Expertise
Expertise, backed by the work.
Explore the systems I’ve built, the problems I’ve solved, and how I work. You’ll find a detailed tools list below.
Infrastructure & Endpoints
Cloud and on-premises systems, office networks, remote access, monitoring, recovery, and the device fleet.
See experience and examples →
Identity & Security
Who can access what, how access changes, and the controls that protect identities, devices, and email.
See experience and examples →
Automation, Software & Data
Internal applications, integrations, and data pipelines that remove repeated work and make business data useful.
See experience and examples →
IT Support & Service Operations
Day-to-day support, difficult technical problems, and the service desk practices that keep work moving.
See experience and examples →
Technical Leadership & Delivery
Standards, roadmaps, investment decisions, acquisitions, and developing people while staying hands-on.
See experience and examples →
Tools and platforms
Hybrid infrastructure
Where I've spent the most time. Servers, networks, identity, endpoints, and ITSM across on-premises and cloud, at multi-site scale.
- Windows Server + Hyper-V virtualization
Hyper-V hosts, AD, file/print, virtual networking, VHDs
Applied in: Multi-site Remote Desktop Services platform · AI-augmented IT operations platform · Home lab and home automation
- Multi-vendor networking
Cisco Meraki MX/MR/SM across 51 sites; Ubiquiti EdgeMax + EdgeRouter X; Aruba Instant On switching and Wi-Fi; Ubiquiti NanoStation point-to-point bridges; CommandLink managed SD-WAN/NaaS migration across per-office ISPs.
Applied in: Multi-site network and WAN standardization · Multi-site Remote Desktop Services platform · AI-augmented IT operations platform · IT standardization and acquisition integration · Home lab and home automation
- Site-to-site VPN architecture
Cross-vendor mesh (Meraki MX terminating against Ubiquiti EdgeRouter X)
Applied in: Multi-site network and WAN standardization
- Hybrid AD + Entra ID
AD Connect, dynamic groups, Conditional Access, PIM, Privileged Identity Management
Applied in: AI-augmented IT operations platform · Microsoft 365 identity, standards, and automation · Employee lifecycle and service catalog automation · Windows estate security and detection · Business-system integrations and data pipelines · Microsoft Fabric F64 migration and Snowflake review · IT standardization and acquisition integration · Entra stale-guest lifecycle automation · Home lab and home automation
- Windows Server RDS / RemoteApp
Connection Broker, Session Host, Gateway, Licensing. TLS-fronted Gateway with cert lifecycle.
Applied in: Multi-site Remote Desktop Services platform · Windows estate security and detection · Home lab and home automation
- Microsoft Azure
Hybrid architecture, automation, security, monitoring
Applied in: AI-augmented IT operations platform · Microsoft 365 identity, standards, and automation · Business-system integrations and data pipelines · Entra stale-guest lifecycle automation
- Microsoft 365 administration
Launched M365 / Exchange Online at a prior employer; 12+ years total. Exchange, SharePoint, Teams, OneDrive, governance
Applied in: Microsoft 365 identity, standards, and automation · Infrastructure and business systems modernization · Multi-region phone system consolidation on Teams Phone · Identity, endpoint, and email security · Business-system integrations and data pipelines · Microsoft Fabric F64 migration and Snowflake review · Freshservice service operations, reporting, and runbooks · Enterprise AI rollout, policy, and governance
- Intune device management
Windows + macOS (paired with Apple Business Manager federation)
Applied in: Intune fleet management and proactive remediations · Microsoft 365 identity, standards, and automation · Employee lifecycle and service catalog automation · Enterprise browser extension for a vendor portal · Freshservice service operations, reporting, and runbooks · Home lab and home automation
- MDM across four platforms
Meraki Systems Manager + Verizon MDM (prior employer), Intune for Windows and macOS (most recent employer), Apple Business Manager federated with Entra ID (most recent employer)
Applied in: Intune fleet management and proactive remediations
- Telephony / UC migrations
Tadiran Coral → OnSIP → Zoom Phone (prior employer, published OnSIP case study, substantial cost reduction). Microsoft Teams Phone with Microsoft Calling Plans (most recent employer); retired the earlier BCMOne Direct Routing setup.
