Projects that deliver

Challenge

A critical infrastructure operator needed to replace a legacy back-office platform supporting field operations across a large distributed fleet. The existing system relied on perimeter security and shared service accounts that were no longer defensible at audit. Field devices needed reliable, sub-second authentication against a central identity service, with cryptographic identity to prevent device spoofing. The team had a fixed rollout window and could not tolerate downtime on the operational workloads the platform supported.

The work

We designed and built a zero-trust platform on Azure Red Hat OpenShift. Device and workload identity through Keycloak, federated with the operator's existing identity tenant. mTLS across in-cluster communications using an internal PKI managed via cert-manager. Application Gateway with WAF at the edge, with TLS inspection on east-west and north-south traffic. GitOps deployment pipelines via ArgoCD with policy enforcement. Secrets externalised to Azure Key Vault, surfaced into the cluster through ESO. Full observability stack with metrics, logs, and traces aligned to operational SLAs.

Outcomes

• Phased rollout across multiple waves over nine months with zero production incidents
• Authentication latency reduced from several hundred ms to under 50ms at p99
• Audit findings on identity controls closed at the first follow-up review
• Operational toil reduced through automation of certificate lifecycle and deployment processes
• Platform now serves as the reference architecture for the operator's broader modernisation programme

Technologies

Challenge

A growing payments business was running on a single-region hosted infrastructure that had outgrown its capacity. They were seeing intermittent latency spikes during high-traffic windows, had no documented disaster recovery, and faced increasing scrutiny from their banking partners around operational resilience. They needed to move to a multi-region cloud architecture, prove DR capability, and reduce monthly infrastructure costs (which had grown faster than transaction volume) without disrupting payment flows.

The work

We migrated the core payments platform from a single-region hosted provider to a multi-region Azure landing zone. Active-passive failover between South Africa North and West Europe with automated DR drills. Service mesh on AKS with mTLS between services. PCI-DSS-aligned network segmentation with strict egress controls. Database tier moved to Azure Database for PostgreSQL with geo-replication and point-in-time recovery. Cost optimisation tactics applied throughout: reserved instances on stable workloads, auto-scaling on traffic-variable services, tag-based showback for product-level cost allocation.

Outcomes

• Migration completed in 24 weeks, zero downtime on any of three cutover windows
• Monthly infrastructure costs reduced 42% versus previous hosted provider for equivalent capacity
• DR drill conducted successfully on month four, failover completed in 18 minutes
• Latency p99 improved from 800ms to 220ms for the primary payment flow
• PCI-DSS scope reduced and documented for audit, passed Level 1 assessment

Technologies