Yawer Hussain
Hameedi

Challenge

Loop Saudi's on-premises infrastructure was approaching end-of-life on multiple compute and storage arrays, and the SAMA-licensed payment platform was growing faster than the datacenter could scale. The challenge was migrating production workloads to Google Cloud Platform without a single minute of downtime — the payment platform processes transactions 24×7 and any interruption would trigger regulatory escalation and merchant SLA penalties. Additionally, all data residency, encryption, and access-control controls had to meet SAMA CSF and SAMA CRFR requirements, which meant the landing zone architecture had to be designed for sovereign-data compliance from day one, not bolted on after migration.

Solution & Architecture

Designed a GCP landing zone with VPC Service Controls perimeter, centralized logging via Cloud Logging with export to BigQuery for long-term retention, and Cloud KMS for customer-managed encryption keys (CMEK) on all persistent disks and Cloud SQL instances. The migration used a phased lift-and-shift approach: Phase 1 moved non-production workloads to validate network connectivity, DNS resolution, and firewall rules; Phase 2 moved production databases using Database Migration Service with continuous replication; Phase 3 cut over application tiers during a 4-hour maintenance window with full rollback playbooks. Identity was federated via Cloud Identity with conditional-access policies enforcing MFA and IP allowlisting. All network traffic between on-prem and GCP used Cloud VPN with BGP routing for sub-second failover.

Results

All production workloads migrated to GCP in under 3 months with zero downtime and zero rollback events. The payment platform processed transactions throughout the cutover window without a single failed transaction. Post-migration, infrastructure run-rate was reduced 22% through committed-use discounts and right-sizing, and the platform passed SAMA CSF audit on the first attempt with zero critical findings. Scalability improved from weeks-to-provision to minutes-to-provision for new environments.

Challenge

Loop Saudi needed a production-grade on-premises infrastructure to support its SAMA-licensed payment platform before cloud migration was an option. The challenge was building a complete compute, storage, network, and security stack from scratch — with no existing datacenter, no legacy infrastructure to reference, and a regulatory deadline tied to the SAMA licensing timeline. Every component had to meet SAMA CSF and SAMA CRFR controls for access management, encryption, logging, and resilience, and the entire stack had to be operational within 10 months to avoid licensing delays.

Solution & Architecture

Designed and deployed a full HPE compute and storage stack (HPE ProLiant servers, HPE Nimble / 3PAR storage) with HPE GreenLake flexible-capacity management for elastic resource allocation. Network core used HPE Aruba switching with SonicWall NSA-series next-generation firewalls for perimeter security, deep packet inspection, and SSL VPN for remote access. Storage was configured with synchronous replication to a secondary site for DR readiness. All systems were integrated into a centralized logging pipeline (syslog → SIEM) and monitored via HPE InfoSight for predictive analytics. Identity management used Active Directory with tiered administrative access and just-in-time privilege elevation.

Results

Full on-premises production stack operational in 10 months, enabling Loop Saudi to meet its SAMA licensing deadline. The infrastructure supported the payment platform from go-live through the subsequent GCP migration with zero unplanned outages. HPE GreenLake's pay-per-use model reduced initial CAPEX by approximately 30% compared to traditional procurement, and SonicWall's threat intelligence feed blocked 12,000+ intrusion attempts in the first 6 months of operation.

Challenge

Loop Saudi's production datacenter was hosted at DetaSad, a third-party provider whose facility was approaching capacity limits and whose cooling and power redundancy didn't meet the company's growing SLA requirements. The challenge was migrating all production racks, network infrastructure, and storage arrays to a new colocation facility without disrupting the 24×7 payment platform — and doing it within a 5-month window before the DetaSad contract expired. Physical server migrations carry unique risks: cable labeling errors, power sequencing issues, and cooling capacity mismatches can cause hours of unplanned downtime if not planned meticulously.

