Stephen D.Thomas
AI Cloud Architect & Team Lead
Architecting institutional-grade cloud infrastructure with zero-downtime track record across multi-cloud environments.
Global Infrastructure
Deployed across 9 data centers on 3 cloud providers — click any region to explore.
All Regions (9)
The Stack
Production infrastructure, agent fleet, and everything being built right now
Proprietary agent-to-agent authentication and coordination standard — defining how autonomous AI agents negotiate, verify, and collaborate across distributed systems.
Scaling the 170+ agent fleet with new verticals, improved memory systems, mixture-of-agents reasoning chains, and tighter K3s/KEDA orchestration.
Building standardised MCP server patterns for authentication, tool registration, context compression, and multi-tenant agent access control.
Institutional fintech platform — 70-agent financial operations fleet, fund accounting, trading execution, risk management, investor reporting.
Proprietary security framework for the AI agent fleet — tamper-evident audit trails, cryptographic agent identity, and non-repudiation for every agent action.
PST for form anti-fraud (browser-native Privacy Pass) and C2PA for AI output provenance — every artifact cryptographically signed with issuer identity and inputs.
The Journey
From building computers in 6th grade to architecting global cloud infrastructure
The First Build
Built my first computer from parts in 6th grade. Not from a kit — sourced components, assembled the machine, installed the OS. While most kids were playing games, I was figuring out IRQ conflicts and jumper settings on motherboards.
Discovered that building things from scratch was the only way that felt right.
First Business
Started selling custom-built computers to classmates, teachers, and neighbors. Learned pricing, customer service, and the art of the upsell — all before turning 13. This was the first time technology became a business, not just a hobby.
Entrepreneurship was in the DNA from day one.
Edina Football Goes Online
Hosted Edina Football's website using Road Runner cable internet. Designed the site, managed the hosting from a home server, and kept it running for the team and community. In 8th grade, I was already running production web infrastructure.
Proved that real infrastructure could run from anywhere — the cloud mindset before the cloud existed.
From Helpdesk to IT Manager
Started on the helpdesk at Sybaritic, a medical device manufacturer. Didn't just answer tickets — identified patterns, automated repetitive tasks, and grew the role until I was managing IT for the entire organization. This is where the enterprise mindset was forged.
Learned that the best way to advance is to make yourself indispensable by solving problems nobody asked you to solve.
Senior Consultant — Financial & Legal
Joined an MSP and quickly became the senior consultant responsible for our most demanding clients — financial firms and law firms. These industries don't tolerate downtime, data loss, or excuses. Built highly available infrastructure, managed complex Exchange migrations (10,000+ mailboxes), and delivered VMware implementations and Hyper-V environments. This was the proving ground for enterprise-grade reliability.
Financial services and legal — two industries where failure is measured in millions. Zero tolerance became the standard.
Microsoft Power BI & Azure Data Warehouse
Took time to consult directly with Microsoft during the Power BI preview phase. Converted Power Query reports to Power BI, built their Azure Data Warehouse, and supported the surrounding infrastructure. Got hands-on with the platform before it was generally available — shaping how enterprise analytics would work at scale.
Working with Microsoft on a product before GA — few people get to shape the tools that millions will use.
SaaS Administration — Enterprise Scale
Worked as SaaS Administrator at FPX, where the client roster included the nation's top credit card processors and helicopter manufacturers. Managed enterprise SaaS platforms at massive scale — uptime, security, and performance for clients who move billions in transactions.
When your clients process billions in credit card transactions, 'good enough' doesn't exist.
Data Center Migration to Azure
Led the data center migration of a 3M product (Bibliotheca) from 3M's on-premises data center to Azure. This was a full lift — not a simple rehost, but a re-architecture for cloud-native operation. IoT security architecture for library systems deployed globally.
Moved a physical product's entire infrastructure to the cloud — bridging the gap between hardware and software at scale.
Green Field Cloud Build — AWS
Green field AWS build for Blue Cross Blue Shield of Minnesota. Everything automated from day one — no in-place patching, no manual deployments. Rip and replace architecture with A/B deployments. Started with CloudFormation, transitioned to Terraform. This was cloud done right: immutable infrastructure, automated everything, zero drift.
