Oleg
Bogomaz
Cloud Architect / Toronto, Canada
I design and run the cloud platform behind a multi-tenant analytics SaaS used by Canadian investment management firms — from tenant isolation and identity through to the data layer, the security controls, and the evidence that satisfies an enterprise procurement review.
Reference shape of the platform I'm accountable for. Swipe to pan →
02 — Scope
Multi-tenant Azure design with a dedicated tenant and separated production and non-production subscriptions per client. Kubernetes workloads on AKS, capacity and SKU planning, environment build-out.
Entra ID and Keycloak-based single sign-on, Microsoft Graph provisioning at scale, group and entitlement models, external identity patterns for client users.
PostgreSQL as the platform data layer — migration, parameter tuning, benchmarking and performance work, plus the in-house queueing that moves work between services.
SOC 2 documentation, security questionnaires and RFP responses for enterprise clients, SIEM rollout and tuning, and the risk framing that goes to the executive team.
03 — Selected work
Moved production workloads from Azure Cosmos DB for PostgreSQL to Azure Database for PostgreSQL Flexible Server: benchmarking, parameter alignment between engines, connection-handling fixes and a written migration risk assessment for sign-off.
Led the compliance documentation effort backing RFPs from large financial institutions — consolidating policy and architecture source material into a single authoritative reference, then producing tailored answers to client security questionnaires.
Automated Entra ID provisioning for a major insurer's beta rollout — PowerShell against the Microsoft Graph API with client-credentials auth, bulk account creation, security group management and welcome/password-setup flows.
Built the analysis that turns raw Keycloak identity-provider logs into a categorized picture of failed sign-ins by error type and client firm, so support and engineering stop guessing at authentication incidents.
Stood up Microsoft Sentinel and drove its tuning, and set out the reasoning behind operating without a third-party MSSP as a documented, revisited risk decision rather than an omission.
04 — Experience
05 — Stack
06 — Off the clock
This site is served off a box in my house — Docker behind nginx, Cloudflare DNS kept current by a small Worker acting as a dynamic-DNS shim for the router. Running my own infrastructure at home is how I keep the instincts sharp for running it at work.
The same instinct pointed at something with a torque curve. I do my own maintenance and diagnostics rather than handing the keys over — reading the symptoms, tracing the cause, fixing the actual thing. It turns out to be the same job as debugging a production incident, just with worse lighting.
Ontario gives you a short riding season, so none of it goes to waste. Two wheels is the part of the week with no dashboards, no alerts and nothing to escalate.
07 — Contact
Cloud and platform architecture leadership, regulated financial services, multi-tenant SaaS. Based in Toronto.