Cloud Infrastructure Engineer
George Denton
// hybrid cloud · IaC · automation
about
Hybrid Azure and on-prem infrastructure for a regulated payments platform. Work covers IaC with Bicep, PowerShell automation, identity and access, and monitoring.
Background in electrical installation and IT support before moving into infrastructure. First proper infrastructure project was a self-hosted media stack. Home lab of Docker-based self-hosted services, deployed from a version-controlled compose definition.
experience
A UK payments processor
2022 — Present- Nov 2025 — Present
Cloud Infrastructure Engineer
Hybrid Azure and on-prem infrastructure for a regulated payments platform. Infrastructure as code in Bicep through Azure DevOps, with changes going through formal approval. Monitoring and alerting across the Azure estate, identity and access hardening in Entra ID, and Windows Server environments built and deployed through pipelines. On-call rota for critical services.
- Apr 2024 — Nov 2025
Junior Cloud Infrastructure Engineer
Hands-on infrastructure across Azure and on-prem; PowerShell automation, Azure Monitor and Log Analytics. First engineering role.
- Oct 2023 — Apr 2024
Second Line Support Engineer
Escalation point for endpoint, identity and connectivity issues; vulnerability management and endpoint administration.
- Dec 2022 — Oct 2023
First Line Support Engineer
Front-line support across a Microsoft 365 environment, in person and remote. User access, device management, account provisioning, and Exchange Online, SharePoint and Teams administration.
// earlier
- Delivery Driver Oglesby Butchers 2021 — 2022
- Merchandiser B&Q (MET team) 2018 — 2021
- Electrician AC Electrics Ltd 2015 — 2018
projects
- PRJ-01
media-server-iac
IaC for a self-hosted media stack. Pinned images, CI validation, update PRs.
- PRJ-02
Deskbridge
Windows RDP connection manager, built as a replacement for mRemoteNG. Published on the Microsoft Store.
- PRJ-03
GeorgesTicker
Cross-platform task and habit tracker, built because the tools worth using weren't an option at work.
homelab
The lab behind PRJ-01. Nine services on one Docker host, download traffic isolated in a VPN network namespace, images pinned and updated by PR. Drawn from the compose definition in media-server-iac.
| Ref | Service | Network | Port | Function |
|---|---|---|---|---|
| 01 | Plex | docker bridge · mediastack | :32400 | Media server. Intel iGPU passed through for hardware transcoding; remote access via the single published port. |
| 02 | Jellyseerr | docker bridge · mediastack | :5055 | Request front end. Users request titles here; approved requests are handed to Sonarr or Radarr over their APIs. |
| 03 | Sonarr | docker bridge · mediastack | :8989 | TV automation. Monitors series, searches indexers via Prowlarr and sends grabs to qBittorrent. |
| 04 | Radarr | docker bridge · mediastack | :7878 | Film automation. Same pattern as Sonarr: indexers from Prowlarr, downloads to qBittorrent. |
| 05 | Prowlarr | docker bridge · mediastack | :9696 | Indexer manager. Central place for indexer config, synced out to Sonarr and Radarr so nothing is defined twice. |
| 06 | Byparr | docker bridge · mediastack | :8889 | Cloudflare challenge solver, FlareSolverr replacement. Handles anti-bot checks for indexers Prowlarr cannot reach directly. |
| 07 | qBittorrent | gluetun namespace | :8200 | Download client. Uses network_mode: service:gluetun, so it has no network stack of its own. All traffic goes through the VPN or nowhere. |
| 08 | Gluetun | docker bridge · mediastack | :8888 | VPN client container. Owns the network namespace qBittorrent runs in and kills traffic if the tunnel drops. |
| 09 | Portainer | docker bridge · default | :9000 | Container management UI. Kept on the default bridge so it stays reachable if the stack network is recreated. |
| 10 | Docker engine | docker host | — | Host Docker daemon. Runs every container here; Portainer manages the stack through the mounted UNIX socket rather than over the network. |
| 11 | VPN provider | external | — | WireGuard endpoint. The only egress path for download traffic. |
stack
Cloud
- Azure
- Hyper-V
- Entra ID (Conditional Access, service principals, SSO)
- Defender
IaC & Automation
- Bicep
- PowerShell
- Azure DevOps
- Power Automate
Monitoring & Security
- Azure Monitor
- Log Analytics
- KQL
- PKI
- MFA
Practice
- IaC
- CI/CD
- Observability
- Incident response
- On-call
- AI-assisted development