Anonymised engagements — what the problem was, how I approached it, and the result. Client details are redacted; figures in brackets are placeholders.
Ageing MPLS WAN was expensive and slow to change; site provisioning took weeks and failover was unreliable.
Designed and rolled out an SD-WAN overlay with centralised policy, dual-transport per site and automated zero-touch provisioning, migrating sites with no production downtime.
Site turn-up cut from [weeks] to [days]; WAN failover to sub-second; circuit costs reduced by [~X%].
Flat network and VPN-based remote access left a large lateral attack surface and a poor experience for hybrid staff.
Introduced identity-based segmentation and a SASE edge, replacing legacy VPN with zero-trust access and inspecting traffic close to the user.
Lateral attack surface materially reduced; remote access latency down [~X%]; passed [audit/standard] with no network findings.
Core platform was at end-of-life and couldn't scale to new wholesale and business customers.
Designed a new MPLS/EVPN core with clear service separation and a staged, low-risk migration plan from the legacy platform.
Capacity headroom for [X]× growth; new service turn-up standardised; zero customer-impacting incidents during migration.
There's more I can't show publicly — sanitised designs live in a private vault, available to recruiters and clients on request.