Azure cloud and DevOps
Infrastructure as code, pipelines that deploy several times a day, a security baseline that is deny-by-default, and a bill that stays predictable. This is how we build a cloud estate, and how we run our own.
The DevOps work itself
- Pipelines. Build, test, security scan and deploy in GitHub Actions, with federated credentials instead of stored secrets and every action pinned by hash.
- Infrastructure as code. Terraform for everything, reviewed as a plan before it is applied, with scheduled drift detection that reports what someone changed by hand.
- Database delivery. Schema changes as versioned migrations that run in the pipeline, so a deploy that ships code without its schema cannot happen.
- Monitoring and alerting. Logs, metrics and traces in one workspace, with alerts that reach a person only when a developer could act on them.
- Cost control. Right-sized tiers, consumption pricing where the load is spiky, and a monthly bill someone actually reads.
What we build with
Every resource is declared in Terraform and deployed from GitHub Actions with federated credentials. Nothing is clicked together in a portal, on our estates or on yours.
Compute
Azure Functions on the .NET 10 isolated worker for the API and 40 scheduled jobs; Container Apps Jobs run database deployments and EF Core migrations.
Data
Azure SQL with row-level security and Always Encrypted columns under customer-managed keys in Key Vault; Blob Storage for documents and signed PDFs.
Front ends
Two Static Web Apps, the portal and this site, both served with a strict Content Security Policy and prerendered where crawlers need HTML.
Identity
Entra ID for people and groups, user-assigned managed identities for every workload, OIDC from GitHub Actions. No long-lived credentials in the pipeline.
Observability
Application Insights and Log Analytics with alert rules that reach the team as Teams messages. Only signals a developer can act on become alerts.
Governance
Resource-group policies, management locks, purge protection and diagnostic settings, all declared in Terraform with the reason next to each rule.
Cost discipline
Our engineering principles rank priorities in a fixed order: cost first, then security, then modernity, then performance. A cost ceiling is set before the architecture is drawn, and every design decision is checked against it. In practice that means consumption pricing instead of always-on servers where the load is spiky, a right-sized database tier rather than the one the vendor recommends, and alerting built from services already in the subscription instead of a paid on-call product.
Security baseline
- Firewalls deny by default; SQL is reachable only from the Functions subnet.
- Secrets exist only in Key Vault and are read through managed identities.
- Personal and financial columns are Always Encrypted, so even a database administrator cannot read them.
- Actions and container images are pinned by hash; dependency updates arrive as reviewed pull requests and a security advisory is an unconditional upgrade.
- CodeQL runs on every push, Terraform plans are validated before apply, and drift is detected on a schedule.
Our cloud record
More than 20 CI/CD pipelines built, two-week releases turned into daily deploys, release time cut from four hours to 25 minutes, Azure spend reduced by 30 percent on one platform. Figures from our delivery history.
Hiring for it, not improvising
DevOps is a role we recruit for deliberately: our vacancy history includes a DevOps engineer and a dedicated DevOps technical interviewer, so candidates are assessed by someone who does the work rather than by a generalist reading a checklist.
Want your Azure estate in code, with a smaller bill?
Send read access to your subscription or a description of what runs where. You get a written assessment and a plan within one business day.