Solution & Architecture

Designed a phased migration using HPE GreenLake as the underlying flexible-capacity platform at the new colocation. Phase 1 provisioned the new facility: power, cooling, rack layout, network backbone, and firewall configuration. Phase 2 replicated storage synchronously between DetaSad and the new site using HPE storage replication. Phase 3 migrated VMs in waves during weekend maintenance windows, with each wave validated by automated health checks before proceeding. Network connectivity was maintained via dual-path MPLS during the transition, with DNS TTLs lowered to 60 seconds for rapid failback if needed. All physical cable runs at the new site were labeled to TIA-606-C standard and certified with Fluke cable testers.

Results

Complete datacenter migration from DetaSad to company colocation facility delivered in 5 months with zero unplanned downtime. The HPE GreenLake flexible-capacity model allowed Loop Saudi to start with 60% of the contracted capacity and scale up as workloads migrated, avoiding over-provisioning during the transition. Post-migration, datacenter PUE improved from 2.1 to 1.6 due to the new facility's efficient cooling design.

Challenge

Al Rajhi Bank operates multiple subsidiaries — Al Rajhi Capital, Emkan, Tawtheeq, Neoleap, Tanfeeth, and Regional Offices — each with distinct IT infrastructure needs, regulatory requirements, and growth trajectories. The challenge was serving as the single point of contact (SPOC) for IT Infrastructure across all subsidiaries, each at different stages of maturity. Some needed greenfield infrastructure builds; others needed network segmentation from the parent bank for regulatory isolation; others needed cloud readiness assessments. Managing 5+ concurrent programs across 5+ subsidiaries required a governance framework that could scale without bottlenecking decision-making.

Solution & Architecture

Built a lightweight IT SPOC governance model: each subsidiary had a designated IT lead as the local interface, while I owned the infrastructure architecture, vendor management, and cross-subsidiary standardization. For each program, I established a RACI matrix, a shared risk register, and a monthly steering committee with subsidiary CEOs. Infrastructure patterns were standardized across subsidiaries (common network design, common DR topology, common monitoring stack) while allowing subsidiary-specific customizations for regulatory requirements. Vendor contracts were consolidated at the group level to leverage Al Rajhi's buying power, with subsidiary-specific SLAs layered on top.

Results

5+ programs accomplished and in-production across subsidiaries, including infrastructure builds for new subsidiaries, network segmentation for regulatory compliance, and cloud-readiness assessments for digital transformation initiatives. The SPOC model reduced average program delivery time by 30% compared to the previous ad-hoc approach, and consolidated vendor contracts saved approximately SAR 4M annually through group-level negotiation.

Challenge

Al Rajhi Bank was constructing a new datacenter to support its growing digital banking operations. The challenge was implementing the full IT infrastructure stack — power distribution, cooling, network backbone, server racks, storage arrays, security systems, and monitoring — in a facility being built simultaneously by the Mega Projects construction team. IT infrastructure had to be ready for commissioning the moment the building was handed over, with zero tolerance for delay since the bank's core operations depended on the new facility going live on schedule.

Solution & Architecture

Coordinated with the Mega Projects construction team to ensure power, cooling, and physical security requirements were designed into the building from the blueprint stage. The IT infrastructure stack included: dual-path power distribution with UPS and generator backup, hot-aisle/cold-aisle containment cooling, a network core built on Cisco Nexus switching with 10G/40G uplinks, HPE server racks with integrated KVM and remote management, and a full BMS (Building Management System) for environmental monitoring. All infrastructure was designed to TIA-942 Rated-3 standards with concurrent maintainability, meaning any single component could be serviced without impacting operations.

Results

Datacenter infrastructure was commissioned on schedule, enabling the bank to migrate production workloads from legacy facilities. The facility achieved TIA-942 Rated-3 certification and passed SAMA CSF audit on the first attempt. The concurrent-maintainability design proved its value during a subsequent cooling system upgrade — the maintenance was performed with zero impact on production services.

