Enterprise security and scaling
No stored keys, least privilege everywhere, backups you have actually restored.
For teams that need to pass an audit, win an enterprise customer or simply sleep at night. I replace stored secrets with identities, enforce guardrails as code, isolate tenants and data, and prove that backups and restores work, on platforms that keep scaling as you grow. I have done this in banking, automotive, the public sector and SaaS.
Sounds familiar?
- Cloud keys and passwords live in CI variables, config files or someone's laptop
- Everyone is owner on the subscription because fine-grained roles were never set up
- Backups exist, but nobody has ever restored one
- An enterprise customer or auditor asks for evidence you cannot produce quickly
How I work on it
- 1
Identities instead of secrets
Pipelines reach the cloud through OIDC, workloads use managed identities, and what must remain a secret lives in Key Vault and reaches Kubernetes through External Secrets. No long-lived keys in repositories or CI.
- 2
Least privilege, enforced as code
Entra ID groups, RBAC and Azure Policy are defined in Terraform or Bicep, so every team gets the same baseline and drift shows up in a pull request instead of an incident.
- 3
Isolate tenants and data
Row-level security in the database, strict Dev, Test and Prod separation, and tenant isolation on shared platforms, so one customer can never see another customer's data.
- 4
Backups you have restored
Encrypted backups several times a day to separate storage, and a nightly restore test into a twin environment, so recovery is a routine, not a hope.
- 5
Scale without surprises
Autoscaling, outside-in checks every 10 minutes and alerts on what customers actually feel. Signed, staged releases with smoke tests after every deploy keep changes fast and safe.
What you get
- A security review of identities, secrets, network and data, ranked by risk
- OIDC and managed identities in place of stored keys
- RBAC, Azure Policy and security baselines in Terraform or Bicep
- Encrypted backups with an automated restore test and alerts
- Evidence for auditors and enterprise customers, generated from the code
Real projects
- UK retail bank, 2023–2024Release engineering for banking apps used by millions~40%
- Automotive manufacturer, 2022–2023A regulated workload moves to Azure, fully in Terraform~25%
- Public sector, healthcare, 2019–2022Sensitive health records between two public systems, none lost0
- Consultancy, information security, 2019–2022ISO 27001 certification tool with native apps3
- Pattern on SaaS, broadcast and retail platforms, 2026Monitoring on business outcomes, backups proven nightly10 min
Questions buyers ask
Where do you start?
With a short review of identities, secrets, network and data, ranked by risk. The first fixes are usually stored keys and over-broad roles, because they close the biggest gaps with the least effort.
Does this help with ISO 27001 or similar audits?
Yes. Controls defined as code produce their own evidence, and I have built a tool that keeps ISO 27001 controls and evidence in one place. I am not an auditor, but I make the technical part easy to prove.
Will security slow our releases down?
Not when it is built into the pipeline. For banking apps used by millions, release cycles became about 40% faster, in one of the most regulated industries there is.
Do you work on Azure only?
No. The same principles apply on AWS, Google Cloud, Kubernetes and your own data center: identities instead of keys, least privilege as code, isolated data and tested restores.
How do you price it?
After a 30-minute call: a fixed scope for the review and the first fixes, or a few days per month as your platform security lead.
Read more
- From AI prototype to production: the eight layers I add, in order
- Air-gapped systems: running critical software with no internet
- Private AI for sensitive data: a local LLM setup that passes the security review
- MCP security in depth: how to let AI assistants into your product without opening the doors
- A landing zone for mid-sized companies, in Terraform or Bicep: the parts that matter
- Restore tests: a backup you have never restored is only a hope
- Monitoring on business outcomes: green dashboards, empty checkout
- The EU AI Act for mid-sized companies: what applies to you, and when
Get in touch
Tell me what you're building. I'll reply within 1–2 business days.
- Company
- MADO Consulting
- Follow me on LinkedIn
Available worldwide, remote. On-site on request, depending on the country.
Opens Calendly's booking calendar here. Loading it sends data to Calendly (see Impressum).