Proved that healthcare infrastructure can be both compliant and cutting-edge — no compromises.
45,000-User Entra ID Migration — Zero Downtime
Performed a 45,000-user Entra ID migration at Fairview Health Services. Disconnected all 45,000 users from Entra ID Sync, disconnected every security group and synced object, re-mapped and re-anchored the Source Anchor — all with zero issues, zero downtime, and zero user impact. This had never been done at this scale. Promoted from Cloud Security Architect & Engineer Consultant to Supervisor of Cybersecurity, Cloud Access & Federation.
Did something that had never been done — 45,000 users, zero downtime. The track record isn't theoretical.
Building the Cloud from Scratch — Global Hedge Fund
Joined Farallon Capital Management as the sole cloud architect and built the entire infrastructure from zero — 9 public cloud regions across Azure, AWS, and GCP, 100% Infrastructure as Code. Every Terraform module written with security built in and scanned with tfsec and Trivy. ExpressRoute circuits and GCP tunnels for private intra-cloud connectivity. OAuth 2.0 and zero-trust access for the NAV/PAC portfolio API. DR strategies across all regions with tested recovery runbooks. Built the AI platform that became the AIHiveMind — 170+ agents, MCP protocol, A2A coordination, TAMP security framework, and C2PA content provenance for every AI output.
Sole architect building a hedge fund's entire global cloud. Every module, every network, every identity — from zero to global production.
AI Infrastructure & The Future
Currently leading AI infrastructure initiatives at the intersection of cloud architecture and artificial intelligence. Working on C2PA (Content Provenance and Authenticity) for verifiable AI content. Designing Agent-to-Agent communication protocols for autonomous system orchestration. Building institutional-grade AI automation that serves investment management operations — NAV calculations, reconciliation processes, and portfolio analytics. Deploying multi-cloud AI across Anthropic, Claude on Vertex, Google Gemini, xAI Grok, and Azure OpenAI. The future of infrastructure is intelligent, autonomous, and provably trustworthy.
Infrastructure doesn't just host applications anymore — it thinks, decides, and acts. Building the systems that make that possible at institutional scale.
Fort Data Center
Built my son a Fort Data Center — a full home infrastructure lab running enterprise-grade hardware. 4 hosts with 640GB RAM, 4 Mac Studios for local AI inference, independent dual 20-amp circuits on separate breakers, bonded 10Gb fiber, Comcast backup, and Starlink failover. This is where the next generation of ideas gets tested before it hits production — and where my son learns that infrastructure is built, not bought.
The same person who built PCs in 6th grade is now building data centers for his son. The cycle continues — and the infrastructure keeps getting bigger.
Experience
15+ years of progressively complex infrastructure challenges
Farallon Capital Management is a San Francisco-based multi-strategy investment firm founded in 1986, managing approximately $40 billion in capital across public equity, credit, real assets, and direct investments. The firm operates globally with offices in San Francisco, Singapore, Tokyo, Hong Kong, and London, deploying capital across developed and emerging markets. Farallon is one of the longest-tenured and most respected hedge funds in the industry, known for disciplined risk management and a research-intensive investment process.
AI Cloud Architect — Team Lead
Jan 2024 — Present (2 yrs 4 mos)Leading AI infrastructure initiatives, global cloud architecture, and AI board membership for a $40B multi-strategy investment firm. Built global AI infrastructure from the ground up. Pioneered the firm's first internal AI chat system. Designing C2PA content provenance systems, Agent-to-Agent protocols, and institutional-grade AI automation. Led Farallon's cloud program alongside the Head of Cyber Security. Managing team while continuing to architect and build multi-cloud infrastructure.