Challenge

Al Rajhi Bank's new HQ Tower and Operations & IT Center campuses were large concrete-and-steel structures that blocked cellular signals, leaving employees and visiting executives with no mobile coverage inside the buildings. For a bank where executives rely on mobile calls for time-sensitive trading decisions and where SMS OTP is used for two-factor authentication, dead zones were unacceptable. The challenge was deploying a GSM In-Building Solution (IBS) across two large campus buildings — including structured cabling, distributed antenna systems (DAS), and base-station integration — while the buildings were still under final-fit construction.

Solution & Architecture

Designed a multi-operator DAS (Distributed Antenna System) supporting STC, Mobily, and Zain simultaneously, fed by operator base stations located in dedicated telecom rooms on each campus. The DAS used a hybrid of active and passive components: passive coaxial distribution for smaller zones, active optical DAS for long runs and high-density areas like the trading floor and auditorium. Structured cabling (Cat 6A) was installed concurrently to support both the IBS monitoring system and future Wi-Fi infrastructure. All antenna placements were modeled using iBwave design software to ensure coverage uniformity with less than 3 dB variance across all zones.

Results

Full GSM coverage delivered across both campuses, with all three major Saudi operators active on day one of building occupancy. Coverage testing showed 100% of occupied spaces achieving signal strength above -85 dBm, well above the -95 dBm threshold for reliable voice and data. The multi-operator DAS design meant the bank wasn't locked into a single carrier — executives could use any network without coverage gaps.

Challenge

Al Rajhi Bank was consolidating its operations into the newly constructed HQ Tower, requiring the relocation of 4,000+ staff and consultants from multiple legacy buildings across Riyadh. This wasn't just a physical move — it was an IT infrastructure challenge. Every employee needed their VDI endpoint, network connectivity, phone extension, printer access, and physical desk setup ready on day one at the new location. A single missed desk, failed phone, or non-functional VDI session would cascade into productivity loss measured in thousands of hours across 4,000+ staff.

Solution & Architecture

Designed a wave-based relocation schedule: staff were moved in groups of 200–400 per wave, with each wave preceded by a full IT readiness check (VDI endpoint tested, phone extension verified, network port activated, printer mapped). A dedicated 'move command center' was established with real-time dashboards showing the status of every desk in the new building. IT runbooks were created for common post-move issues (VDI login failures, phone registration issues, printer mapping errors) with a 15-minute SLA for resolution. The relocation program ran in parallel with the VDI ThinClient installation project, requiring tight dependency management between the two workstreams.

Results

4,000+ staff and consultants successfully relocated over 12 months with zero lost productivity days. On the first business day after each wave, 98% of relocated staff had fully functional IT — the remaining 2% were resolved within the first 2 hours via the move command center. The wave-based approach, combined with real-time dashboards, became the template for subsequent bank-wide relocations.

Challenge

Al Rajhi Bank was replacing its legacy desktop fleet with 4,000+ VDI ThinClient endpoints as part of the HQ Tower relocation. The challenge was deploying, configuring, and validating 4,000+ endpoints across multiple floors and buildings — each needing network connectivity, VDI broker registration, peripheral mapping (printers, scanners, dual monitors), and user-profile assignment. The deployment had to run in parallel with the building construction and the staff relocation program, meaning endpoints were being installed in spaces that were still being finished by contractors.

Solution & Architecture

Designed a factory-model deployment: ThinClient endpoints were pre-configured in a staging area with standard image, VDI broker registration, and baseline peripheral profiles before being deployed to desks. Each endpoint was labeled with a QR code linking to its configuration record, enabling rapid troubleshooting via mobile scanning. The VDI backend used persistent desktops with user-profile disks (UPD) for personalization, connected via 10G network backbone to ensure sub-50ms latency. Automated health-check scripts validated each endpoint post-installation: network connectivity, VDI login test, display detection, and peripheral mapping.

Results

All 4,000+ VDI ThinClient endpoints deployed, configured, and validated ahead of the staff relocation schedule. The factory-model approach reduced per-endpoint installation time from 45 minutes to 12 minutes, and the QR-code-based tracking system reduced misconfiguration incidents by 80% compared to the legacy manual process. Post-deployment, the VDI environment achieved 99.9% availability for user sessions.