Applied in: Multi-region phone system consolidation on Teams Phone
- Line-of-business app hosting
QuickBooks Desktop self-hosted, Right Networks, RDS / RemoteApp publishing
Applied in: Infrastructure and business systems modernization
- ITIL Framework
Incident, problem, change, request, asset, knowledge; thousands of tickets a year
Applied in: AI-augmented IT operations platform · Employee lifecycle and service catalog automation · IT standardization and acquisition integration · Freshservice service operations, reporting, and runbooks · Dell warranty to Freshservice sync · ScreenConnect remote endpoint ops toolkit
Automation, scripting, and AI augmentation
The default response to a repeatable problem. PowerShell-first for IT; Python for data and integration; AI-assisted investigation builds on those integrations.
- PowerShell
Advanced scripting, module dev, Graph API. Internal M365 admin library plus the PowerShell toolkit from a prior employer that predated it
Applied in: Multi-site Remote Desktop Services platform · Intune fleet management and proactive remediations · Microsoft 365 identity, standards, and automation · Infrastructure and business systems modernization · Windows estate security and detection · Business-system integrations and data pipelines · IT standardization and acquisition integration · Entra stale-guest lifecycle automation
- Python
Data pipelines, FastAPI, SQLAlchemy, dbfread, automation. stdlib-first style; idempotent and resumable jobs
Applied in: AI-augmented IT operations platform · Infrastructure and business systems modernization · Business-system integrations and data pipelines · Independent Mobile App Business · Dell warranty to Freshservice sync · ScreenConnect remote endpoint ops toolkit · Subreddit Sounds
- Microsoft Graph API
Identity, M365, transitive group membership, extension attributes
Applied in: AI-augmented IT operations platform · Microsoft 365 identity, standards, and automation · Business-system integrations and data pipelines · IT standardization and acquisition integration · Entra stale-guest lifecycle automation
- Power Automate
User lifecycle, approval routing, SMS, vendor data ingest, on-premises data gateway bridges to on-prem PowerShell
Applied in: Employee lifecycle and service catalog automation · Business-system integrations and data pipelines
- On-premises data gateway
Bridges cloud Power Automate to on-prem file shares and PowerShell jobs
- Azure Logic Apps
- Git + GitHub (PRs, issues, Actions)
PR-per-feature workflow, GitHub Issues as the work queue, branch-based development; repo/org administration across the company GitHub org
Applied in: Enterprise browser extension for a vendor portal · Matt's Volleyball League · Entra stale-guest lifecycle automation · Dell warranty to Freshservice sync
- GitHub Actions + Azure Pipelines
Scheduled multi-workflow data feed plus auto-deploy on push to main on the internal AI-ops platform; scheduled workflows running the volleyball league's GroupMe communications hands-off; multi-stage CI/CD, matrix builds, secrets management
Applied in: Enterprise browser extension for a vendor portal · Matt's Volleyball League · Entra stale-guest lifecycle automation · Dell warranty to Freshservice sync
- Webhook-driven automation
Applied in: AI-augmented IT operations platform
- Azure Functions
Unattended autonomous-agent host: webhook to queue to agent, auto-deployed from main
Applied in: AI-augmented IT operations platform
- Claude skill plugin authorship
Custom skill ecosystem for the IT team
Applied in: AI-augmented IT operations platform · Enterprise AI rollout, policy, and governance · ScreenConnect remote endpoint ops toolkit
- Claude API in production
Live conversational triage agent: whole-ticket reasoning, subject-person resolution, vision-based screenshot reading, prompt caching, confirm-gated actions, deterministic fallback
Applied in: AI-augmented IT operations platform · Enterprise AI rollout, policy, and governance
- LLM reasoning + model routing
Haiku→Sonnet→Opus escalate-on-low-confidence cascade with surfaced confidence bands; judgment-led routing with guardrails kept at the write layer
Applied in: AI-augmented IT operations platform
- MCP server authorship (FastMCP)
Deployed FastMCP server on Azure Container Apps exposing Freshservice, ScreenConnect, Meraki, Dell warranty, and Microsoft Graph as one namespaced connector; write tools gated at the identity layer via an Entra OAuth connector and delegated Graph on-behalf-of scoping
Applied in: AI-augmented IT operations platform · Enterprise AI rollout, policy, and governance
Observability and systems platforms
Monitoring built from vendor tools, custom collectors, time-series data, and dashboards, alongside storage and backup systems.
