The work, described by method.

What is left is the method — the problem as we found it, what we changed, and what held afterwards.

Cloud	Work	Layer	Tech
AWS	Building HPC Slurm clusters for scientific workloads We gave simulation and sequencing workloads scheduler-managed clusters — Slurm on managed cluster infrastructure, GPU node types included — and provisioned them as code, so a cluster could be rebuilt rather than repaired. When a network move broke the controller's reachability, we traced the failure through the scheduler daemon and brought the cluster back. We then reused the same template for later workloads.	Scientific platform	Slurm AWS ParallelCluster CloudFormation EC2 GPU VPC
AWS	An Oracle 12c to 19c upgrade for a scientific data platform Instead of upgrading in place, we cloned the production hosts from the overnight backups into the same placement group, so the test environment matched production exactly. We rehearsed the upgrade on the clone, revalidated the application tier against it, and ran the cutover inside a planned window — keeping the old hosts intact as our rollback path. We carried the same clone-stage-cut pattern through the platform's later development and production lifecycle work.	Scientific platform	Oracle 19c EC2 Placement Group AMI EBS Snapshot Windows Server
AWS	A dedicated account for structural biology and cryo-EM workloads We gave structural biology and cryo-EM work its own account rather than letting it share the main estate — cluster scheduling, reconstruction software and a web front end for job submission. We decommissioned the legacy network, peered the new account back to the primary one, bridged directory access with a connector, and carried the license path to the other cloud over the existing VPN. We built governance, lifecycle rules and configuration monitoring into the account rather than adding them afterwards.	Scientific platform	AWS ParallelCluster CryoSPARC Open OnDemand VPC Peering AD Connector AWS Config
AWS + GCP	Standing up and running scientific data analysis platforms We built development and production instances for two scientific data analysis platforms, and after self-signed certificates proved a dead end we settled TLS permanently on managed load balancers with certificates from the cloud's certificate manager. We integrated single sign-on with the vendor over OIDC and supervised the services so they survived restarts. When the platforms later moved to the second cloud, we carried their access path across intact.	Scientific platform	Dotmatics Certara D360 AWS ALB ACM Okta OIDC EC2
GCP	Modernising end-of-life Linux hosts without touching user configuration Two long-lived hosts — an R Shiny server and a scientific license server — were sitting on an end-of-life distribution. We took the Shiny host through a staged in-place upgrade across LTS releases, rebuilt every R package from source and lost no data. We migrated the license server to a clean current build against a step-by-step runbook we wrote for it, which also cut its disk footprint substantially. We brought user-facing configuration through both unchanged.	Scientific platform	Ubuntu Pro/ESM R RStudio Server Shiny Server nginx Schrödinger Maestro
AWS + GCP	Migrating a research application stack to the second cloud Applications we moved from one cloud to the other came out with the usual post-migration breakage, so we rebuilt domain, DNS and TLS around the new addresses. When an integration kept dropping after a fixed number of API calls, we traced it not to the vendor but to a missing static external address on the host, and fixed it by assigning one. For a platform that had only been reachable over VPN, we rebuilt access on a managed load balancer with automatic certificates.	Scientific platform	GCP Compute Engine Route 53 AWS ALB ACM Static IP Dotmatics
GCP	Replacing default service accounts across a GCP organisation We brought an unmanaged fleet of research compute instances under a five-phase programme — discovery, vulnerability review, decision, execution, documentation — and replaced the default compute service accounts with custom accounts scoped per bucket. We moved the production hosts inside a single planned window with no interruption. Where an instance could not be changed in place, we rebuilt it and carried its data and repository history across intact, then made the mounts durable across reboots.	Infrastructure backbone	Compute Engine IAM Service Accounts GCS gcsfuse Cloud Logging
AWS + GCP	Organisation-wide audit logging with a live dashboard Storage audit logs sat scattered across a multi-project cloud organisation, so we centralised them through an organisation-level aggregated sink — into a partitioned analytics warehouse for querying, and an archive bucket for retention. We moved the dashboard off a prototype framework onto a proper application stack and put it behind an internal load balancer, reachable over VPN only. Where the platform's managed certificates could not cover that topology, we terminated TLS on the other cloud and chained it across.	Infrastructure backbone	BigQuery Cloud Logging Aggregated Log Sink Cloud Run Internal Load Balancer AWS ALB ACM
AWS	Cost cleanup: reclaiming an idle cloud estate We turned monthly usage and cost reporting into an owned inventory, tagging every instance, volume, image and snapshot and attributing each to a named owner. We confirmed ownership one by one before touching anything, then retired the idle estate — orphaned volumes, stale images, an accumulated snapshot backlog and long-dormant compute. Behind it we put idle-stop routines and a tagging discipline so the estate would not grow back.	Infrastructure backbone	EC2 EBS AMI EBS Snapshot Cost Explorer Compute Optimizer Trusted Advisor
