Things I've built, shipped, or am still shipping.

Internal Python + Supabase platform unifying the IT team's source systems (Freshservice ITSM, Microsoft Graph for Entra/Intune, ScreenConnect, Cisco Meraki, Bitdefender GravityZone, Action1) into one analyzable store. Runs a live conversational Claude agent — plain-language requests in private ticket notes, whole-ticket reasoning with subject-person resolution and screenshot vision, a Haiku→Sonnet→Opus escalate-on-low-confidence cascade with the confidence band named on every note, and a wide confirm-gated action surface (machine fixes, Exchange changes, password/MFA resets, groups, scheduled offboarding). Judgment belongs to the model, guardrails to the writes: analysis is unconstrained; nothing changes without an explicit confirm.

A deployed, live Model Context Protocol server (Python, FastMCP on Azure Container Apps) exposing the IT team's operational systems to Claude and Cowork as one namespaced connector: 35 tools across Freshservice, ScreenConnect, Cisco Meraki, Dell TechDirect warranty, and Microsoft Graph. Read-heavy, with a set of governed write tools whose trust boundary sits at the identity layer: an Entra OAuth connector limits access to assigned users and Microsoft Graph runs delegated on-behalf-of, scoping every call to the signed-in user's own roles, backstopped by a bearer-token gate and server-side secret handling. Includes a fleet warranty audit cross-referencing Freshservice assets to Dell entitlements.

Own the company-wide AI program end to end across roughly 1,000 employees: a three-tier governance framework plus the rollout itself. Authored the corporate AI Policy (co-owned with HR and Business Intelligence) covering approved tools, a Protected Information definition, output ownership, and incident response; a separate AI-Assisted Development Policy governing sanctioned tooling, private source control, secrets management, and least-privilege access for anyone building with AI; and a 22-section developer handbook with eleven how-to guides (including end-to-end Microsoft Graph tutorials in PowerShell and Python) plus a production-ready repo template. Backed by a managed developer platform: an isolated non-production tenant, per-developer domain-joined workstations, and a dev-to-production least-privilege promotion flow. Rollout centers on Claude Enterprise, Claude Code, GitHub Copilot, and Microsoft Copilot Studio agents, all governed under one policy.

Heading a program to bring every support team (CRM, application, mobile app, data, and IT) onto one Freshservice ticketing platform, replacing today's mix of email, shared mailboxes, and disparate per-team tools. One front door, per-team queues, shared SLAs and reporting.

Multi-year program bringing a national company that grew through acquisition onto one standardized IT operating model: a single tenant, one network and phone standard, one endpoint and security baseline, and one service desk across 80+ locations.

Two-track reporting layer on top of the Freshservice API: Microsoft Fabric / Power BI for executive audiences plus a parallel SQLite cache + Claude skill for the IT team. Same source of truth, audience-appropriate consumption surfaces.

Snowflake-native Python stored procedure pulling filtered Entra ID users via Microsoft Graph on a daily schedule. Runs inside Snowflake's Python runtime; no external server, no separate venv, no external credentials.

The Python-generated infrastructure-reference core of the IT documentation set (52 files, 29,174 words, regenerable from live-tenant discovery): Active Directory and Group Policy baselines, multi-vendor network and firewall configuration, server and Hyper-V inventory and build standards, and the naming and standards taxonomy across three identity systems. Documentation as code. Policy, operational runbooks, RDS, and Microsoft 365 governance are documented in their own project entries.

Designed, deployed, and documented a multi-site Remote Desktop Services platform serving roughly 850 users. One site splits the RDS roles (Gateway, Connection Broker, Web Access, Licensing) with the gateway isolated in a DMZ and separate session hosts on the internal network, including a dedicated host for a line-of-business accounting application; a regional site runs a consolidated single-server deployment. Public access is TLS-fronted with certificates auto-renewed through Certify The Web using Let's Encrypt and Cloudflare DNS-01, and users connect through either the native client or the HTML5 web client. Connection and resource authorization policies, capacity planning, and full operational documentation round it out.

A library of operational runbooks standardizing how the IT team runs day to day: user onboarding and offboarding, password resets, computer deployment, macOS enrollment through Apple Business Manager and Intune, server patching, backup and recovery, IT purchasing under a hybrid central and regional approval model, asset selection and assignment, and endpoint troubleshooting and escalation. Written as repeatable procedures so any team member, including a new hire or the offshore helpdesk, can execute them consistently.

The documented architecture and governance of the Microsoft 365 estate: Entra ID identity governance (groups, admin roles, Privileged Identity Management, authentication methods), Conditional Access policy design with named locations, app registration and enterprise-app SaaS integration inventory, external identities, a licensing model mapped to SKUs, and workload configuration across Exchange Online, Teams (including voice), SharePoint, OneDrive, and Power Platform. The reference layer every identity, security, and automation decision builds on.