- Built global AI infrastructure from the ground up — started with Azure OpenAI as the firm's first AI infrastructure architect, navigated Microsoft's governance process to onboard subscriptions with Content Filtering and Abuse Monitoring exemptions removed, then expanded to Anthropic, Claude on Vertex, Google Gemini, and xAI Grok
- Served as AI Board Member — provided strategic direction on AI adoption, governance, and risk for the firm
- Pioneered Farallon's first internal AI chat system — deployed before ChatGPT was publicly available, establishing the firm's AI-first culture
- Architected and secured every AI service deployment with executive approvals for zero data retention — no provider touches firm data without contractual guarantees
- Deployed multi-cloud AI infrastructure across Azure OpenAI (first), Anthropic, Claude on Vertex, Google Gemini, and xAI Grok — sole infrastructure architect for every AI platform at the firm
- Developed Mixture-of-Agents modules inferring against multiple LLM providers (Anthropic, Gemini, Grok, Azure OpenAI) for various investment and operational tasks
- Implemented pieces of Open Brain Platform tracked via Azure Subscription for centralized AI governance and cost attribution
- Built custom AI-powered newsletter generator with content and image generation — automated institutional communications
- Developing proprietary AI agent-to-agent (A2A) communication protocols — the standards layer for how autonomous agents authenticate, negotiate, and coordinate across distributed systems without human intervention
- Building TAMP (Trusted Agent Messaging Protocol) — a security framework governing how AI agents exchange messages, verify identity, and maintain tamper-evident audit trails across the fleet
- Implementing C2PA (Coalition for Content Provenance and Authenticity) outputs — every AI-generated artifact is cryptographically signed with provenance metadata so the firm knows exactly what created it, when, and from what inputs
- Building and standardizing MCP (Model Context Protocol) server architecture — tool registries, context compression, authentication patterns, and multi-tenant agent access control
- Leading all AI infrastructure initiatives: 170+ agent fleet orchestration, memory systems, multi-model routing, and mixture-of-agents reasoning chains
- Building AI-driven investment operations automation: NAV, PAC, reconciliation, compliance monitoring, research synthesis, and portfolio analytics
- Stood up .NET 9 Aspire during architecture discussions — containerized orchestration for local development and cloud deployment
- Led Farallon's cloud program with assistance of the Head of Cyber Security — joint accountability for security posture across all cloud services
- Continued to grow technical depth across AI, security, and cloud-native patterns while leading the team
- Managing and mentoring cloud engineering team while continuing to architect and build hands-on — never left the keyboard
Cloud Architect
Apr 2022 — Present (4 yrs 1 mo)Sole cloud architect responsible for every cloud system at a $40B global hedge fund — ran the entire cloud operation single-handedly for 3 years. Built 9 public cloud regions from zero across Azure, AWS, and GCP. Every Terraform module, every network, every identity, every observability platform, every security control — architected, engineered, and operated by one person. Redesigned the firm's global network for cloud-native operations. Built full cloud management platform (Fusion Nexus), Atlassian Cloud replacement (Fusion Forge), and all developer, analytics, and observability tooling. Implemented baseline security patterns including private endpoints and managed identities across every service.
