Bonjour.

Infrastructure billing usually lives in spreadsheets and tribal knowledge. This platform replaced both with Django applications that price and bill fileshares, VMs, physical servers and HPC usage — owner mapping, cost-centre tracking, per-U rack pricing, all in one place.

One click renders owner-specific PDF bills and emails them to owners or entire distribution groups. And every six months, each PI receives an access report of exactly what they hold — the fileshares, AWS accounts and virtual machines under their name — so reviews happen on schedule, not on suspicion.

The dashboards reveal what billing systems usually hide: unattributed costs, expired records, missing CMDB entries. A billing platform that quietly audits the whole estate.

Enterprise storage answers to no one — until you make it. Automated collection and reporting of quotas, shares, ownership and access groups across Isilon/OneFS, cross-checked against CMDB and Starfish until every gap has a name and an owner.

It drives safe decommissioning end to end as well — export removal, AD group cleanup, CMDB updates, controlled filesystem cleanup — the risky manual steps encoded as one repeatable, reviewable workflow.

Cross-account governance as code: role assumption at scale through STS, landing-zone checks, account lifecycle operations and S3 policy automation across the entire organization.

Purpose-built governance Lambdas patrol the fleet, aligned with the latest CIS benchmarks for AWS security — so compliance is continuous rather than an annual scramble.

Drift detection returns clean true/false answers that orchestration can act on directly — with full operational logging kept underneath, for the humans.

ServiceNow and Cirrus — our custom front end — drive vRO/vRA as the orchestration backbone for the entire infrastructure request catalog:

One front end, one orchestration backbone, every request auditable — and it survived the Aria upgrades, too.

Raw Slurm job data — CPU and memory efficiency, requested resources, runtime — turned into reports research stakeholders actually read: usage, waste, performance and cost drivers, per job and per group.

Beyond reporting, I've been reshaping how researchers reach the cluster itself: custom RHEL VDIs deployed as user shells, sparing the login nodes, with a purpose-built Docker container for app deployment and a custom wrapper that tames the greedy accounting algorithm behind user quotas.

The VDIs are provisioned through vRO workflows and requested through Cirrus and ServiceNow — with approvals flowing from PI grants via the Workday API. Access to the cluster became a governed request, not a shared bottleneck.

The CHOP Azure Research Portal turns VM delivery into a governed product: Platform Administrators, PIs and research users each receive a purpose-built workspace for grants, requests, access, approvals and lifecycle operations.

Terraform plans are immutable and checksum-verified; grant expiry closes unsafe requests; Azure Bastion keeps SSH native to Entra ID; GitHub and future Terraform Enterprise integration are captured as explicit architecture decisions rather than hidden coupling.