the building, is infrastructure work first and AI work second. It needs someone who has run a cluster with no internet. I have.
Self-hosted inference
Open models on your own hardware. GPU scheduling and model serving on Kubernetes, model lifecycle and versioning, and inference that keeps working when the environment is fully disconnected.
AI gateways
A single controlled ingress for all model traffic. Routing between models, quotas and rate limits, cost attribution per team, audit logging of every prompt and response, and key management that is not a shared secret in a wiki.
Guardrails
Policy at the model boundary, on the way in and on the way out. Prompt-injection defence, tool-use restrictions, and data-loss prevention, built so a security team can reason about the failure modes instead of trusting a vendor's marketing.
Agent fleets and harnesses
Designing, orchestrating and operating fleets of agents, and the harness they run inside: tool boundaries, permission models, process isolation, and observability good enough to answer what an agent did and why.
Retrieval over private corpora
Retrieval pipelines over documents that cannot leave the perimeter. Ingestion, chunking, embeddings and index all hosted by you, with access control that survives contact with the retrieval layer.
Agentic development
Putting agentic workflows into a real engineering organisation: where they are allowed to act, what they are allowed to touch, and the review gates that stay meaningful when the volume of change goes up.
Software engineering
Underneath the infrastructure and the AI, there is still software to build. Eight years of it: sophisticated systems built from the ground up, and legacy software pulled out of archaic languages into something a current team can read and maintain. I have done this both as the tech lead steering a team and as the engineer writing the code.
The leverage now is agentic coding. I build with AI agents under close human steering, spending my attention on direction and boundaries rather than micromanaging keystrokes. Knowing the patterns, the security, the delivery, the hosting and the observability is what keeps that fast without the wheels coming off.
Systems from the ground up
Design through implementation, testing and QA. Whole systems that hold up in production, not prototypes that someone else has to finish.
Legacy modernisation
Migrating software off archaic languages and dead frameworks into a stack a current team understands, without losing what the old system quietly knew.
Architecture and patterns
The right structure and boundaries for the problem, so the system stays workable as it grows instead of calcifying into something nobody wants to touch.
Security and QA, built in
Security, testing and validation as part of the build, not a phase bolted on at the end when it is too late to be cheap.
Delivery and hosting
Release pipelines, where it runs, and getting changes to production safely and often rather than in rare, frightening events.
Observability
Being able to see what the system is actually doing in production, so a problem shows up as a signal rather than a surprise.