Cloud, DevOps & Security
Infrastructure that stays up, ships often and can be handed over.
The layer under the application: cloud migration and architecture, infrastructure as code, CI/CD, container platforms, cost control, observability, backup and recovery, and a security and access review that tells you what is actually exposed.
What you end up with
- Infrastructure described in code, kept in your repository and reviewable like any other change
- A migration or release path with a tested rollback rather than a hope
- A ranked list of what is exposed, what it reaches and what fixing it costs
- Monitoring that tells a named person before a customer notices
Tools and platforms
- AWS
- Azure
- Google Cloud
- Terraform
- OpenTofu
- Kubernetes
- Docker
- GitHub Actions
- GitLab CI
- Cloudflare
- Grafana
- Prometheus
- OpenTelemetry
- PostgreSQL
- Redis
- S3
Services
9 services in Cloud, DevOps & Security
Each one has its own page covering what the work involves, what you receive and the trade-offs.
Cloud Migration
Move to the cloud without carrying the old problems with you.
Cloud Architecture & Design
Decisions that are cheap now and expensive to reverse later.
Cloud Cost Optimisation
Most cloud bills contain spend that nobody decided to make.
CI/CD & Release Engineering
Deploys that are boring, which is exactly the point.
Kubernetes & Container Platforms
Containers are quick to adopt and slow to master.
Infrastructure as Code
Your infrastructure, written down, reviewable and reproducible.
Cloud Security & Access Review
Understand what is exposed before somebody else maps it for you.
Observability, Monitoring & Alerting
You cannot fix what nobody can see.
Backup & Disaster Recovery
A backup nobody has restored is a hope, not a plan.
How we think about it
Why cloud, devops & security projects fail
The technical detail that decides whether this work pays back, written for someone who has to sign off on it.
Infrastructure is a product, and it needs an owner
Most estates are assembled rather than designed. A server added during a launch week, a bucket opened for a file transfer in 2022, a database that was provisioned large because nobody wanted to be the reason the site was slow. Each decision was reasonable when it was made, and none of them has an owner now, which is why the bill grows and the diagram in the wiki is three years out of date. The first thing we produce is the real inventory, including the parts nobody remembers deploying.
Change is the thing being managed, not the servers
Reliability comes from being able to change something small and predictable, not from a server that has been running untouched for years. That means infrastructure described in code, reviewed before it is applied, deployed through a pipeline rather than from a laptop, and reversible. Teams that can deploy on a Tuesday afternoon without a meeting are the teams that recover fastest when something goes wrong, because recovery is the same motion as release.
Security is configuration and access, before it is tooling
The incidents that hurt small and mid-sized companies are rarely exotic. They are a long-lived access key in a public repository, a storage bucket with a guessable name, an administrator account with no second factor, a former contractor whose access was never removed. None of that needs a sophisticated attacker. We review identity, exposure, secrets and audit trails in that order, because that is the order in which problems are actually found.
You should be able to run this without us
Cloud work is easy to make deliberately obscure. At the end of an engagement your team should be able to deploy, restore, rotate a credential and read the dashboards without calling anyone. We write runbooks for the tasks that happen at 2am when nobody wants to be reading documentation for the first time, and we rehearse the restore rather than describing it.
Questions
Before you book a call
Do we need all of this, or is it only for large companies?
Most of it scales down to a single application, and the parts that do not, we will say so. A two-person product team does not need a service mesh or a platform group, but it does need infrastructure in code, automated deploys, backups that have been restored at least once, and someone's phone that rings when the checkout stops working. That is a small amount of work with a large return.
Can you work with our existing cloud account and team?
Yes, and that is usually the right shape. We work inside your account with the least access the job needs, we review rather than gatekeep, and we write for the engineers who will own it afterwards. Where your team already has strong opinions about tooling, we will use what they can maintain rather than what we would have chosen in isolation.
We are on a single server and it works fine. Should we move?
Not necessarily, and we will not pretend otherwise. A single well-configured server with good backups is a perfectly respectable answer for a business of a certain size, and moving to a distributed platform adds failure modes that have to be understood to be useful. The trigger for moving is usually a specific pain: deployments that require downtime, a release that cannot be rolled back, or a recovery objective you cannot currently meet.
Tell us where the manual work is
A 30-minute call. We map the process, tell you what we would automate or build first, and what it costs. No retainer before you agree the scope.
- No retainer before scope is agreed
- Written plan you can act on alone
- Worldwide delivery, on your hours