Nicolas Leduc

Available for new engagements

Azure and AI platforms, built for production.

Independent Azure Cloud Architect. I work with IT leadership in banking, insurance and large enterprises to design, industrialise and secure their platforms, from landing zone to AI services in regulated environments.

On Azure
Since 2012
Microsoft exams passed
31
Active certifications
8
First conversation
30 min

Services

Five levers for a cloud under control

Every engagement starts from something concrete: an architecture to frame, an AI platform to expose without leaking data, a deployment to automate, a bill to bring under control, or an exposure to reduce.

Specialty

AI platforms on Azure

Expose AI models to your teams with no compromise on data sovereignty, traceability or cost control, including inside regulated banking environments.

  • Azure AI Foundry: quotas, model governance, migration
  • AI Gateway on API Management: token quotas, OAuth, WAF, IP filtering
  • Production MCP servers on AKS (App Gateway and APIM)
  • Shared central AI hub with private endpoints and APIOps
  • RAG, agents and automated code review inside pipelines

Architecture and landing zone

Target architectures aligned with the Cloud Adoption Framework and the Well-Architected Framework. Foundations laid before the first resource.

  • Landing zone, management groups, subscription governance
  • Network topology: hub and spoke, ExpressRoute, private DNS
  • Azure Lighthouse and Managed Applications
  • Building a Cloud Center of Excellence (CCoE)

Infrastructure as Code and DevOps

Infrastructure becomes a versioned, reviewed, repeatable deliverable. No more manual configuration that nobody can reproduce.

  • Terraform, Bicep and ARM: modules, conventions, reusability
  • GitHub Actions and Azure DevOps pipelines
  • GitOps, self-hosted runners, environment management
  • Upskilling and handover to your teams

Security and compliance

Reduce the attack surface and make compliance demonstrable, including NIS and financial services contexts, without slowing your delivery teams down.

  • Entra ID, RBAC, PIM, MFA, conditional access
  • Defender for Cloud, Sentinel, security posture
  • Network segmentation, Azure Firewall, private endpoints
  • Azure Policy, initiatives and regulatory compliance
  • CyberArk PAM: deployment, connectors, operations

FinOps and optimisation

Understand the bill before cutting it. Consumption analysis first, then actions ranked by saving and by effort.

  • Cost analysis and waste identification
  • Rightsizing, reservations, automatic shutdown policies
  • Governance: tagging, budgets, alerts, chargeback
  • Dashboards and exports for leadership

Method

A simple, readable sequence

No multi-month tunnel before the first deliverable. We move in short stages, each one ending with something usable.

Framing

A 30 minute conversation to understand the context, the regulatory constraints and the real objective. Outcome: a clear scope and an honest estimate.

Design

Documented target architecture (HLD, LLD, diagrams), reasoned technical choices and explicit trade-offs between cost, security and operational complexity.

Delivery

Implementation as Infrastructure as Code, joint review and iteration based on what actually runs in your own subscription.

Handover

Documentation, runbooks and training for your teams. I am also a Microsoft Certified Trainer. The goal is your autonomy, not your dependency.

Experience

Demanding environments

Private banking, insurance, air transport: contexts where an architecture mistake is expensive and where compliance is not negotiable.

  1. Dec 2024 to Jul 2026

    Sr. TechLead DevSecOps

    Rothschild & Co · Freelance · Paris

    Built a shared central AI hub at group level (private endpoints, APIOps). Delivered the organisation's first production MCP server, running on AKS behind Application Gateway and APIM. Designed the AI Gateway for Azure AI Foundry and an automated code review pipeline, under EU data sovereignty constraints.

  2. Jan 2024 to Jan 2025

    Cloud Competence Center Manager (CCoE)

    Groupama · Freelance · Paris

    Created the Cloud Center of Competence and Excellence: selected the cloud solution provider and laid the first architecture pillars.

  3. Sep 2023 to Jan 2025

    Lead AI Engineer

    SharkAtlas · Freelance

    Designed an application to revalue insurance assets: retrieval augmented generation, document reading through Google Vision AI, prompt engineering, vector search with GPT-4o, chunking optimisation and a FastAPI service.

  4. Apr 2022 to Feb 2024

    Sr. Lead Cloud Architect Azure

    Amadeus · Freelance · Nice

    Technical referent in an IBEX 35 environment. Security landing zone, AKS, Container Registry and Key Vault deployed through GitHub Actions. Azure Lighthouse to onboard customer subscriptions, Managed Applications with Marketplace bootstrap, and KQL alerting forwarded to ServiceNow.

  5. Feb 2012 to Apr 2022

    Cloud Architect Azure and Systems Expert

    AG2R LA MONDIALE · Permanent

    Ten years building the Azure platform of an operator of essential services (NIS): governance and Enterprise Agreement, hub and spoke topology, VPN and ExpressRoute, ADFS, MFA and conditional access, FinOps, BCDR strategy, Azure ML and Synapse, Kubernetes, HPC, plus deployment and administration of CyberArk PAM.

Expertise

Day to day technologies

Azure platform

Landing ZoneVirtual Network ExpressRouteAKS App ServiceFunctions API ManagementApplication Gateway Container RegistryLighthouse Managed AppsService Fabric

AI and data

Azure AI FoundryAzure OpenAI MCPSemantic Kernel RAGAI agents Microsoft FabricAzure ML SynapsePurview Power BIFastAPI

Automation

TerraformBicep ARMGitHub Actions Azure DevOpsAPIOps PowerShellAzure CLI PythonGitOps

Security and governance

Entra IDRBAC PIMAzure Policy Defender for CloudSentinel Key VaultPrivate Endpoints Azure FirewallCyberArk PAM

Observability and FinOps

Azure MonitorLog Analytics KQLApplication Insights Managed GrafanaCost Management AdvisorServiceNow

Certifications

Microsoft certified

31 Microsoft exams passed since 2021. The credentials below are currently valid.

Azure Solutions Architect Expert Valid until January 2028
Azure Administrator Associate Valid until February 2028
Microsoft Certified Trainer Accredited to deliver Microsoft training
CyberArk Privileged Access Security Administration, CyberArk
Azure Fundamentals Microsoft Certified, no expiry
Azure AI Fundamentals Microsoft Certified, no expiry
Azure Data Fundamentals Microsoft Certified, no expiry
Microsoft 365 Fundamentals Microsoft Certified, no expiry

Also passed along the way: AZ-400 (DevOps Engineer Expert), AZ-500 (Security Engineer), AZ-700 (Network Engineer), AZ-204 (Developer), AZ-140, AZ-120, AZ-600, AI-102, DP-203, SC-200, MS-500 and the Power Platform and Dynamics 365 track. These Associate and Expert credentials renew annually and are no longer maintained, the focus being Azure architecture and AI.

Book a meeting

30 minutes to take stock

One slot, one conversation, no commitment. Describe your context and I will tell you frankly whether I am the right person, and if not, who to talk to.

The booking module could not load.

Open Calendly