- Ran every cloud system at the firm single-handedly for 3 years — sole architect, sole engineer, sole operator across Azure, AWS, and GCP
- Built the entire cloud infrastructure from zero — every resource, every module, every network, every identity, every policy
- Designed and deployed a global multi-cloud footprint spanning 9 public cloud regions across Azure, AWS, and GCP — covering North America, Europe, and Asia-Pacific
- Architected global network re-architecture to be cloud-native — redesigned the firm's entire network topology for modern cloud connectivity
- Implemented Azure Virtual WAN with global VWAN hubs, ExpressRoute circuits, and site-to-site VPNs — unified global network backbone spanning all regions and cloud providers
- Implemented baseline security patterns across all services — private endpoints and managed identities as the default; no public-facing data plane, no stored credentials
- Deployed ExpressRoute circuits and GCP tunnels for private intra-cloud connectivity across all three providers
- Built every Terraform module from scratch with security baked in by design — every module scanned with tfsec and Trivy before deployment; security is not a layer added after, it is the foundation
- Created centralized Terraform templates consumed by both infrastructure and development teams — standardized patterns for consistent, secure deployments across the firm
- Operated a 100% code-based infrastructure — zero manual provisioning, zero console configuration; every resource, every policy, every secret is defined in code and version controlled
- Implemented Azure Policy as Code — governance guardrails deployed and enforced through Terraform alongside infrastructure, ensuring compliance is automated and auditable, not manual
- Built Fusion Nexus — full cloud management and operations platform with Developer Sandboxes based on custom business process, time-based environments with approval workflows, and automated vulnerability patching across all packages
- Built Fusion Forge — Atlassian Cloud replacement; internal project management platform replacing Jira with custom workflows tailored to the firm's operations
- Architected, engineered, and implemented Dynatrace for legacy application observability — full APM, distributed tracing, and infrastructure monitoring
- Architected, engineered, and implemented New Relic for modern cloud-based application observability — end-to-end monitoring for containerized workloads
- Architected, engineered, and implemented Farallon's data warehouse and analytics infrastructure — Synapse, Fabric, Power BI, and Purview in a hybrid deployment, all on private networking with no public endpoints
- Deployed Azure Arc to extend Azure management and governance to on-premises and multi-cloud resources — unified control plane across hybrid infrastructure
- Architected, engineered, and implemented Plotly Enterprise with multiple environments — secure analytics visualization for investment teams
- Implemented Global Secure Access to enable multiple groups to use applications like Plotly externally and on mobile devices — secure remote access without VPN dependency
- Architected, engineered, and implemented all Power BI related infrastructure and tooling — including Power BI QA analysis tooling for data quality validation
- Architected, engineered, and maintained GitHub, Azure DevOps, and Bitbucket Cloud — sole owner of all source control and CI/CD platforms across the firm
- Managed every cloud-based solution including Entra ID — continuously strengthening security posture, migrating SSO applications to Entra ID, and developing Entra ID role deployment processes
- Implemented Container App Environments and Container App Jobs — serverless container orchestration for batch and event-driven workloads
- Implemented Private State Tokens and custom cookie management for secure, privacy-preserving authentication flows
- Managed the full Microsoft Defender suite — Defender for Cloud, Defender for Endpoint, and Defender for Cloud Apps across all environments
- Migrated from legacy MDM to Microsoft Intune — modern endpoint management for the entire device fleet
- Migrated from legacy MFA to Microsoft Authenticator — phishing-resistant authentication across the enterprise
- Implemented passwordless sign-in with Windows Hello for Business and Entra ID Conditional Access policies
- Managed all Entra ID and Defender for Cloud Apps Conditional Access policies — risk-based, location-based, and device-compliance-based access controls
- Led vendor due diligence for all cloud and SaaS vendors — security assessments, contractual requirements, and risk evaluation
- Built out API management for the firm's custom NAV/PAC solution — designed OAuth 2.0 authentication and zero-trust access controls for all portfolio analytics API endpoints
- Designed and implemented DR (Disaster Recovery) strategies across all cloud regions — cross-region failover, backup policies, RTO/RPO targets, and tested recovery runbooks
- Built custom Service Principal lifecycle management with automated secret rotation via Key Vault
- Designed Zero-Retention Data Sandboxes for secure investment data operations
- Built NAV, PAC, and reconciliation processes in Azure — institutional-grade financial operations automation
- Served as the primary cloud contact for every business group across the firm — translated business requirements into cloud architecture and ensured priorities and goals were met
- Enabled multiple groups across the firm to adopt cloud services — drove cloud adoption from zero to enterprise-wide
- Trained and mentored helpdesk teams; built all internal operational tooling
Capabilities Developed
Lab & Independent Work
What I build on my own time — experiments, platforms, and infrastructure
AIHiveMind
170+ Agents170+ autonomous AI agent fleet built from scratch — a full institutional intelligence platform spanning investment operations, compliance, legal, research, sales, media, and infrastructure across 6 business entities. Implements Mixture-of-Agents architecture inferring against Anthropic, Claude on Vertex, Google Gemini, xAI Grok, and Azure OpenAI. Features proprietary A2A (Agent-to-Agent) communication protocols, TAMP (Trusted Agent Messaging Protocol) for secure agent messaging, MCP (Model Context Protocol) server architecture for tool registries and context compression, and C2PA content provenance for cryptographically signed AI outputs. The fleet includes a MasterMind apex orchestrator using Mixture-of-Agents synthesis with adversarial red-teaming before execution.
