IT‑IS‑Networking
Technology › Security Architecture

Security Architecture

Security-by-design across estates with conflicting statutory obligations — where the classification scheme has to survive a court rather than an audit.

Left to right is time. Each row is one of the 18 disciplines this one worked alongside, ordered so kindred disciplines sit next to each other rather than alphabetically — a landscape only means anything if neighboring rows belong together. Height is the work running in that domain in that year, weighted by what failure would have cost — life-safety ×3, a statutory obligation ×2.2, the estate itself ×1.5, an evaluation ×1. Every project declares which of those it was, so each ridge traces to an entry you can open and disagree with. Only the work that used this technology is counted, so what shows here is the company it kept rather than the record around it. Height and color are on the record-wide scale rather than this page’s own, so a modest estate draws a modest landscape and any two of these pages can be read against each other.

Enterprise security policy and standards, identity and privilege architecture, and compliance-driven design across CJIS, HIPAA, NIST 800-53, PCI and Florida public records law simultaneously on shared infrastructure.

The firewall estate was run directly, not only designed, across two platform generations: the enterprise Juniper security platform — every rule, every change, every upgrade — and the Cisco ASA platforms serving the library system and the Clerk of Courts data center, before architecting the Palo Alto Networks multi-tenant platform that succeeded them.

Being the person who lives with the rule base is what makes the next architecture better than the last one.

A recurring design principle, learned the hard way: security controls that take the network with them when they fail do not survive contact with an operations team. The disaster recovery path was built with diverse carrier circuits and aggregated links into redundant next-generation firewall pairs in high availability with hardware bypass, so a failure of the inspection layer degraded to open rather than to down.

Subtopics

  • Criminal Justice Information BoundarySeparating CJI-bearing paths from general traffic end to end, reviewed with the state's CJIS authority and carried through thirty-five revisions.
  • Device Administration & IdentityWho may type a command on production infrastructure, and what is recorded when they do — seventeen years across three platform generations, ending in multi-factor and duty-separated accounts.
  • FortinetVDOM-separated inline intrusion prevention at the enterprise core, with separate inspection policy per internet path.
  • Intrusion Prevention & DetectionInline inspection at the core designed to fail open rather than down, with monitoring segments planned in from the start.
  • Juniper NetworksThe city's security estate for a period, and a deliberate second vendor track twelve years into holding a CCIE.
  • Link & Platform CryptographyMACsec at the link layer and FIPS 140-2 validated platforms, where the standard is a compliance obligation rather than a preference.
  • Multi-Tenant IsolationSix independently governed agencies on shared infrastructure, none able to reach, disrupt or inherit the regulatory exposure of any other.
  • Network Access ControlDeciding what may join a network and proving it — from arguing against MAC-based port security in 2006 to operating citywide enforcement across agencies that could each stand it down.
  • Packet Capture & Network ForensicsFull packet capture on the critical path, retained long enough to reconstruct an event rather than merely notice one.
  • Palo Alto NetworksThe platform underneath the city's multi-tenant firewall boundary — multi-vsys, per-tenant routing domains and policy on shared hardware.
  • Post-Quantum CryptographyCrypto-agility at scale, which is an inventory and mass-change problem before it is a cryptography problem.
  • Regulatory Compliance ArchitectureHIPAA, CJIS, NIST 800-53, PCI and Florida public records law — often on the same record at the same time.
  • Web Filtering and Content SecurityEighteen years and five vendor generations of the one control that touches every user every day — and, in a government estate, the one whose decisions are public records.

