Enterprise Architect · Head of Software
I rebuild the systems a business can't afford to switch off.
A decade of legacy doesn't get thrown away. It gets grown around, then replaced — while the business keeps trading.
I own the technical direction of a multi-tenant automotive platform serving dealerships, dealer groups and OEMs — a large SQL Server estate and a .NET landscape I've helped shape for nine years, from content editor to enterprise architect.
Part of that was spent as the team's security analyst, and that lens never left. I'm an ISO 27001 Lead Implementer and stood for the OWASP Global Board — I build like someone who's accountable for what happens when the system gets attacked.
Day to day that means leading a strangler-fig migration onto .NET 8 and a team of six building to the standards I set — while staying deliberately close to the code.
Grounded for a month, locked out of the family PC, no reset disk in sight. The fix was a stack of library books and a lot of stubbornness — and I've been getting into, and securing, systems ever since.
The platform is a decade old, and the whole business runs on it.
Rewrites are where companies go to die. I grow the new system around the old one — a strangler-fig migration onto .NET 8 — and move it across piece by piece, so nothing ever goes dark while the business keeps trading.
A report takes three minutes. It should take four seconds.
Usually the schema and the query plan are already telling you what's wrong — if someone reads them. I've pulled three-minute reports down to four seconds by cutting the scans the optimiser was quietly working around. No new hardware, no rewrite.
One codebase has to serve forty tenants, and each wants to feel bespoke.
Multi-tenancy done well is invisible. I build the platform so a single system serves dozens of dealers, groups and OEMs — shared where it saves you, skinnable where it shows — without forking the code for every client.
The reporting is run by hand, and nobody quite trusts the numbers.
I replace the spreadsheets and hand-run scripts with reporting that runs itself: scheduled, tenant-scoped and auditable, right down to the stored procedures underneath — so the number on the board is the number in the database.
Everyone wants AI in the product. You need it shipped, not demoed.
I build AI that survives contact with production — generated media rolled out across a whole estate, insight layers sitting on real data, agent workflows wired into the tools a team already uses — not a prototype that dies the week after the pitch.
The app works, but it's a security liability.
Rate limiting, login hardening, honeypots, a drop-in firewall layer, POPIA where it applies — the unglamorous work that turns an app you're nervous to leave running into one you can forget about.
You need to prove you're secure, not just be secure.
Being secure and passing the audit are two different jobs. As an ISO 27001 Lead Implementer I put the controls, the evidence and the management system in place to stand up to scrutiny — so compliance stops being a fire drill and becomes something you already have.
The BCL and the framework before custom code — and before a new dependency earns its way in.
The schema is the design. The query plan is the proof. Decimal for money, always.
No abstraction earns its place until there's a second caller. Ceremony is not architecture.
Strangler-fig migrations that replace the old system without ever taking the business offline.
Three-minute reports become four-second reports by reading the plan, not guessing.
Values, review and a hiring bar that let six engineers build like one — and be trusted to.
Cloud and server hosting in partnership with a national infrastructure provider — and a web studio that designs, builds and hosts client platforms end to end, from record-label and dance-studio sites to a Museum of Impossible Things.
A consumer-AI product venture behind Bondis.ai — a companion platform built on ASP.NET Core, with the full POPIA-compliant legal, SEO and brand infrastructure to match.
Let's talk about
the hard part.