Protocols
170+ agents operating across investment, compliance, legal, research, sales, media, and infrastructure — serving 6 business entities with institutional-grade AI automation
Fort Data Center
Enterprise-grade home infrastructure lab built for my son — and for testing the next generation of ideas before they hit production. 4 hosts with 640GB RAM, 4 Mac Studios for local AI inference, independent dual 20-amp circuits on separate breakers, bonded 10Gb fiber primary connectivity, Comcast backup, and Starlink failover. Runs K3s clusters, local LLM inference, and serves as the proving ground for every architecture pattern deployed to production.
CloudPortfolio Platform
Institutional-grade AI operations platform — the command center for the AIHiveMind fleet. Includes CloudPortfolio.Manager (portfolio command center), CloudPortfolio.Operations (observability, monitoring, onboarding), CloudPortfolio.Orchestrator (master-of-masters coordination), with shared Identity and Security layers. Built on .NET Aspire with Azure Container Apps and KEDA autoscaling.
StephenDThomas.com
This resume site — a multi-cloud deployed interactive platform built with Next.js 16, Three.js globe rendering, region-aware theming based on visitor geolocation, Private State Token bot protection, and Cloudflare Pages edge functions. Deployed across Cloudflare Pages, AWS S3+CloudFront, and Firebase Hosting simultaneously.
VisitCharlesNThomas.com
Personal project for my son Charles — a custom-built website designed and developed from scratch. Built to teach the next generation that infrastructure is built, not bought, and that every great technologist starts with a first project.
VisitNotable Projects
Platforms, tools, and systems built from scratch
Automated Server Build-Outs with Automatic VM Creation
Automated server provisioning with automatic virtual machine creation in highly available networks. Multiple backup methods based on budget tiers.
Exchange Migration Suite (2003 → 2010 → 2013 → O365)
Complete Exchange migration pipeline from Exchange 2003 through 2010, 2013, and Office 365. Included Active Directory upgrades, GAL upgrades, mailbox migrations of 10,000+ mail stores, public folder migration and retirement.
Farallon AI Assistant
First internal AI chat system for the firm. Built from scratch to provide AI-powered assistance to employees.
Fusion Nexus — Cloud Management Platform
Full cloud management platform providing observability, monitoring, and operational oversight across multi-cloud infrastructure.
Fusion Forge — Project Management Platform
Replacement for Jira built to match the specific workflows and requirements of the organization. Full project management, tracking, and collaboration.
Skills & Expertise
63+ endorsed skills across cloud, security, AI, and development
Cloud Platforms
Infrastructure as Code
Identity & Security
Networking
Containers & Orchestration
AI & Machine Learning
Development
Virtualization
Cloud Computing
Recommendations
19 received on LinkedIn — here are a few
“Steve was one of the nicest IT people I ever worked with: he was always happy to help, patient, smiling and professional. We collaborated on many in house projects to promote some of our products (marketing and training tools) and he showed great initiative, ideas, quality and fast delivery from start to finish. As a product manager he was a great asset to my work; I really enjoyed working with Steve and would recommend him for any position.”
“Steven is a remarkably dedicated individual with a wealth of experience and a huge passion for cloud based infrastructure and web development. He's always keen to improve and has a great work ethic. He was my web based wing man at Imagine IT.”
“Steve demonstrated a unique balance of organization and creativity to provide specialized IT solutions for our team. He listened to our needs and provided a variety of ideas with our desired outcome in mind. He showed a great amount of skill and know how with building a variety of web based programs and solutions.”
“I would highly recommend Steve. He has always worked very hard both personally and professionally. He is very detailed and continues to prove no challenge is too difficult.”
Let's Connect
Have a project in mind or want to discuss cloud architecture?