Applied in

  • Enterprise Agreement Pursuit — Global AutomotivePursuit March–April 2025 · headquarters session May 2025 · relationship carried forwardCisco services subject-matter expert on a bid for a global automotive manufacturer's North American arm — a two-day clarification window, an affiliate's engineering bench as the differentiator, a loss, and a headquarters meeting four weeks later.
  • Career Reference Record — Design, Build and Publishing PlatformApril–September 2026A cross-linked reference work built as a derived graph: edges declared once, every index, backlink and chart generated from them, published static with per-document access control.
  • Casino Surveillance Network Design and Segmentation2024–2026Surveillance refresh and segmentation for a metropolitan casino property — designed as Principal Architect and governed as Director, through a phased implementation and a mid-program re-scope.
  • Client Architecture Portfolio2024–202688 numbered engagements across two years, twenty-plus live at any moment, across healthcare, manufacturing, financial services and the public sector — the inverse of nineteen years inside one estate, and a different problem.
  • E-Rate Funded Network Programs2024–2026Roughly fifteen engagements across school districts, a regional education service agency and a public library consortium — every design constrained by federal funding eligibility and the funding-year window.
  • Multi-Property Gaming Group2024–2026Four properties for a regional casino group — security and segmentation, core refresh, wireless, surveillance separation and firewall consolidation.
  • Healthcare Estates2024–2026Five providers — firewall and intrusion-prevention upgrades against an active vendor advisory, a multi-site data center fabric on standing retainer, and segmentation with virtual desktop.
  • Vendor and Partner Program2024–2026Seven technology and service partners brought in across two years for capability the practice did not have or could not scale, with a formal manufacturer specialization track behind it.
  • Post-Quantum Cryptography ProgramProposed December 2025 · accepted January 2026 · began February 2026A thirty-six-month joint research engagement with the group's parent company, originated rather than assigned — proposed December 2025, accepted January 2026, transacted at CFO level between two companies.
  • SD-WAN Portfolio — Banking and State Legislature2025–2026Three concurrent SD-WAN engagements in regulated and public environments, with the low-level design at revision 2.0 and every configuration passing a routing review before production.
  • State and Local Government Delivery2025–2026A state transportation department data center relocation inside a single summer window, and county switching, firewall and platform replacement alongside it.
  • Utility OT/IT Engagement2024–2026A natural gas and electric utility, carried from review of the SCADA statement of work through firewall and switch delivery.
  • Firewall Refresh and Intrusion Response2025A multi-site next-generation firewall refresh for a nonprofit health provider — and an intrusion the night after cutover, met with geo-fencing and containment run alongside day-one support.
  • Infrastructure and Integration Automation2018–2024Recurring infrastructure and integration work automated on orchestration platforms, governed on the principle that automation multiplies the blast radius of a mistake.
  • Security Posture, Incidents and Federal Liaison2012–2024Working directly with the City's Chief Security Officer on posture, governance, attacks and breaches — and alongside Homeland Security and the FBI when an incident reached that far.
  • Enterprise Fortinet IPS Deployment2012–2024VDOM-separated inline intrusion prevention at the enterprise core, with separate policy per internet path.
  • Fourteen Weeks on the ToolsApril – August 2024The densest hands-on stretch of the NRI tenure — seven client engagements worked personally, in the configuration and the peer reviews and the customer calls, while taking over a team from the second day.
  • Enterprise Multi-Tenant Firewall Architecture2020–2024Six independently governed agencies on shared infrastructure, none able to reach, disrupt or inherit the regulatory exposure of any other.
  • Cecil Disaster Recovery Data Center2015–2023Facility and network design for the recovery site — power, cooling and carrier entry as well as what ran inside.
  • Clerk of the Court Filtering and DMZ Architecture2016–2023A separate filtering estate and demilitarized zone for an independently governed constitutional officer sharing City facilities.
  • Port-Level Authentication: The 2006 Position2006–2023An argument made in 2006 that securing ports by MAC address was not the answer — held across four platform generations, and in production fifteen years later by a route other than the one proposed.
  • Electronic Paper Tablet Assessment and Rollout2019–2023A personal device that became a supported city endpoint — after the enterprise web filtering estate I had built turned out to be the thing breaking it.
