Lucas Jacob

A long-running infrastructure as code journey that evolved in step with both the tooling landscape and the maturity of the engineering teams — progressively shifting infrastructure ownership closer to developers while improving reliability, repeatability, and scale.

Phase 1 — ARM Templates
Began the IaC journey with Azure ARM templates, which represented a significant step forward at the time — providing a declarative, source-controllable format for capturing infrastructure state. ARM templates brought consistency and repeatability to Azure resource provisioning and established the foundational discipline of treating infrastructure as code rather than a manual, tribal process.

Phase 2 — Azure PowerShell & Bash Scripting
As environment complexity grew, ARM templates became limiting. Transitioned to Azure PowerShell and Azure Bash scripting to unlock greater flexibility — particularly around variable handling and dynamic environment generation. This enabled the programmatic construction of large, complex environments on demand, supporting ephemeral and per-project infrastructure without manual intervention and giving the team far greater control over provisioning logic.

Phase 3 — Terraform & Developer Empowerment
Adopted Terraform as the IaC standard, marking the most significant shift in both capability and culture. Built a library of reusable Terraform modules and abstracted the backend plumbing — connecting modules to state backends, pipeline tooling, and cloud services — so that engineers could create and orchestrate their own infrastructure changes without needing deep DevOps involvement for every request. Terraform state management provided continuous drift detection, ensuring the real-world environment always reflected what was defined in code and giving teams confidence that what was deployed matched what was intended.

A continuous investment in CI/CD capability spanning many years — from the early adoption of Azure DevOps (then VS Online) through to a fully mature delivery platform touching every layer of the software delivery lifecycle.

Foundation — Migration & Pipeline Maturity
Adopted Azure DevOps in its early incarnation as VS Online and grew with the platform, migrating all repositories and delivery capabilities as it evolved. Standardised pipeline-based delivery across all teams and workstreams, bringing deployment windows down from hours to minutes and eliminating the need for manual rollback procedures through reliable, repeatable pipeline execution.

Infrastructure & Ephemeral Environments
Extended CI/CD beyond application delivery to drive infrastructure builds, treating infrastructure as a first-class pipeline citizen. Leveraged pipelines to manage ephemeral environments — enabling teams to spin up and tear down environments on demand, reducing costs, eliminating environment contention, and giving developers isolated, consistent environments for every piece of work.

Quality Feedback Loops — Functional & Non-Functional Testing
Partnered with QA teams to embed testing directly into the CI/CD pipeline, shortening the feedback loop between code change and quality signal. Integrated Selenium-based functional test suites to validate application behaviour on every build, and introduced non-functional testing via Blazemeter and Azure Load Tests to surface performance and scalability issues before they reached production. Shifted quality left — giving developers test results at the point of change rather than at the end of a release cycle.

Security Feedback Loops — DevSecOps Integration
Embedded security tooling into the pipeline to give developers and security engineers early visibility of vulnerabilities without waiting for scheduled audits. Integrated SonarQube for static application security testing (SAST) across the codebase and OWASP ZAP for dynamic application security testing (DAST) — replacing infrequent, manual security reviews with continuous, automated scanning on every release. Gave security teams actionable findings at the speed of development.

iICE MDM is a commercial off-the-shelf Master Data Management platform with no native support for source control or CI/CD. All business logic and scripting was stored directly in the database, making it impossible to track changes, compare versions, or manage deployments in a modern, controlled and repeatable way.

The Problem:
Developers and configuration teams were making changes directly within the MDM system with no visibility, no audit trail, and no rollback capability. There was no way to detect drift, compare environments, or deploy changes consistently — creating significant risk around data integrity and release quality.
The Solution — Jython Extraction & Source Control
Engineered a process to extract the code stored natively in the iICE MDM database and export it as standalone Jython files that could be committed to source control. This unlocked full version history, branch-based development, and the ability to diff changes — including changes made by developers working outside of the formal process. The pipeline could then deploy changes from source control back into the MDM system in a controlled, repeatable manner, bringing the platform in line with standard software delivery practices for the first time.
Expansion — Full Configuration Coverage
The initial solution focused on Jython scripts, but the approach was later expanded to capture and source control other configurable attributes of the iICE MDM system. This broadened the scope of what could be tracked, audited, and deployed — providing end-to-end configuration management across the platform and further reducing the risk of undetected drift between environments.

A multi-year Sitecore CMS platform journey spanning three major phases of infrastructure modernisation, CI/CD transformation, and global expansion — supporting both internal and customer-facing websites throughout.

Phase 1 — Vendor Exit & Azure IaaS Migration:
Transitioned Sitecore hosting away from a third-party vendor, bringing full ownership of the platform in-house and migrating infrastructure to Azure IaaS. Migrated CI/CD pipelines from TeamCity and Octopus Deploy to Azure DevOps and Jenkins, standardising the delivery process and reducing external dependencies.

Phase 2 — PaaS Modernisation & CI/CD Consolidation:
Migrated the Sitecore platform from IaaS to Azure PaaS, reducing operational overhead and improving platform reliability and scalability. Consolidated CI/CD tooling entirely onto Azure DevOps, simplifying the pipeline landscape and enabling faster, more consistent releases.

Phase 3 — Global Expansion & Developer Enablement:
Scaled the platform to a globally hosted solution serving content authors across both the USA and Australia, with hosting distributed across the United States, Asia, and Australia to meet regional performance and compliance requirements. Introduced dynamic Sitecore environment generation, empowering developers to provision fully configured Sitecore environments on demand per project needs — significantly reducing environment lead times and improving developer velocity while keeping cost at the forefront of delivery.

Established a DevSecOps practice from the ground up working with Security Teams, Managers, Development Teams and Engineers to integrate automated security tooling directly into the CI/CD pipelines. Onboarded SonarQube across 100+ repositories to enforce static code analysis (SAST) on CI Builds, Pull Requests and Releases, surfacing vulnerabilities and code quality issues before they reached production systems.

In addition I implemented OWASP ZAP (Zed Attack Proxy) for dynamic application security testing (DAST), replacing ad-hoc manual penetration tests with automated scans on every deployment. Shifted the security cadence from a quarterly audit model to continuous, release-gated scanning — dramatically reducing the window of exposure and giving development teams real-time security feedback.

The initiative measurably improved the organisation's overall security posture, reduced the backlog of unresolved vulnerabilities, and embedded a security-first culture across engineering teams.