AWS + GCP	A highly available VPN between AWS and GCP Research workloads needed to reach a license server and a directory on the other cloud, so we bridged them first with a single tunnel and then rebuilt that as a highly available dual-tunnel site-to-site VPN. We joined the host on the second cloud to the managed directory domain on the first, documented the full connectivity matrix as a diagram, and narrowed network exposure to the license server alone. We applied later tunnel endpoint changes with BGP verification and no interruption.	Infrastructure backbone	AWS Site-to-Site VPN GCP HA VPN Cloud Router BGP AWS Managed AD Shared VPC
AWS	Recovering from an expired VPN certificate chain When the certificate authority, server and client certificates behind a managed Client VPN reached their expiry date, every user lost access at once. We traced the cause from the VPN logs to the expired chain, reissued the certificates and redistributed the client configuration the same day, and access came back inside the working session. We wrote up the gap that allowed it — no expiry alerting on the certificate manager — and put renewal on a calendar.	Infrastructure backbone	AWS Client VPN ACM OpenVPN CloudWatch PKI
AWS	Consolidating research access onto a single identity layer A security alarm — domain ownership still sitting with a departed employee — gave us the opening to build one identity layer rather than patch the old one. We stood up a managed directory with file shares, client VPN and single sign-on on top, closed SSH exposure to the internet and moved compute hosts into a dedicated research network. We separated out the roles that had accumulated on the directory management server and hardened the host.	Infrastructure backbone	FSx AWS Managed Microsoft AD AWS Client VPN AWS SSO VPC Route 53
AWS	Standardising security group architecture against lateral movement Security groups had grown per-server, leaving open paths for lateral movement. We proposed a standard built around usage class rather than host — public and private tiers, minimum open ports, VPN as a precondition — and rolled it out development first, production second. We caught the ports missed in the cutover proactively and swept out local administrator accounts outside the domain in the same pass.	Infrastructure backbone	EC2 Security Groups VPC AWS SSO Site-to-Site VPN
AWS	Closing CIS and HIPAA audit findings, then bringing the audit in-house We took on the findings from external CIS Controls, CIS Benchmark and HIPAA scans item by item: MFA coverage, key rotation, flow logging, configuration recording. We placed buckets holding regulated data under conformance pack rules with the provider's business associate agreement in place. Over time we moved the assessment itself in-house and made it continuous — driven by threat detection, configuration rules and a security hub rather than a periodic outside scan.	Infrastructure backbone	AWS Config Security Hub GuardDuty CIS Benchmark VPC Flow Logs AWS Artifact
AWS + GCP	Scoped data exchange with contract research organisations We put data sharing with outside research partners on a repeatable pattern instead of ad hoc grants: identities scoped to a single prefix or bucket with no delete rights where that was enough, cross-account bucket policies or presigned URL flows where compliance required it. We passed credentials over an authenticated channel, caught over-broad policies before they shipped, and moved large transfers to multipart upload.	Infrastructure backbone	S3 GCS IAM Bucket Policy Presigned URL Multipart Upload
AWS	Secure desktops for overseas CRO teams Scientists at an overseas contract research organisation needed to work inside the research platform without being issued VPN or directory accounts of their own. We took a managed desktop service from proof of concept to a production architecture — transit gateway peering, a directory connector, scoped network rules — then migrated the estate onto a newer streaming protocol with no loss of access, consolidating the network path in the same move.	Infrastructure backbone	AWS WorkSpaces Transit Gateway AD Connector VPC
AWS + GCP	Backup plans and the restores that proved them We defined daily and weekly backup plans and assigned the critical hosts to them — database, scientific application and directory servers. We did not leave the plans as configuration: we recovered failed builds and corrupted configurations from specific restore points, and on the second cloud we restored a snapshot and swapped the address to put a replacement host in place of a broken one, fast enough to keep the working day.	Infrastructure backbone	AWS Backup EBS Snapshot GCP Snapshot Static IP Oracle
AWS	Layered least-privilege access for an outside service provider Bringing in an external provider did not mean handing over administrator rights. We designed a layered access model instead: a delete-protected operational administrator role bounded by a permissions boundary, named individual identities rather than a shared account, MFA required, and elevation routed through an approval workflow. We wrote down what the provider could and could not do before the handover rather than discovering it after.	Infrastructure backbone	AWS IAM Permissions Boundary IAM Roles MFA AWS Organizations

Read all reviews

Work like this begins with a defined project.

Tell us what your workloads run on and share your requirements. Let us discuss the right operational approach for your cloud environment.

Start the conversation

Real work, no names.

The work, described by method.

Work like this begins with a defined project.