About
Hi, I'm Wesley Lomax.
This blog used to be about Sitecore and .NET. It's now about the problem I actually spend my days on: running a managed cloud team and turning bespoke Azure engineering into repeatable services, for regulated platforms that have to be compliant and affordable at the same time.
I run the Managed Cloud team at Sitecore. I write about productising Azure services: what makes engineering repeatable, what it costs to run, and which AI automations actually pay for themselves. That includes access control, logging and network architecture built to hold up under a QSA's questions and a security review's, usually the same weak points causing both.
I've been in IT since 2002 — starting as a developer, then over a decade as a freelance solution architect working with some of the world's leading brands, before specialising in cloud engineering and managed cloud services.
Most of what gets written about PCI DSS is compliance-shaped but not Azure-specific, and most of what gets written about Azure cost control ignores that half your "waste" is actually a control someone put there for a reason. I write from the seam between the two — landing zones, Application Gateway and Front Door configuration, IAM and service-principal hygiene, and the KQL queries that prove (or disprove) that any of it is actually working.
What I write about
Productising managed services
Turning bespoke engineering into repeatable offerings: what to standardise, what to leave custom, and how to run it with a team rather than heroes.
AI automation that pays for itself
Where automation genuinely reduces toil or cost in cloud operations, and where it doesn't. Honest numbers and trade-offs, not hype.
Landing zones & platform architecture
Structuring an Azure estate — management groups, subscriptions, networking — so it holds up as it grows.
PCI DSS v4.0.1 on Azure
Where regulated estates actually fail an audit, and the concrete Azure config that satisfies each control.
Application Gateway, Front Door & WAF
Ingress and web-security decisions — AGIC vs. dedicated controllers, and the rules that quietly change behaviour.
IAM & service-principal hygiene
Access control and the stale, over-permissioned identities that are a finding waiting to happen.
Cloud cost & FinOps
Cutting waste without deleting the controls someone put there for a reason — compliance and cost as one story.
KQL & Log Analytics
The queries that prove — or disprove — that any of the above is actually working.
If you're a platform or engineering lead at a fintech, payments or regulated SaaS company trying to get your Azure estate through an audit without blowing the cloud budget, or building the team and services to run it, this is written for you.
Get in touchViews here are my own and not those of my employer.