01
The challenge
The platform consisted of multiple enterprise digital properties built around Sitecore, .NET and Optimizely, with integrations across cloud infrastructure and external services. It required reliable application delivery, strong security controls and consistent infrastructure across development, UAT and production. As the platform evolved, infrastructure and deployment processes had to become more standardised, observable and resilient while supporting frequent application releases.
02
Solution architecture
Request path in teal; dashed lines are private connectivity, deployment and telemetry. Scroll sideways on small screens.
Layers top to bottom. Controls apply at every layer.
Read the full write-up: Sitecore on Azure PaaS: a production reference architecture with Next.js, Cloudflare and private networking
03
Approach
- 01Cloud architecture: designed and optimised the Azure infrastructure for production digital workloads, including networking, compute, load balancing and supporting services.
- 02Application platform: supported enterprise Sitecore and .NET applications across hosting, configuration, deployment and production troubleshooting.
- 03Digital experience: worked with Optimizely and enterprise CMS components behind content-driven experiences and experimentation, with a Next.js front end and middleware for routing, locale and personalisation.
- 04Security and edge: implemented Cloudflare, WAF, TLS, access controls and network-level security for the public-facing applications; private endpoints and VPN connectivity for everything behind them.
- 05Infrastructure as code: standardised provisioning and environment configuration with Terraform and repeatable deployment patterns.
- 06CI/CD: built and improved automated pipelines in Azure DevOps for build, test and deployment across environments.
- 07Operations: improved monitoring, logging, alerting and incident response while supporting production releases.
04
How the delivery ran
- Architecture and security baseline agreed first: network segmentation, edge controls, identity and secrets handling, environment strategy.
- Infrastructure brought under Terraform environment by environment, starting with non-production, so drift was removed before production changed.
- Pipelines rebuilt per application with approvals for UAT and production; releases moved from manual steps to repeatable, reviewed deployments.
- Observability and runbooks added alongside, so each release could be verified and each incident handled from the same dashboards.
- Delivered with a team under Cloudlit's brand and contract, with 24×7 operations.
05
What was delivered
- Enterprise Sitecore and .NET application infrastructure
- Optimizely-based digital experience infrastructure
- Azure production, UAT and development environments
- Cloudflare and WAF security configuration
- Load balancing and secure application ingress
- Terraform-based infrastructure provisioning
- CI/CD pipelines for application delivery
- Application and infrastructure monitoring
- Production incident troubleshooting and runbooks
- Performance and infrastructure optimisation
- Secure and repeatable release processes
06
Results
| Dimension | Outcome |
|---|---|
| Application delivery | More consistent and repeatable releases |
| Infrastructure | Standardised cloud environments and configuration |
| Security | Stronger edge, network and application security controls |
| Operations | Improved monitoring and production visibility |
| Reliability | More controlled production deployments and incident response |
| Scalability | Infrastructure designed to support high-traffic digital experiences |
| Ownership | End-to-end responsibility across cloud, DevOps and application delivery |
Client confidentiality: Client names, URLs and certain implementation details have been intentionally omitted due to contractual confidentiality requirements. The architecture, responsibilities and delivery scope have been generalised while accurately representing the nature of the engagement.
Facing a similar decision? A 30-minute architecture review is the fastest way to find out whether the same approach fits.
Book an architecture reviewMore case studies
Other engagements
Food & Wellness · E-commerce · Azure
The Azure platform behind a high-volume digital meal-plan experience, run as code.
PractiCal sells personalised meal plans across the UAE through a Next.js storefront, Laravel/PHP backend services and Azure serverless workloads. I owned the cloud and application platform end to end: infrastructure, edge security, CI/CD and production operations across development, staging and production.
Education · Enterprise · Azure
A secure Azure platform for a large-scale university digital experience on .NET and Umbraco.
A university digital platform serving prospective students, current students, faculty and other stakeholders: programme discovery, admissions, applications and student services on an ASP.NET and Umbraco CMS stack. I owned Azure infrastructure, application delivery, security and production operations.
B2B SaaS · AWS
Kubernetes platform that cut cloud spend by 60% and deploy time from 45 minutes to 5.
A growing SaaS platform was running on hand-built AWS infrastructure with manual deployments and costs rising 40% month on month. I replaced it with a production-grade EKS platform, GitOps delivery and infrastructure as code, migrated with zero downtime.
FinTech · AWS
Zero-trust AWS controls that took a FinTech to SOC 2 Type II in 8 weeks with no audit findings.
Enterprise deals depended on SOC 2 Type II, and the existing estate had shared secrets in code, permissive IAM and no audit trail. I designed and implemented the identity, network, secrets and audit controls, and the external audit closed with zero findings.
B2B Software · Kubernetes
Observability and SLOs that cut detection time from 90 minutes to 5 and freed a fifth of engineering time.
A six-person team ran production with no visibility: incidents took hours to detect and 40% of engineering time went to firefighting. I built the observability stack, defined SLOs and burn-rate alerting, and wrote the runbooks. Detection fell to 5 minutes and the team got 20% of its time back.