I’m a Senior Cloud Security Engineer, security researcher, Microsoft MVP in Security: Identity & Access, and long-time infrastructure engineer with a habit of pulling on weird threads until they become blog posts, tools, or threat models.

I work across cloud security, identity, Conditional Access, Microsoft Entra ID, Intune, Azure, Google Cloud, and the messy edges where platforms, assumptions, and attackers meet.

I’m especially interested in:

• Cloud and identity security
• Microsoft Entra ID, Conditional Access, and Intune abuse paths
• Secure-by-design cloud architecture
• Detection engineering and threat hunting
• SaaS and platform abuse research
• Agentic software development and AI-assisted engineering governance
• Turning hard-won lessons into reusable tools, models, and write-ups

I publish research, technical notes, and occasional security-shaped chaos at:

https://cirriustech.co.uk

Some of my work explores topics like cloud identity anti-patterns, Conditional Access design, Intune abuse, SaaS-hosted exfiltration, AI-assisted development workflows, and practical ways to make security controls less imaginary.

I also build tooling and experiments around these ideas, including projects related to cloud security research, AI-assisted development governance, and security operations.

Right now I’m spending time on:

• Microsoft Entra ID and Conditional Access attack/defence models
• Intune and device-trust research
• AI-assisted development lifecycle governance
• Cloud identity misconfigurations and abuse patterns
• Practical security automation that survives contact with production

I’m always interested in thoughtful collaboration around cloud security, identity, detection, research, and tooling - especially where there’s a weird edge case, a dangerous assumption, or a control that works beautifully in a diagram and less beautifully in prod.

• Email: graham@cirriustech.co.uk
• Blog: cirriustech.co.uk
• Mastodon: infosec.exchange/@cirriustech
• Ko-fi: Buy me a coffee

Assumptions have teeth. Identity is infrastructure. “Works in prod” is both a status and a threat model.