FIG.00 GD

Cloud Infrastructure Engineer

George Denton

// hybrid cloud · IaC · automation

DRAWN G.DENTON REV 2026 LINKEDIN ↗

about

Hybrid Azure and on-prem infrastructure for a regulated payments platform. Work covers IaC with Bicep, PowerShell automation, identity and access, and monitoring.

Background in electrical installation and IT support before moving into infrastructure. First proper infrastructure project was a self-hosted media stack. Home lab of Docker-based self-hosted services, deployed from a version-controlled compose definition.

experience

A UK payments processor

2022 — Present
  1. Nov 2025 — Present

    Cloud Infrastructure Engineer

    Hybrid Azure and on-prem infrastructure for a regulated payments platform. IaC with Bicep through Azure DevOps, alerting, monitoring, incident response, plus an on-call rota for critical services. Windows Server environments built and deployed through Azure DevOps pipelines.

  2. Apr 2024 — Nov 2025

    Junior Cloud Infrastructure Engineer

    Hands-on infrastructure across Azure and on-prem; PowerShell automation, Azure Monitor and Log Analytics. First engineering role.

  3. Oct 2023 — Apr 2024

    Second Line Support Engineer

    Escalation point for endpoint, identity and connectivity issues; vulnerability management and endpoint administration.

  4. Dec 2022 — Oct 2023

    First Line Support Engineer

    Front-line support across a Microsoft environment, in person and remote.

// earlier

  • Delivery Driver Oglesby Butchers 2021 — 2022
  • Merchandiser B&Q (MET team) 2018 — 2021
  • Electrician AC Electrics Ltd 2015 — 2018

projects

homelab

The lab behind PRJ-01. Nine services on one Docker host, download traffic isolated in a VPN network namespace, images pinned and updated by PR. Drawn from the compose definition in media-server-iac.

FIG. 02 — homelab topology · docker media stack
Parts list
Ref Service Network Port Function
01 Plex docker bridge · mediastack :32400 Media server. Intel iGPU passed through for hardware transcoding; remote access via the single published port.
02 Jellyseerr docker bridge · mediastack :5055 Request front end. Users request titles here; approved requests are handed to Sonarr or Radarr over their APIs.
03 Sonarr docker bridge · mediastack :8989 TV automation. Monitors series, searches indexers via Prowlarr and sends grabs to qBittorrent.
04 Radarr docker bridge · mediastack :7878 Film automation. Same pattern as Sonarr: indexers from Prowlarr, downloads to qBittorrent.
05 Prowlarr docker bridge · mediastack :9696 Indexer manager. Central place for indexer config, synced out to Sonarr and Radarr so nothing is defined twice.
06 Byparr docker bridge · mediastack :8889 Cloudflare challenge solver, FlareSolverr replacement. Handles anti-bot checks for indexers Prowlarr cannot reach directly.
07 qBittorrent gluetun namespace :8200 Download client. Uses network_mode: service:gluetun, so it has no network stack of its own. All traffic goes through the VPN or nowhere.
08 Gluetun docker bridge · mediastack :8888 VPN client container. Owns the network namespace qBittorrent runs in and kills traffic if the tunnel drops.
09 Portainer docker bridge · default :9000 Container management UI. Kept on the default bridge so it stays reachable if the stack network is recreated.
10 Docker engine docker host — Host Docker daemon. Runs every container here; Portainer manages the stack through the mounted UNIX socket rather than over the network.
11 VPN provider external — WireGuard endpoint. The only egress path for download traffic.

stack

Cloud

  • Azure
  • Hyper-V
  • Entra ID (Conditional Access, service principals, SSO)
  • Defender

IaC & Automation

  • Bicep
  • PowerShell
  • Azure DevOps
  • Power Automate

Monitoring & Security

  • Azure Monitor
  • Log Analytics
  • KQL
  • PKI
  • MFA

Practice

  • IaC
  • CI/CD
  • Observability
  • Incident response
  • On-call
  • AI-assisted development