carlo@dublin:~$ whoami

Carlo Lombardi

Cloud · Identity · Automation

I keep the business running while I automate the systems it depends on.

IT engineer in Dublin. I administer Microsoft 365, Entra ID, Intune and Azure, build AI tooling for the IT team, and I am moving into DevOps and cloud engineering.

while (alive) { learn(); build(); ship(); }

01 / work

What I build and run

Since 2025 I have worked at Fónua, a telecoms fulfilment, repair and logistics operation in Dublin, as an IT Support Engineer. My work there covers systems, cloud identity and automation across multiple sites.

The demos below were built for this page and use made-up data. The real systems are internal.

A knowledge system with hybrid retrieval

I designed and built a retrieval-augmented (RAG) knowledge system on ChromaDB over resolved incidents and internal documentation. Retrieval is hybrid: dense vector similarity and BM25 keyword matching, fused with reciprocal rank fusion, so a query finds both the passage that means the same thing and the one that contains the exact error code.

Search this page the same way

BM25 keywords

    Similarity trigrams

      Fused RRF, k = 60

        Both rankers run in your browser over the sections of this page. BM25 is the real algorithm. The similarity ranker compares character trigrams and stands in for dense embeddings, because no model is shipped to your browser; it is what catches the typo.

        An MCP server the whole IT team uses

        I delivered a remote MCP (Model Context Protocol) server that exposes that knowledge base to the wider IT team. It runs in production, so any colleague's AI client can list the tools and call them.

        The conversation, message by message

        1. initialize the client introduces itself
        2. result the server answers with its capabilities
        3. tools/list what can you do?
        4. result one tool: search_knowledge
        5. tools/call search for an incident
        6. result ranked passages come back
        
          
        
            
            
          
        
        
        
      
        

      
        
        
        
          
        Agents that are not allowed to break things
        
          
        I built specialised AI agents for triage, solution verification and pre-change risk analysis. A hook inspects every command before it runs and blocks destructive operations, so an agent can investigate a problem but cannot delete data.
        
        
        
        
        
          
        Try to get a command past the hook
        
          
        
            
        
            
        
              
              
              
              
            
        
          
        
          
        
          
        
            Rules the hook checks before execution
            
        PatternWhy it is blocked
        
            
              
        rm, del, delete, erase, rmdirDeletes files or data
        
              
        DROP, TRUNCATE, DELETE without WHEREIrreversible data loss
        
              
        Remove-*, Clear-*Removal needs a change request
        
              
        git push --force, git reset --hardRewrites history
        
              
        shutdown, Restart-Computer, formatTakes a system down
        
                    
          
        
        
        
      
        

      
        
        
        
          
        Identity, from first day to last
        
          
        I administer Microsoft 365 and Entra ID: the identity lifecycle of joiners, movers and leavers, Intune enrolment and compliance, Azure RBAC, and Azure VPN Gateway with SSO and MFA. Access follows group membership, so changing a person's role rewires what they can reach, and leaving removes all of it.
        
        
        
        
        
          
        One person, three events
        
          
        
            
            
            
          
        
          
            Graph of a user, their groups and the access each group grants
            
              
              
              
              
              
              
              
            
            user
            All staff
            Warehouse
            Finance
            VPN · SSO+MFA
            Intune laptop
            Ops mailbox
            Finance site
          
          
        Joiner: account created, licence assigned, added to groups, laptop enrolled. Access comes from group membership.
        
        
        
      
        

      
        
        
        
          
        Certificates renewed before they expire
        
          
        I own the certificate and PKI lifecycle across five platforms, including SAML SSO and API certificates on Azure App Service. Production changes are sequenced for risk: non-production first, written confirmation, an out-of-hours rollout, then validation through Application Insights telemetry.
        
        
        
        
        
          
        A renewal, in the order that keeps production safe
        
          
        
            
              Days until the certificate expires
              
              
              30
              days left
            
            
          
              
        1. Raise the change ahead of the window
          2. 
              
        2. Generate the CSR, get it signed, assemble the PFX
          3. 
              
        3. Deploy to non-production and validate
          4. 
              
        4. Written confirmation to proceed
          5. 
              
        5. Deploy to production, out of hours
          6. 
              
        6. Validate against live telemetry
          7. 
            
        
          
        
          
        
            
          
        
        
        
      
        

      
        
        
        The rest of the role
        
        
          
          
        • Automation. Ticket ingestion and reporting automated with Python, PowerShell and the Freshservice API.
          • 
          
        • Security. Ran an agentic penetration-testing trial end to end, from vendor evaluation to triaged findings.
          • 
          
        • Infrastructure. Windows Server, networking, VPN and print infrastructure across sites.
          • 
          
        • Integrations. Courier, customer and partner integrations over APIs and SFTP with key-based authentication, with SQL Server diagnostics.
          • 
          
        • Reporting. Built a Power BI QA dashboard that was adopted as the standard for programme tracking.
          • 
        
        
      
        
    
        

    
        
      
        02 / pipeline
        
      
        This page is a deployment
        
      
        This part is real. Every push to main runs a GitHub Actions workflow that lints the code, validates the HTML, builds the site, checks every link and asset, and deploys to GitHub Pages. What you are reading is the output of the run below.
        
      
          
        
        1. lintESLint
          2. 
        
        2. validatehtml-validate
          3. 
        
        3. buildstamp build.json
          4. 
        
        4. checklinks and assets
          5. 
        
        5. deployGitHub Pages
          6. 
      