  • Enterprise Web Filtering and Content Security2005–2023 · final platform decision scored 17 May 2023Eighteen years and five vendor generations, split two ways between a government workplace and a public library on the same infrastructure.
  • Fire & Rescue Mobile Gateway and SD-WAN Overlay2012–2023Three hundred apparatus turned into routed nodes on the enterprise network — dual carriers on private APNs, head-ends behind two providers, and a zero-trust overlay behind a firewall virtual system built for the fleet.
  • JTA and Downtown Transit Connectivity2006–2023Seventeen years on the boundary between two public agencies that could not direct one another — first as the city's architecture review on transit proposals, then as owner of the interconnect itself.
  • NFL Stadium Cybersecurity Review2022–2023A league Internal Audit assessment of the city-owned stadium against the Department of Homeland Security's stadium cybersecurity guidelines, reaching the building's control systems as much as its enterprise IT.
  • Administrative Identity for the Network Estate2006–2022Sixteen years and three platform generations of who may type a command on a city switch and what is recorded when they do — begun as a procurement condition in 2006, closed with multi-factor and a duty-separated account standard.
  • Enterprise Network Access Control2016–2022Seven years from vendor evaluation to a control that could quarantine a port anywhere in the city — and the federated exception handling that made enforcement survivable in a building shared with four other agencies.
  • Enterprise Traffic Management Platform2006–2022Sixteen years on a platform chosen for what it could be programmed to do rather than what it did on the day — bought as a server proxy in 2006 and ending as continuity infrastructure.
  • Enterprise Packet Capture and Network Forensics Platform2009–2022Full packet capture on eight critical-path points, owned across thirteen years and two platform generations, with retention pushed past thirty days.
  • Juniper Enterprise Security Suite2009 – 2021A security platform rather than a firewall — selected on an instrument written before anyone knew who would win, operated for twelve years, and retired in stages on a plan the same team wrote.
  • Republican National Convention — National Special Security EventJune – October 2020Critical Infrastructure Subcommittee for a national special security event relocated to the city eight weeks into planning — first-responder mobility, venue design, carrier redundancy, and federal sensors landed on a municipal estate.
  • Records Retention and Disposition Standards2008–2018Classification, retention and defensible disposition under Florida public records law, across an estate where criminal justice records, patient information, court records and elections data shared one platform.
  • Enterprise Firewall Policy and OperationsMay 2009 – March 2017Eight years running the rule base directly across two platform generations — every rule, change and upgrade — then handing it down to a dedicated post rather than holding it.
  • The SHA-2 Migration That Reached Dispatch2014A routine certificate renewal that broke a live estate through its oldest endpoints, stopped station alerting in seventy-plus fire stations, and was resolved by deliberately keeping one service weak.
  • Student Capstone Security Engagement and College Partnerships2009–2014A student team given scoped authorization to penetration test the live city estate — and a written response to their findings, taken to a second revision, rather than a thank-you note.
  • Duval County Courthouse Technology Program2008–2012A $12M IT program inside a $350M, 800,000 square foot capital facility, cut over live to a fixed date.
  • Enterprise Security Committee and Governance Program2009–2012The city's enterprise architecture review board, chaired and chartered — and, in the years before the City had a Chief Security Officer, the body where security policy was set.
  • Internet Perimeter Firewall Replacement2006 – 2008An unsupported, undocumented Check Point estate replaced with firewall blades in the core — held as a stated performance objective, carried from written justification to floor-by-floor cutover, with no vendor producing a design at any point.
  • Super Bowl XXXIX Surveillance Network and Command Center2004–2005The transport and command center behind the video surveillance estate for the 2005 Super Bowl — evaluated, architected and overseen by the same person, deliberately.
  • E-Commerce Site Architecture2000–2003PIX firewalls, content switches and SSL accelerators for early commercial web estates.
  • Insurance Carrier E-Commerce Platform2001–2003Mainframe to public web in 2001, across a colocation tunnel and two firewalls — where the deliverable was the boundary, not the website, and the documentation reached revision 243.
  • Water Treatment Facilities WAN/LAN1999–2002WAN and LAN design for water treatment facilities, with PIX firewall and web monitoring.