- PRTG Network Monitor
Primary infrastructure monitor across Meraki / Ubiquiti / Aruba / Synology / Hyper-V / Windows / SQL / LOB
Applied in: Three-layer observability stack · Windows estate security and detection · Home lab and home automation
- InfluxDB time-series
Local TSDB backend on a prior employer's observability stack
Applied in: Three-layer observability stack
- Grafana
Dashboards over InfluxDB for server, hypervisor, network, and storage telemetry
Applied in: Three-layer observability stack
- Custom SNMP collectors (bash)
Authored synology.sh polling the Synology NAS via SNMP into InfluxDB
Applied in: Three-layer observability stack
- Telegraf-style Windows agent (Influx Capacitor)
Per-role XML profiles (Hyper-V health, network, SQL, DCs)
Applied in: Three-layer observability stack
- Veeam Backup & Replication
Servers, endpoints, Hyper-V VMs at both employers; primary backup engine
Applied in: Home lab and home automation
- Synology NAS (DSM)
On-prem file platform (prior employer) and Veeam backup target (both employers)
Applied in: Three-layer observability stack · Home lab and home automation
- Backblaze B2 (S3-compatible)
Off-site backup tier in the Veeam → Synology → Backblaze 3-2-1 pattern
Applied in: Home lab and home automation
- Azure Monitor / Log Analytics / Application Insights
- Home Assistant automation at scale
Whole-house scale across Zigbee, Z-Wave, and MQTT on a self-run home lab
Applied in: Home lab and home automation
Web and app development
Where the side businesses live. Web applications on Astro and Next.js, and cross-platform mobile development with Flutter and Dart.
- Astro
afterhoursds.com, mattsvolleyball.com, acquired-company marketing sites
Applied in: Matt's Volleyball League
- Next.js + TypeScript
Volleyball Engine on Cloudflare Workers via OpenNext
Applied in: Volleyball Engine
- React
Applied in: Volleyball Engine
- Tailwind CSS
- Cloudflare Pages / Functions / Workers / R2
Acquired-company sites + Volleyball Engine + internal Worker projects; Pages Functions API endpoints with edge caching on mattsvolleyball.com
Applied in: Enterprise browser extension for a vendor portal · Business-system integrations and data pipelines · IT standardization and acquisition integration · Volleyball Engine · Matt's Volleyball League
- FastAPI + SQLAlchemy
Subreddit Sounds (public), legacy FoxPro DBF exploration, internal AI-augmented IT ops platform
Applied in: Subreddit Sounds
- Docker
Single-container app packaging: Subreddit Sounds (public), self-hosted FastAPI services; runs on any Docker host
Applied in: Subreddit Sounds
- Self-hosted deployment
Containerized apps on personal Linux infrastructure: reverse proxy, TLS, scheduled/unattended jobs, browser-based first-run config with no secrets on disk
Applied in: Subreddit Sounds
- Supabase Postgres + RLS
Schema design, migrations, RLS policies, audit columns, multi-source data lake patterns
Applied in: AI-augmented IT operations platform · Volleyball Engine · Independent Mobile App Business
- WordPress (Porto theme)
Brand-distinct sites for three HVAC companies under one ownership umbrella
- Flutter / Dart
Current AfterHoursDS stack (cross-platform mobile)
Applied in: Independent Mobile App Business
Data and analytics
Database, warehouse, and BI work that ties IT and business reporting together.