        
      
        
        
        commit
        loads with JavaScript
        
        
        run
        -
        
        
        built
        -
        
        
        source
        github.com/carlo-lombardi/whoami
        
      
        
    
        

    
        
      
        03 / path
        
      
        How I got here
        
      
        From writing application code, to keeping hospital and power-grid systems alive around the clock, to building the tooling myself.
        
      
          
        
        1. 
          
          2025 to now
          
          
          IT Support Engineer Fónua · Dublin
          
          
          Systems, cloud identity and automation engineering for a telecoms fulfilment, repair and logistics operation: Microsoft 365, Entra ID, Intune, Azure, certificates, and AI tooling for the IT team.
          
        
          2. 
        
        2. 
          
          2025
          
          
          Service Desk Engineer Origina · Dublin
          
          
          Coordinated customer interactions and technical escalations for IBM solutions across every incident priority, P1 to P4. Led technical bridge calls and kept action items moving until resolution. Wrote knowledge base articles and root cause reports, and resolved Azure access, authentication and SharePoint permission incidents.
          
        
          3. 
        
        3. 
          
          2024 to 2025
          
          
          24/7 Technical Support Engineer Auxilion / EirGrid · Dublin
          
          
          First and second line support in a critical national infrastructure environment. Managed accounts and onboarding across on-premises Active Directory and Azure AD, monitored and escalated incidents across Windows Server, Linux and databases, coordinated certificate issuance, and used Intune for device management.
          
        
          4. 
        
        4. 
          
          2023 to 2024
          
          
          IT Support Specialist TCS / GE HealthCare · Donegal
          
          
          Supported production healthcare systems: PACS, RIS, cardiology systems and DICOM integrations. Troubleshot Java applications through logs, JVM behaviour and heap and thread inspection; Windows Server on VMware and Hyper-V; Linux disks, RAID and file systems; Oracle, SQL Server and Sybase. Restored a production PACS server after an outage.
          
        
          5. 
        
        5. 
          
          2021 to 2022
          
          
          Full Stack Developer Qubiq · Italy, remote
          
          
          Built and maintained internal tools and web solutions for insurers and affiliates: JavaScript and Node.js API logic, SAP integrations through API endpoints, TypeScript and React components, and server-side work with Next.js.
          
        
          6. 
      
        
    
        

    
        
      
        04 / learning
        
      
        What I am studying
        
      
        
        
        
          
        in progress · 2026–27
        
          
        Higher Diploma in Science in Computing (Cybersecurity)
        
          
        National College of Ireland · NFQ Level 8 · evenings
        
          
        This semester: Software Development, Object Oriented Software Engineering, Web Design and Client Side Scripting, and Introduction to Databases. The programme curriculum continues with Computer Architecture, Operating Systems and Networks, Security Principles and Secure Programming, Network and Web Penetration Testing, Digital Forensics, and a final project.
        
        
        
        
        
          
        in progress
        
          
        Microsoft Azure Administrator (AZ-104)
        
          
        Identities and governance, storage, compute, virtual networking, and monitoring.
        
        
        
        
        
          
        completed
        
          
        CompTIA A+ and a full stack bootcamp
        
          
        CompTIA A+ certified. Before that, an eight-month, full-time bootcamp on the MERN stack: React, Redux, Next.js and TypeScript on the front end, Node.js and Express APIs, MongoDB and PostgreSQL, Git and Scrum.
        
        
        
        
        
          
        ongoing
        
          
        On my own time
        
          
        Retrieval-augmented generation in depth: embeddings, chunking, vector stores, retrieval evaluation and reranking. AI engineering and MLOps, from building with models to operating them. And a home server lab on Ubuntu Server with SSH, Docker and a Kali live environment, which I still break on purpose.
        
        
        
      
        
    
        

    
        
      
        05 / next
        
      
        What comes next
        
      
        I am heading towards DevOps with a focus on security. These are the certifications and projects I plan to do next. I have not started them yet.
        
      
        
        
        
          
        Certifications planned
        
          
          
            
        • HashiCorp Terraform Associate
          • 
            
        • Microsoft DevOps Engineer Expert (AZ-400)
          • 
            
        • Certified Kubernetes Administrator (CKA)
          • 
            
        • Certified Kubernetes Security Specialist (CKS)
          • 
          
        
        
        
        
        
          
        Projects planned
        
          
          
            
        • Azure landing zone with Terraform and Entra ID
          • 
            
        • Containerised app with CI/CD: Docker, GitHub Actions, Trivy
          • 
            
        • Microsoft 365 and Azure automation toolkit in PowerShell and Python
          • 
            
        • Kubernetes GitOps platform: ArgoCD, Helm, Prometheus
          • 
            
        • Secure CI/CD pipeline: SAST, Checkov, gitleaks
          • 
            
        • Observability stack: OpenTelemetry, Prometheus, Grafana, Loki
          • 
            
        • Supply chain security: SBOM, Cosign, SLSA, Kyverno
          • 
            
        • Internal developer platform with Backstage
          • 
            
        • Kubernetes hardening: RBAC, Falco, OPA, Vault
          • 
          
        
        
        
      
        
    
        

    
        
      
        06 / tools
        
      
        What I work with
        
      
      
        Spanish, native · English, professional
        
    
        

    
        
      
        07 / contact
        
      
        Say hello
        
      
        Happy to talk cloud, identity, automation, security or philosophy.
        
      
      
        Outside work: guitar, salsa, sketching, football, long walks in nature, and writing about life and philosophy. Italian and Peruvian, based in Dublin.