Enterprise and Solution Architecture
Translating business strategy into target-state architectures, roadmaps, and standards that engineering teams can actually deliver.
Explore capability
Houston, Texas, United States
Enterprise Architect — Cybersecurity, Cloud and Network Transformation
Helping organizations design secure, scalable, resilient, and well-governed technology environments.
Credibility highlights
20+ years of enterprise IT experience
From hands-on network engineering to enterprise architecture leadership across regulated environments.
Architecture and cybersecurity leadership
Target-state design, security architecture, and governance for complex infrastructure programs.
CCIE ×2, CISSP, CCSP, CISM, PMP, and Microsoft credentials
Deep, verified expertise across networking, security, cloud, and technical program delivery.
Financial services, cloud, and managed services
Experience where compliance, availability, and confidentiality are non-negotiable.
Capabilities
Expertise that spans architecture, security, and delivery
Six of the areas where organizations most often engage me — each backed by hands-on delivery experience, not just advisory slides.
Cybersecurity Architecture
Designing layered security architectures that reduce real-world risk while remaining operable by the teams who run them.
Explore capability
Cloud and Microsoft Platforms
Building secure, well-governed Azure and Microsoft 365 environments — landing zones, identity, data protection, and cost-aware design.
Explore capability
Networking and Data Centers
Architecting enterprise networks and data center environments — from campus and branch to SD-WAN, segmentation, and facility migrations.
Explore capability
Identity and Zero Trust
Putting identity at the center of security — conditional access, privileged access, device trust, and pragmatic Zero Trust adoption.
Explore capability
AI Security and Governance
Helping organizations adopt AI services with the same discipline applied to any enterprise platform — governed, monitored, and risk-assessed.
Explore capability
Selected Work
Representative projects
Sanitized case studies from enterprise engagements — the business problem, the architecture, and what changed.
Enterprise ArchitectureSanitized case study
Multi-Region Brokerage Connectivity and Token Resilience Platform
Architecture and delivery of a dedicated token-resilience control plane for an automated trading platform — one safe refresh owner per brokerage connection across multiple regions, with leases, fencing and versioned atomic commits replacing an in-process refresher that lost credentials under concurrency.
- OAuth 2.0 authorization code flow
- PKCE (RFC 7636)
- Refresh token rotation and replay detection
- OAuth 2.0 Security Best Current Practice (RFC 9700)
MicrosoftSanitized case study
Microsoft Teams Phone System Design, Configuration, and Call Routing
Designed and configured a Microsoft Teams Phone deployment for a growing professional-services organization — PSTN connectivity, number plan, Auto Attendants, Call Queues, dial plans, emergency calling, and the network readiness work that makes the calls sound right.
- Microsoft Teams Phone
- Microsoft 365
- Microsoft Entra ID
- Teams admin center
GovernanceSanitized case study
NYDFS Part 500 and AI Cybersecurity Readiness Assessment
Independent readiness and gap assessment of a New York-licensed financial institution against 23 NYCRR Part 500, extended to cover the institution's own use of AI and the AI-enabled threats directed at it.
- Microsoft Entra ID
- Conditional Access
- Privileged Identity Management
- Microsoft Purview
Data CenterSanitized case study
Enterprise Data Center Modernization
Led the architecture and migration planning for consolidating aging data center environments onto a modern, resilient platform for a large regulated enterprise.
- Cisco data center switching
- Virtualization platforms
- Enterprise storage
- Structured cabling and facilities
CybersecuritySanitized case study
Zero Trust Network Access and Identity Architecture
Designed an identity-centered Zero Trust architecture — conditional access, device trust, and privileged access — replacing implicit network trust for a distributed workforce.
- Microsoft Entra ID
- Conditional Access
- Privileged Identity Management
- Multifactor authentication
NetworkingSanitized case study
Secure SD-WAN and Branch Transformation
Architected the migration from legacy MPLS-centric branch connectivity to a secure SD-WAN design with centralized policy, segmentation, and direct cloud access.
- SD-WAN platform
- Cisco routing and switching
- Next-generation firewalls
- Cloud security services
How I Work
From business requirements to running, governed systems
A consistent approach refined over two decades of enterprise programs.
- 01
Understand the business
Every engagement starts with requirements, constraints, risk appetite, and what success means to the organization — before any technology choice.
- 02
Architect the target state
Design a secure, scalable target architecture with explicit trade-offs, standards, and a transition path that respects production reality.
- 03
Design security in
Identity, segmentation, data protection, and monitoring are part of the architecture from day one — not a review gate at the end.
- 04
Govern the implementation
Decision records, design reviews, and honest status keep delivery aligned with the architecture as vendors and teams execute.
- 05
Validate and hand over
Cutovers are rehearsed, results are validated against objectives, and operations teams receive documentation they can live with.
- 06
Improve continuously
Architectures are revisited as the business, threat landscape, and platforms evolve — improvement is planned, not accidental.
Research and Writing
Publications and research
Published research and professional writing on cybersecurity and enterprise technology.
Research interests span cybersecurity architecture, cloud security, Zero Trust, and AI governance. The authoritative record of academic work lives on Google Scholar.
View Google Scholar Profile (opens in a new tab)Insights
Latest articles
Practical writing on architecture, security, cloud, and AI governance.
AI Architecture
Microsoft Copilot Studio vs Microsoft Foundry: Which AI Agent Platform Should Your Business Choose?
Copilot Studio and Microsoft Foundry are not competitors — they sit at different levels of abstraction, and three changes in 2026 have quietly retired most of the advice written about choosing between them. A decision framework built on who owns the runtime, where the data already lives, and who operates the agent on day ninety, with the cost shapes, governance asymmetries and interop paths verified against Microsoft's own documentation.
15 min read
AI Architecture
Microsoft Foundry Explained: Enterprise Architecture for Production-Grade AI Agents
Microsoft Foundry is no longer a place to call models — it is a platform for hosting, grounding, governing and operating agents. A working architecture guide to prompt and hosted agents, Foundry IQ, Toolbox, MCP and A2A, model choice and Claude, agent identity and RBAC, private networking, evaluation and Agent 365 — with every capability marked GA, Preview or retiring, and the places Microsoft's own documentation contradicts itself named rather than smoothed over.
41 min read
AI Security
Agentic AI Security Architecture: Securing Autonomous Agents in the Enterprise
A research-grounded enterprise reference architecture for autonomous AI agents: agent identity, task-bound authorization, tool and MCP gateways, memory security, runtime containment, observability, and incident response — with an OWASP agentic Top 10 mapping, a bounded-autonomy model, and a 38-control matrix.
71 min read
Let's talk about your environment
Architecture, cybersecurity, cloud, networking, AI governance, or technical transformation — if it needs to be secure, scalable, and governed, I can help.