- SQL Server / T-SQL
- Snowflake (with Python runtime)
Snowflake-native Python stored procedures with EXTERNAL ACCESS INTEGRATION, Snowflake Tasks scheduling
Applied in: Business-system integrations and data pipelines · Microsoft Fabric F64 migration and Snowflake review
- Microsoft Fabric F64
Capacity, semantic models, RLS, external sharing, Copilot in Fabric
Applied in: Microsoft Fabric F64 migration and Snowflake review · Freshservice service operations, reporting, and runbooks
- Power BI
DAX, capacity, semantic models, RLS
Applied in: Microsoft Fabric F64 migration and Snowflake review · Freshservice service operations, reporting, and runbooks
- SQLite
Embedded store for single-process apps; read-only immutable consumer access. Knowing where it stops: file-sync and unattended multi-reader workloads belong on a server database
Applied in: Subreddit Sounds
- Data formats (JSON / XML / CSV / DBF)
Security and identity
Identity-first, platform-controls-first. Defender stack plus the discipline that comes from testing a posture from the outside rather than assuming it holds.
- Conditional Access + MFA + PIM
- Defender XDR suite
Defender for Endpoint, Identity, Cloud Apps, Office 365
Applied in: Identity, endpoint, and email security · Windows estate security and detection
- Bitdefender GravityZone (AV/EDR)
Endpoint AV/EDR reads in the IT ops platform; confirm-gated scan/isolate
Applied in: Identity, endpoint, and email security · IT standardization and acquisition integration
- Action1 patch management
Patch-state reads in the IT ops platform; confirm-gated deploy/reboot
Applied in: Identity, endpoint, and email security
- CISA ScubaGear M365 baseline
Applied in: Identity, endpoint, and email security
- Microsoft Purview
Information Protection, sensitivity labeling, retention, eDiscovery
Applied in: Enterprise AI rollout, policy, and governance
- Unified Audit Log forensics
- Authorized web-app pentesting
External assessments under written authorization. nmap, subfinder, SecLists.
- PhishMe (Cofense) security awareness
Topical training on BEC, ransomware, malicious macros
- Physical security platforms
AxTraxNG (Rosslare) door access at a prior employer; SEMAC Web at the most recent employer; Ubiquiti UniFi Video and Reolink NVR; self-pulled Cat6 runs
Applied in: Home lab and home automation
- Bitwarden secrets administration
- Group Policy baselines
Cross-cutting operations
The non-code parts that make the code parts work in real organizations.
- Cross-tenant M&A migration toolkit
PowerShell migration runners + an operating playbook generated from a docx codebase
Applied in: Multi-region phone system consolidation on Teams Phone · IT standardization and acquisition integration
- Enterprise technology standardization
Career-long discipline: one supported stack per layer across three offices and brands, then the same method scaled across more than a dozen businesses. Target-state design, platform selection, documentation, phased migration, change leadership, and automation against standards.
- Documentation pipelines
Internal IT documentation library generated from live introspection across Graph, Meraki, ScreenConnect, Freshservice, and Snowflake via an MCP server, then exposed back through that server as a read-only skill the ticket agent grounds its answers in; automated PowerShell-to-markdown into SharePoint
Applied in: AI-augmented IT operations platform · Microsoft 365 identity, standards, and automation · Microsoft Fabric F64 migration and Snowflake review · IT standardization and acquisition integration · Freshservice service operations, reporting, and runbooks
- Naming-standards design
Interlocking standards anchored on Entra ID Department: account, computer, and server naming; AD, Entra ID, M365 group, and shared-mailbox taxonomy; region codes; and IP address assignment. Drives dynamic groups, licensing, Conditional Access scoping, and Intune targeting.
