Matthew Pollock

~$ head -4 about.md

About me

I’m a UK-based Azure Cloud & Security Architect. I design and run enterprise Microsoft environments – identity, email, endpoint, and the Azure platform – with security as the backbone of all of it. The current chapter is governed AI operations: AI agents execute the majority of my routine work under controls I designed – a least-privilege identity of their own, read-only by default, and nothing privileged without my sign-off. I’ve also architected and shipped two production AI platforms, now in daily business use.

~$ git log --oneline career/

Key experience

Cloud & IT Infrastructure Lead — AX Ltd

Dec 2024 – present

The estate: Own architecture and security posture across identity (Microsoft Entra ID, hybrid AD), the email estate (Exchange Online, Mimecast), endpoint (Microsoft Intune) and the Azure platform for a 500+ employee business.
Security operations: Microsoft Defender and Microsoft Sentinel as the daily workbench – audit, remediate, validate – with KQL for detection and investigation.
AI operations: The majority of routine operational work executes through governed AI agents (Claude Code, Codex, Ollama, Opencode) – dedicated least-privilege identity, just-in-time elevation, read-only default posture, plan-before-execute approval on anything privileged, full audit trail.
AI platforms: Architected and delivered two production AI applications on Azure – customer interaction analytics and operational decision support – from solution design through IaC, CI/CD, security, and daily operations.
Zero physical servers: Decommissioned the estate’s final on-premises domain controllers and physical hosts across all sites – a first in the organisation’s history, ending the hardware refresh cycle for good.
Delivery: Infrastructure change lands as code through Azure DevOps – Bicep and PowerShell, reviewed and repeatable.

IT Infrastructure Manager — AX Ltd

Jan 2017 – Dec 2024

Directed a full-scale cloud migration to Microsoft Azure, decommissioning primary and secondary data centres and moving the company from hardware refresh cycles to a consumption-based model.
Managed and mentored a team of five infrastructure engineers, delivering key projects including SD-WAN deployment, network modernization, virtualization platform refreshes, and datacentre relocations.
Designed and implemented infrastructure for new remote depot sites, reducing deployment times while ensuring seamless integration with existing systems.
Optimized vendor relationships and licensing agreements while maintaining compliance and service quality.

Senior IT Infrastructure Engineer — AX Ltd

Nov 2011 – Jan 2017

Designed and executed multiple Microsoft Exchange migrations and domain controller refreshes, achieving improved performance, reliability, and a reduction in hardware requirements.
Ran the email estate end to end – Exchange, Mimecast, mail hygiene and security, archiving and compliance.
Strengthened Active Directory and Group Policy standards, and improved monitoring and automation to reduce incident resolution times.

~$ cat skills.conf

Skills & competencies

Microsoft Azure: Design, migration, and day-to-day running of the platform – Entra ID, Intune, PIM, Microsoft Sentinel, Azure Monitor, Azure Automation, Azure Backup, Azure Site Recovery, Key Vault, Azure Policy, Azure Arc, and Bastion.
AI operations: Agentic AI (Claude Code, Codex, Ollama, Opencode) running production IT operations under a least-privilege governance model – spec-driven delivery, human sign-off on anything privileged, full audit trail.
AI platforms: Two production Azure AI applications in daily business use – architecture, IaC, CI/CD, security, and operations, owned end to end.
Identity & access management: Microsoft Entra ID (Azure AD), Conditional Access, MFA, SSPR, PIM, hybrid AD, and Group Policy.
Microsoft security suite: Defender for Endpoint, Defender for Identity, Defender for Cloud, and Microsoft Sentinel with KQL.
Governance & data protection: Microsoft Purview, Azure Policy, Azure Backup, and Azure Site Recovery.
Email estate: Exchange 2010 through Exchange Online – on-premises, hybrid, and everything in between – plus Mimecast administration.
Collaboration platforms: Microsoft 365 administration – Exchange Online, Teams, and SharePoint Online.
Windows Server: 2003 through 2022, from installation to decommissioning.
Cloud networking: DNS, firewalls, VPNs, Azure WAF, load balancing, Cato SD-WAN/SASE, and network peering across hybrid environments.
Infrastructure as code: Bicep, Terraform, ARM templates, and CloudFormation.
Scripting & automation: PowerShell, Azure CLI, and Python.
DevOps practices: Azure DevOps CI/CD pipelines, GitHub Actions, and working knowledge of Docker, Kubernetes, and AKS.
AWS: IAM, EC2, S3, Route53, VPCs, and CloudFormation.
Leadership: Mentoring engineers, vendor and budget ownership, and aligning IT strategy with business goals.
Documentation & training: Runbooks, technical documentation, and training sessions for technical teams and end-users.

~$ ls certifications/ --sort=level

Certifications

AZ-305 · expert

Microsoft Certified: Azure Solutions Architect Expert

AZ-400 · expert

Microsoft Certified: DevOps Engineer Expert

AZ-500 · associate

Microsoft Certified: Azure Security Engineer Associate

AZ-104 · associate

Microsoft Certified: Azure Administrator Associate

SAA-C02 · associate

AWS Certified Solutions Architect – Associate

AZ-900 / CLF-C01

Azure Fundamentals · AWS Cloud Practitioner

legacy · 2001–2019

MCP, MCSA, MCSE, MCTS, MCITP – Windows Server 2003/2008/2012, Exchange 2010/2013

17 Microsoft certifications in total – the full transcript lives on Microsoft Learn.