Shimon Ifrah

Using .NET and Azure OpenAI, I developed and released an application that creates cover letters for job applications. The application is hosted on Azure and deployed using Azure DevOps. The back-end infrastructure was deployed using infrastructure-as-code (Bicep).

OVERVIEW
Brought on as a fractional CTO for an early-stage fintech startup that had a bold idea but no technical leadership. They wanted to build a real-time threat-detection engine that used machine learning to catch fraudulent transactions and anomalous network behaviour before damage was done. My job was to turn that vision into a shipping product.

THE CHALLENGE
The founding team had cobbled together a proof-of-concept using basic rule-based detection, but it was drowning in false positives and couldn't scale. Their Azure environment was a mess—no proper network segmentation, inconsistent logging, and the ML pipeline was a Jupyter notebook running on someone's laptop. They needed someone to architect the whole thing properly and get the engineering team firing on all cylinders.

WHAT I DID
• Designed a cloud-native architecture on Azure using Event Hubs for real-time ingestion, Databricks for feature engineering, and Azure ML for model training and deployment.
• Implemented a layered detection strategy—fast rule-based filters at the edge, ML-based anomaly detection in the middle tier, and a feedback loop so the model continuously improved from analyst decisions.

A mid-market Australian retailer was haemorrhaging money on their call centre — long wait times, inconsistent answers, and customer satisfaction scores heading south. They engaged me to lead the build of a conversational AI platform that could handle the bulk of customer enquiries across chat, email, and eventually voice.

THE CHALLENGE
Their existing setup was a patchwork of Zendesk macros and a basic chatbot that customers hated. Product data lived in three different systems (Shopify, a legacy ERP, and a warehouse management tool), none of which talked to each other properly. The internal dev team was capable but had never built anything with LLMs and needed direction on architecture, prompt engineering, and responsible AI guardrails.

WHAT I DID
• Built a RAG (Retrieval-Augmented Generation) architecture using Azure OpenAI (GPT-4o) with a vector store backed by Azure AI Search, pulling from unified product, order, and policy data.
• Designed a multi-channel orchestration layer using FastAPI that handled context management across chat sessions, email threads, and escalation to human agents.

A regional healthcare provider with 14 clinics was running its entire operation on aging on-premises infrastructure—we’re talking Windows Server 2012 R2, a single point of failure SQL Server instance, and a patient management system that hadn’t been updated in years. I was brought in to move them onto a modern cloud platform without disrupting clinical operations.

THE CHALLENGE
Healthcare is unforgiving when it comes to downtime. Clinicians needed 24/7 access to patient records, and any migration had to be invisible to end users. On top of that, the data sovereignty requirements under the Australian Privacy Act and healthcare-specific regulations meant everything had to stay in Australian Azure regions. The internal team had zero cloud experience, and the board was nervous about costs blowing out.

WHAT I DID
• Ran a thorough discovery phase—inventoried 47 workloads, classified them by migration strategy (rehost, refactor, and replace), and built a phased migration plan that prioritized low-risk workloads first to build confidence.
• Designed a hub-and-spoke Azure landing zone with proper network segmentation, ExpressRoute connectivity back to clinic sites, and Azure Firewall for traffic inspection.

The client had a Microsoft 365 environment that had grown organically over several years. Devices were inconsistently enrolled, endpoint policies were incomplete, identity controls needed review, and internal IT needed a cleaner operating model for day-to-day administration.

SOLUTION
• Reviewed the Microsoft 365 tenant, Intune configuration, device compliance, identity controls, licensing, and operational processes.
• Designed and implemented Intune policies for Windows endpoint management, compliance, app deployment, and baseline security.
• Improved Autopilot readiness and device onboarding processes.
• Reviewed Entra ID conditional access and identity controls.
• Documented the target configuration and provided practical handover guidance for the internal team.

The client needed a practical Essential 8 Maturity Level 2 action plan. The challenge was not just interpreting ACSC guidance, but mapping it to Microsoft 365, Intune, Defender, identity controls, patching, application control, backup practices, and evidence collection.

SOLUTION
• Assessed the current Microsoft 365, endpoint, identity, patching, and security posture against Essential 8 requirements.
• Mapped gaps to Microsoft-native controls where possible.
• Prioritized remediation by risk, business impact, and implementation effort.
• Produced a clear action plan with evidence, expectations, and ownership guidance.
• Aligned recommendations to practical operational capability rather than paperwork-only compliance.