Applied in: AI-augmented IT operations platform · Microsoft 365 identity, standards, and automation · Employee lifecycle and service catalog automation
- IT policy and governance authorship
Company-wide AI policy (with HR and Business Intelligence), AI-assisted development policy, IT code of conduct, plus the developer handbook and repo template that operationalize them
Applied in: Microsoft 365 identity, standards, and automation · IT standardization and acquisition integration · Enterprise AI rollout, policy, and governance
- Operational runbooks and procedures
User lifecycle, deployment, patching, backup and recovery, purchasing, and escalation procedures written for repeatable execution across the whole support team
Applied in: IT standardization and acquisition integration · Freshservice service operations, reporting, and runbooks
- Technical evaluation of vendors and platforms
Where the alternative is rolling our own; when the answer is build, this informs that too
Applied in: Multi-site network and WAN standardization · Multi-region phone system consolidation on Teams Phone · IT standardization and acquisition integration · Freshservice service operations, reporting, and runbooks
Team leadership and IT management
A small team run properly, not a large one. Three people including me, covering 850 users across 51 offices. Plus what comes with the title: budget, vendors, the roadmap, and the board conversation.
- Leading a small IT team
Three people including me, roughly one support engineer per 283 users against a 1:50 to 1:100 industry benchmark. Small on purpose: standards and automation do the scaling headcount otherwise would.
Applied in: IT standardization and acquisition integration · Freshservice service operations, reporting, and runbooks
- Mentoring and knowledge transfer
Grew an inherited technician into independent project ownership, including site telephony migrations, operational guides, and shared knowledge-base authorship under common editorial standards
Applied in: Freshservice service operations, reporting, and runbooks
- Hiring and staffing models
Designed and staffed an offshore helpdesk path after a headcount request was declined: sourcing, screening, and the SOPs and handoff procedures the role works against, so it ran off documented playbooks rather than tribal knowledge
Applied in: Freshservice service operations, reporting, and runbooks
- Cross-functional program leadership
Programs spanning teams that don't report to me: the company-wide AI program with HR and Business Intelligence, support centralization across five teams, and IT integration for five acquisitions
Applied in: IT standardization and acquisition integration · Freshservice service operations, reporting, and runbooks · Enterprise AI rollout, policy, and governance
- IT strategy and roadmap ownership
Annual State of IT assessment feeding nine dependency-sequenced initiative documents, including staffing and organizational design re-costed against user growth. Reconciliation names what didn't move, not only what did.
Applied in: IT standardization and acquisition integration
- IT budget and cost allocation
Budget ownership for an 80+ location estate, cost allocated and defended across regional P&Ls, and contract lifecycle work: term-end sequencing to avoid early-termination fees, notice windows, invoice reconciliation
Applied in: Multi-site network and WAN standardization
- Executive and board communication
Modernization plan presented to senior leadership; a licensing proposal drafted with per-user cost analysis and taken to board approval
Applied in: IT standardization and acquisition integration
Other systems experience
Differentiators that round out the resume.
- Legacy Unix (SCO OpenServer)
Self-taught SCO OpenServer admin to keep a prior employer's legacy service-management environment running; decommissioned after the 2014 platform cutover
Applied in: Infrastructure and business systems modernization
- Linux server administration
Debian (3CX evaluation), Ubuntu, CentOS
Applied in: Three-layer observability stack · Subreddit Sounds
- Visual FoxPro / DBF data extraction
Python + dbfread, ad-hoc; exploratory not production
Applied in: Infrastructure and business systems modernization
- PKI / SSL/TLS lifecycle
CSR generation, cert lifecycle, private-key handling, DNS / domain ownership across internal and public-facing infrastructure
Applied in: Multi-site Remote Desktop Services platform
Mechanical / HVAC trade credentials
From a decade in the trade before IT. Maintained current because the discipline that earned them is the same discipline I bring to systems work.
- NC H-3-I Mechanical Contractors License
Held current. Acted as the mechanical-contractor qualifier for a BPI Gold Star HVAC division.
- NATE Service Technician (multi-specialty)
Heat Pump, Gas, Oil, Air Distribution
- EPA Section 608 Universal
All three certification types (I, II, III)
- BPI Building Analyst + Envelope Professional
Building performance, blower door, duct blaster, thermal imaging
- ACCA Manual J / D / S / N / Q
Residential and commercial load, duct, sizing, and design calcs
- Wrightsoft + AutoCAD mechanical layout
- Cross-trade fluency
Gas piping, low and high voltage electrical, sheet metal duct fab