Hi, I’m Layla HaddadCloud Solutions Architect

I design the cloud foundations regulated teams can trust.

For nine years I have built landing zones, network topologies and identity setups for organisations where an outage or a leaked record is a headline. Most of that work is in healthcare and public-sector Azure, where every design has to pass a security review before it passes a sprint.

Open to architecture roles · Q1 2027move your cursor across the field

01 Experience

Senior Cloud Solutions Architect

Feb 2023 – Present

Northwind Health Cloud ↗

Northwind hosts clinical and incident-reporting systems for hospital groups. I own the reference landing zone every new tenant is deployed into, and sign off the architecture before go-live.

Designed a hub-and-spoke landing zone with Azure Firewall, private endpoints and Key Vault per workload, now the baseline for 14 hospital tenants.
Moved hospital connectivity from site-to-site IPsec to ExpressRoute with a VPN failover path, cutting average latency to on-premises systems by 60%.
Federated sign-in for 3,000+ clinical users to Microsoft Entra ID over SAML, with conditional access tied to device compliance.
Wrote the security review pack (network segregation, key management, logging) that halved the time from design to approval.

Azure Landing Zones
Hub-spoke
Azure Firewall
ExpressRoute
Key Vault
Entra ID
Bicep
Azure Policy

Cloud Engineer

Jun 2020 – Jan 2023

Arcwell Consulting ↗

Migration projects for ministries and banks. Lift-and-shift first, then rebuild the parts that should never have been lifted.

Azure Migrate
Terraform
Azure SQL MI
App Service
Azure DevOps
PowerShell

Systems Engineer

Mar 2018 – May 2020

Sablebay Telecom ↗

Ran the Windows and VMware estate behind billing and CRM, and built the first hybrid connection to Azure.

VMware vSphere
Windows Server
Active Directory
Site-to-site VPN
SCCM

Education & certification

American University of Sharjah

2012 – 2016

BSc Computer Engineering

Microsoft Certified: Azure Solutions Architect Expert

2022

AZ-305, plus AZ-500 Security Engineer Associate (2023)

02 Projects

Baseline ↗used by 14 tenants

A Bicep module set for healthcare landing zones: hub network, firewall rules, private DNS and diagnostic settings, with Azure Policy assignments that block a public endpoint before anyone can create one.

Bicep
Azure Policy
Private DNS
GitHub Actions

Tracepath ↗open source

A CLI that reads an Azure subscription and draws the actual network path between two resources, hop by hop, including which NSG or firewall rule allows or drops the traffic.

Python
Azure SDK
Graphviz
Resource Graph

Keyring Audit ↗open source

A scheduled check that lists every secret and certificate expiring in the next 60 days across all Key Vaults in a tenant, and opens a ticket for the owning team.

Azure Functions
Key Vault
Logic Apps
KQL

03 Stack

Cloud: Azure · Landing Zones · Hub-spoke · Virtual WAN · App Service · AKS · Azure Functions
Network: Azure Firewall · NSGs · Private Link · ExpressRoute · IPsec VPN · Application Gateway · WAF
Identity: Microsoft Entra ID · SAML · OIDC · Conditional Access · PIM · Managed identities
Data: Azure SQL Managed Instance · SQL Server · Storage accounts · Backup & Site Recovery
Security: Key Vault · Defender for Cloud · Sentinel · Azure Policy · ISO 27001 controls
Automation: Bicep · Terraform · PowerShell · Python · Azure DevOps · GitHub Actions

04 Contact

layla@example.com

Email LinkedIn ↗ GitHub ↗ Microsoft Learn ↗