Monthly Microsoft 365 activity report (email, Teams, SharePoint, OneDrive usage) for Client Services and Reconciliation staff, migrated from an on-prem scheduled task to a serverless Azure Automation runbook. Authenticates with a system-assigned managed identity via Microsoft Graph: no server, no certificates, no stored secrets. Mail.Send is scoped by application access policy to a single no-reply mailbox.

Hybrid cloud / on-prem pipeline syncing CRM relationship data to Exchange Online distribution lists. CRM → SharePoint → Power Automate → CSV via on-premises data gateway → PowerShell against Exchange Online. Designed around the Power Automate limitation that DL membership operations aren't supported.

70+ script internal PowerShell library used for monthly Microsoft 365 compliance reviews. Built on Microsoft Graph + Exchange Online + SharePoint PnP.

Endpoint fleet automation across 80+ offices in Microsoft Intune: 29 scripts plus 11 detect/remediate proactive-remediation pairs (bloatware removal, Fast Boot, printer defaults, browser cleanup), app packaging as .intunewin, batch antivirus removal, per-division serial-based device renaming, Edge bookmark policy templates, and winget/Chocolatey update orchestration.

End-to-end ITSM platform rollout replacing inherited spreadsheets and ad-hoc ticketing. 14,168 tickets in 3.5 years; 4,000+ assets in live inventory; 242 KB articles across 25+ folders.

25+ structured Freshservice service items. 1,089 onboarding + 469 offboarding tickets processed. Multi-ticket onboarding cascade plus HR Onboarding Teams App plus Power Automate flows propagating to Freshservice, the outgoing MSP, and the company CRM. Provisioning time compressed from 2 hours to 15 minutes.

SCIM-based integration making Darwinbox the system of record for employee lifecycle events fanned out through Entra ID. User attribute standardization, SCIM connector config, UAT, vendor handoff, plus a downstream Darwinbox-to-CRM notification flow.

PowerShell + Microsoft Graph pipeline replacing manual monthly vendor reporting across 11 manufacturers. Static-IP whitelisted from office ranges.

Production employee broadcast platform: Microsoft Forms + Power Automate + Graph + Twilio with Teams approval routing, dynamic Entra ID audience targeting, and CTIA-compliant toll-free A2P.

Foundational multi-site network refresh across one region's office estate. ~13 Meraki MX appliances + Aruba Instant On switching + APs, procured mid-2023, installed personally on a two-week road trip in October 2023.

Region-by-region migration of per-office internet (individually contracted Comcast, Spectrum, AT&T, Cox — no common management layer) onto CommandLink managed SD-WAN/NaaS. First region: 14 offices / 15 circuits. Overlap-first dual-WAN cutovers on the Meraki MX fleet, sequencing timed to contract terms to avoid early-termination fees, static IPs feeding Conditional Access named locations, and a LAN re-IP standardization riding each cutover.

Reusable cross-tenant PowerShell migration tooling and a 26-page operating playbook generated by a Node.js + docx document builder. Backed by a 293-task work inventory inside a nine-domain repo template.

2014 migration off ACOMARC on SCO OpenServer Unix to Acowin at a regional HVAC business (vendor-driven data conversion), plus the field workflow change that moved technicians from paper to iPads with in-field card processing.

External web-app pentests on 3 production properties under written authorization. 47 findings, demonstrated unauthenticated RCE, GCP service-account key exposure confirmed.

Self-published EPA 608 study app for HVAC technicians on iOS and Android. Three platform generations: App Inventor to Thunkable to Flutter. Latest release adds full Spanish localization (UI plus the entire question bank) and an adaptive Smart Practice mode weighted to weakest questions. Maintenance mode, passive income.

Next.js + TypeScript platform on Cloudflare Workers that runs a 150 to 200 player league across six tournament formats (including a Swiss pairing algorithm with teammate-penalty scoring), with role-based access control, real-time live scoring over Supabase subscriptions, playoff brackets, and a revenue-split calculator that drives 1099 contractor payouts. Five scheduled GitHub Actions workflows run the league's GroupMe communications hands-off: daily schedule posts, weekly recaps, missing-score nudges, registration alerts, RSVP checks, and weather warnings.

Syncs a Reddit feed into a daily-updated Spotify playlist. Python + FastAPI + SQLite, Jinja2 admin UI with run history and manual triggers, APScheduler running the sync at 7am Eastern, single-container Docker on a personal Debian box. In production. Now my #1 playlist on Spotify.

An enterprise-style home network and automation stack: Firewalla Gold SE (IDS/IPS, WireGuard VPN) with HP Aruba Instant On switching and Wi-Fi, a Windows Server Hyper-V host, a custom NVR running Plex, Jellyfin, and Milestone XProtect, and Home Assistant at real scale (370+ devices, 3,578 entities, 96 automations) across Zigbee, Z-Wave, and MQTT, monitored with PRTG, InfluxDB, and Grafana.

This site. Astro 5 + Tailwind v4, content modeled as typed TypeScript data instead of CMS pages, Pagefind for static search, dark mode with persistence, Cloudflare Pages deploy. Built and maintained as portfolio and personal lab.