I design Azure landing zones for regulated European estates, take platforms off managed-service providers, and put cost and privilege under the same controls as residency.
I am Group Lead for Cloud and Connectivity at Kanadevia Inova, and I run Ne Plus Ultra Global Solutions for the same work with other EU and Swiss clients. About 19 years of the career has been in IT, and about 9 years in cloud architecture.
The design work is hub-and-spoke and virtual WAN, identity and privilege, Terraform and Ansible, and the cost of the estate. The control set is NIST, ISO 27001, CIS, COBIT, NIS2, DORA, and Swiss nDSG.
Disaster recovery is designed and then exercised. I do not quote a recovery-time guarantee.
Certificate, Unix / C++ · 2000
Azure landing zones, hub-and-spoke, virtual WAN, HYOK, and PIM. NIST, ISO 27001, CIS, COBIT, NIS2, DORA, and Swiss nDSG.
IAM, privileged access with no standing privilege, and disaster recovery that is designed and then exercised.
Azure, AWS, Terraform, Ansible, Azure DevOps, VMware, and Linux.
FinOps, rightsizing, tagging, reservation modelling, and taking a platform off a managed-service provider.
The same engagements as the CV. Select a card to read the write-up.
A 480-server hybrid estate and 14 business-critical applications. The first phase of a 24-month MSP exit, done in six months. CMDB automation cut ticket noise by 64%. The 49% run-rate figure is a model.
Read case studyHub-and-spoke and virtual WAN, residency rules, and a privilege baseline for other EU and Swiss clients.
Read case studyAWS and Azure aligned to NIST, ISO 27002, CIS, and COBIT. Identity incidents down 70%. Cloud spend down 25%.
SAP-to-AWS with encryption and IAM. Terraform and Ansible baselines. Build time down 60%.
Read case studyKanadevia Inova AG · Group Lead, Cloud & Connectivity · Aug 2025 – Present
I own cloud and connectivity for a 480-server hybrid estate and 14 business-critical applications, with 12 programmes running in parallel. The first phase of a 24-month MSP-exit roadmap was compressed into six months: decision rights, runbooks, and a parallel cutover off the external provider.
The three-wave hybrid migration is modelled at CHF 160,800 a year in infrastructure run-rate, about 49% of that cost. That figure is a model, not a saving already taken. CMDB automation cut ticket noise by 64%. The Azure landing zone for Swiss nDSG is hub-and-spoke and virtual WAN, HYOK encryption, and PIM just-in-time access with no standing privilege.
Ne Plus Ultra Global Solutions · Sep 2024 – Present
Landing-zone stamps for regulated estates: hub-and-spoke and virtual WAN, residency rules, and a privilege baseline. The MSP-exit method is decision architecture, runbook transfer, and a parallel cutover. Privileged sessions can be killed in under 30 seconds. The control set is DORA, NIS2, and Swiss nDSG.
Zurich Insurance · Jan 2022 – Apr 2025
AWS and Azure estates aligned to NIST, ISO 27002, CIS, and COBIT. Enterprise IAM for more than 5,000 users. Cloud spend fell by 25% through rightsizing, a tagging taxonomy, and reservation modelling. Disaster recovery was designed and exercised in quarterly drills.
DXC Technology · Dec 2016 – Dec 2020
SAP-to-AWS migrations with encryption and IAM. Cost fell by 20%. Terraform and Ansible baselines aligned to NIST and ISO 27001. Build time fell by 60% across more than 100 environments.
Notes on the landing zone, cost, and the forge. Select a card to read the note.
GitLab Community Edition on an OVH VPS, behind the WireGuard mesh, at git.neplusultra.eu. The website describes the forge. The website does not host it.
5 min read · GitLab CE · WireGuard
Read articleResidency, HYOK, and PIM with no standing privilege, as part of the landing zone rather than a project afterwards.
DORA · nDSG · NIS2
Read articleTagging first, then the exit from the provider. The 49% figure is a modelled infrastructure run-rate.
FinOps · MSP exit
Read articleArticle · By Sashree Seepersad · 20 October 2026
The forge for this practice is GitLab Community Edition on a machine I operate. It is not GitLab.com, and it is not this website.
GitLab CE is the omnibus install: Git, merge requests, CI, and a container registry. Gitaly stores the repositories. Workhorse and Puma serve the application. Sidekiq runs the jobs. Postgres and Redis stay inside the same install. A Runner on that host runs the pipelines.
A hosted forge holds the history, the CI credentials, and the images. That is another operator. Source is part of the baseline. If it can only be read by asking the vendor, the estate has not left.
The install sits on an OVH VPS, the second node of the WireGuard mesh, at git.neplusultra.eu. This website stays on the hub. A public browser receives a mesh-required refusal. Operators reach the forge over WireGuard.
Ubuntu 24.04 on the OVH node. GitLab CE omnibus in rootless Podman. The Runner is a service on the same host. Caddy on the hub terminates TLS and only forwards clients already on the mesh. The key agreement on that name is the hybrid group X25519MLKEM768.
The forge is part of the estate. The website can describe it. The website does not host it.
Article · 20 October 2026
Residency, HYOK, and PIM with no standing privilege belong in the landing zone. Terraform and Ansible carry that baseline into the next environment. Measured results are on the Zurich and Kanadevia studies: compliance gaps down 40%, identity-related incidents down 70%.
Article · By Sashree Seepersad · Principal Enterprise Architect
As cloud investments mature, enterprise organizations frequently reach a tipping point where Managed Service Provider (MSP) markup, unoptimized resource provisioning, and fragmented tagging lead to unsustainable cloud spend growth.
Many enterprise MSP models rely on fixed resource markups or opaque management fees, creating a structural disincentive to rightsize cloud environments. When combined with uncoordinated cloud migrations, organizations often find themselves paying premium cloud rates for legacy operational patterns.
Direct answers.
Sashree Seepersad is a Principal Cloud Architect. He is Group Lead for Cloud and Connectivity at Kanadevia Inova, and founder of Ne Plus Ultra Global Solutions. About 19 years of his career has been in IT, and about 9 years in cloud architecture.
Azure landing zones with hub-and-spoke and virtual WAN, HYOK encryption, and PIM just-in-time access with no standing privilege. The control set is NIST, ISO 27001, CIS, COBIT, NIS2, DORA, and Swiss nDSG.
At Zurich, compliance gaps fell by 40%, identity-related incidents fell by 70%, and cloud spend fell by 25%. At DXC, Terraform and Ansible baselines cut build time by 60% across more than 100 environments. At Kanadevia, CMDB automation cut ticket noise by 64%. The three-wave migration is modelled at CHF 160,800 a year in infrastructure run-rate, about 49% of that cost.
Use the form on this page. The company site is neplusultra.eu.
The notes above are the same record as the CV.
Thank you! Your message has been sent directly to Sashree Seepersad.