Fochville, South Africa
Lead: Infrastructure Services at Master Drilling, and nearly two decades in the same estate before the title. Microsoft cloud, identity, endpoints, networks and security for a business on five continents: who gets access, what runs where, how fast it all goes away when someone leaves, and what breaks when nobody is watching.
Microsoft 365, Entra, Intune, Azure, and the networks and endpoints underneath. Run as one estate across regions.
Conditional Access, MFA, Defender and DLP. Hardening what is already in production, and proving who can reach what.
Custom platforms and PowerShell that remove the manual steps skipped under pressure, which is where most incidents start.
Took the tenant's Microsoft 365 Secure Score to 93.3%. Retired legacy authentication, rebuilt Conditional Access from the ground up, enforced phishing-resistant MFA and risk-based identity policies, and rolled Defender out across every regional office. A zero-trust posture with the number to show for it.
Deployed Darktrace across network, SaaS and email to catch what signature-based tools miss: anomaly detection that learns what normal looks like and flags the deviation, with autonomous response to contain a threat in the seconds before a human can reach it. It runs alongside the Microsoft Defender stack, not instead of it.
Designed and built the company's IT service desk from the ground up, replacing legacy help-desk software that could not keep up. Now the front door for IT across the business: 24 request types across 21 regions, with ticketing, approval workflows, SLAs and reporting, and a 94% resolution rate. It set the pattern for the rest of the internal platform (procurement, finance, HR lifecycle, document tooling), whose identity and auth layer I own.
The ERP is where identity meets the business, and I own the access side of it. Security-role matrices reported across production and test environments, drift alerts when roles change without a request behind them, and a browsable view of the entities and roles that makes F&O legible instead of a black box. Carried the platform through the move from Dynamics AX to D365 Finance & Operations.
Led the overhaul of core routing, switching and inter-site links across headquarters and the global Centers of Excellence: segmentation, high-availability pairs, and clean cutovers run on live operational shifts without dropping one.
A standardised, deployable site kit: connectivity, endpoints, identity and access provisioned to one baseline, then rolled out across 118 remote locations. Standing up a new site went from a bespoke project to a repeatable deployment.
Turned joiner, mover and leaver from a checklist into a pipeline. Approval on a ticket now creates the account, assigns the licence and sends credentials in the right language; on exit it disables the account across Entra, Microsoft 365 and Dynamics 365. Destructive steps default to off and are opted into per region.
Found and closed a gap in an internal platform where some endpoints were reachable without a valid check, and tightened token validation to verify signatures and pin the expected tenant. Rolling the same pattern out across the wider estate.
A voice-controlled house on dual text-to-speech engines, with presence detection built on the router rather than GPS. Self-hosted end to end. Migrated bare-metal to new hardware, with its own outage tracking and recovered energy history. Where I get to break things without a change request.
Notes on infrastructure, identity, security and the automation that holds it together. All writing →
I have been at Master Drilling since 2007, from IT Controller to Lead of global infrastructure. Long enough to have run most of this stack while it was still the previous version of itself, and to know that the title is worth very little if you can no longer open a shell and find the actual problem.
The interesting problems are rarely the exotic ones. They are the account nobody disabled and the endpoint nobody put a check on.
Most of what I do sits behind a corporate login, so this page is where I write up the parts I can share.
LinkedIn is the best way to reach me. Happy to talk about infrastructure, cloud security, identity, or anything Microsoft shaped.
/in/dewaldvw