Through subtopics

19 further projects reference a subtopic of this entry rather than the entry itself.

  • Enterprise Architecture Practice Build2024–2026An architecture practice of up to fourteen, built and run to a design review gate and a weekly rhythm — so engagements were delivered against one design language rather than individual preference.
  • Enterprise Networking Practice Lab2026Three repurposed servers being rebuilt into a 2.3 TB virtualized network emulation cluster, funded on a cost-per-month argument against a six-month procurement lead time — and the end of a practice running on engineers' own hardware.
  • Commercial Site Rebuild and Live Domain MigrationApril–September 2026Twenty pages moved off a hosted page builder onto a static build, and a live domain repointed to a new host without touching any of the six records carrying its mail.
  • Municipal Infrastructure Assessment to RFP2024–2025An infrastructure assessment for a town government, scoped from the start to become the foundation of its own procurement rather than a proposal for follow-on work.
  • Consolidated CAD/911 Dispatch System2016–2024Two agencies with separate commands onto one dispatch platform, cutting response times from five to ten minutes down to one to two.
  • Enterprise AI Readiness Assessment2022–2024Two years of technology review and systems analysis on where AI could fit a consolidated city-county government — and, as often, where it could not yet be defended.
  • Data Center Estate and Colocation Program2015–2024Six tiered sites for the city and five external agencies — and a municipal IT department selling colocation against commercial carriers, and winning on engineering.
  • ISP Cutover, Public IP Renumbering and WAN Modernization2022–2023An estate moved to a new provider and a new public address space, then modernized for remote and hosted working without dropping the applications the business ran on.
  • Oracle ERP Program — RFP to Cloud Go-Live2011–2023Twelve years from the 2011 request for proposal to a 2020 cloud go-live — the cost model that had to exist first, and a cutover instrumented so neither side could blame the other.
  • Disaster Recovery Validation and Application Tiering2020Criticality bound to recovery objectives in an instrument rather than a narrative, and a definition of "tested" that the estate could not yet meet — reported rather than softened.
  • Annex to Main Data Center Consolidation2010–2018Moving one data center into another with the estate live throughout, on three design documents at revisions ten, twelve and ten.
  • Telemedicine Program with Hospital PartnersMay 2014 – August 2015Duval County Jail to UF Health — fifteen months from vendor presentation to completed pilot, opened with a business case rather than with equipment.
  • Courthouse Trial BroadcastDecember 2013 – January 2014A controlled pooled broadcast out of a courtroom for high-profile trials — four cameras, coax to fiber through four floors, and a request to block cellular data on one antenna node while leaving voice alone.
  • Biochemical Manufacturer Converged Network2010–2012Headquarters, an affiliated business and a plant site joined over encrypted tunnels on consumer DSL — where the reliability had to come from the design, because it was not coming from the circuits.
  • Fort Stewart Mobile Disaster Recovery Fleet2003–2004A fleet of vehicles able to deploy across Georgia during disasters and operate where fixed infrastructure was gone.
  • SOCOM Transportable Wireless Kit2003–2004A two-site voice, video and data package over a point-to-point link where no fixed infrastructure existed.
  • Hospital Network and Clinical Wireless2000–2004Facility-wide clinical wireless under HIPAA across hospital systems in New York, Florida, Delaware and North Carolina.
  • StorComm PACS Platform1997–1999Chief system designer of a clinical picture archiving and communication platform for hospital customers.
  • StorComm Teleradiology Platform1997–1999Diagnostic imaging delivered to radiologists at home over ISDN and dial-up — telemedicine fifteen years before the market used the word.

Career

Documents

Attested by

  • Cisco Expert-Track Written Examinations2003 · undefinedFour expert-track written examinations passed across eight years. These carried CCIE recertification through successive cycles — the exam record behind twenty years of maintaining #10042.
  • JNCIA2012 · LapsedJuniper Networks Certified Associate, taken in January 2012 as the City of Jacksonville estate took on Juniper security platforms.
  • JNCIS-SEC2012 · LapsedJuniper Networks Certified Specialist, Security.
  • JNCIP-SEC2012 · LapsedJuniper Networks Certified Professional, Security — the professional tier of the Juniper security track.

See also

Also searched as

  • zero trust
  • ZTNA
  • microsegmentation
  • least privilege network
  • SASE
  • SSE
  • secure service edge
  • cloud-delivered security
  • SIEM
  • SOC
  • security operations
  • incident response
  • threat detection

Compliance-driven isolation and per-tenant policy, designed under regulatory constraint before the vocabulary existed.