Challenge

Al Rajhi Bank's new HQ Tower and Operations & IT Center campuses required enterprise-grade Wi-Fi coverage across all floors, meeting rooms, auditoriums, and common areas. The challenge was deploying 122+ Wireless Access Points in a building still under construction, with coverage requirements that included high-density zones (trading floors, auditoriums with 500+ concurrent users) and secure zones (executive floors with enhanced authentication). Additionally, all wireless traffic had to be segmented from the wired production network to meet SAMA CSF network-segmentation controls.

Solution & Architecture

Designed a Cisco wireless network with 122+ lightweight APs managed by a centralized Wireless LAN Controller (WLC). Coverage was modeled using Ekahau Pro site-survey software, with predictive heat maps for each floor type (open office, enclosed office, auditorium, trading floor). High-density zones used APs in dense clusters with load-balancing and band-steering; secure zones used 802.1X authentication with RADIUS integration against Active Directory. All wireless traffic was tunneled via CAPWAP to the WLC, which enforced ACLs segregating wireless VLANs from production wired VLANs. Structured cabling (Cat 6A) was installed concurrently to support both the APs and future network expansion.

Results

122+ Wireless Access Points deployed across both campuses with coverage validated via post-installation site surveys. All occupied spaces achieved signal strength above -67 dBm (excellent for voice/video), and high-density zones supported 500+ concurrent users without degradation. The network-segmentation design passed SAMA CSF audit with zero findings on wireless controls.

Challenge

Cybernet, one of Pakistan's largest ISPs, operated a state-of-the-art datacenter that had been built in the early 2000s. While functional, it no longer met TIA-942 industry standards for redundancy, cooling efficiency, or cable management — and increasingly demanding enterprise customers were asking for tier-rating certifications before signing colocation contracts. The challenge was upgrading a live, 24×7 production datacenter to TIA-942 standards without disrupting any of the hosted services. This meant working in an active facility with live power, live cooling, and live network — every modification had to be planned and executed with zero impact on production.

Solution & Architecture

Led the full upgrade program: design specification, construction, commissioning, and integration of existing datacenter products. The upgrade included: dual-path power distribution with redundant UPS and generator backup, hot-aisle/cold-aisle containment for cooling efficiency, cable management system upgrade to TIA-606-C labeling standard, environmental monitoring (temperature, humidity, water leak detection) with SNMP integration to the NOC, and physical security upgrades (biometric access, CCTV with 90-day retention). Worked with the financial department to develop the capital budget and coordinated with procurement to ensure on-time delivery of all components, managing a 15+ vendor ecosystem through the 18-month program.

Results

Datacenter upgraded to TIA-942 Rated-3 standards, enabling Cybernet to win enterprise colocation contracts that required tier certification. Post-upgrade, PUE improved from 2.4 to 1.8 (25% energy savings), cooling capacity increased by 40% (enabling higher rack density), and the facility passed independent TIA-942 audit with zero findings. The project was delivered on budget and on schedule despite the complexity of working in a live production environment.

Challenge

Cybernet operated 44 managed and unmanaged sites across Pakistan — from major city POPs to remote regional locations. Each site had network devices (routers, switches, access servers) that were managed individually, often requiring on-site visits for even basic troubleshooting. The NOC had no centralized visibility — if a site went down, the NOC often learned about it from customer complaints rather than monitoring alerts. The challenge was designing and deploying a centralized NOC monitoring and management platform that could give real-time visibility into all 44 sites from a single console, enabling proactive detection and remote troubleshooting.

Solution & Architecture

Designed a centralized NOC platform using SNMP-based monitoring (SNMPC) with a tiered architecture: regional aggregation routers collected SNMP data from site devices and forwarded it to the central NOC via existing WAN links. The central platform used open-source monitoring (Nagios + Cacti for trending) with custom alerting rules that suppressed flapping and correlated events to reduce alert fatigue. Secure shell (SSH) access was tunneled through the central platform, enabling NOC engineers to troubleshoot any device at any site without requiring site visits. The design accounted for low-bandwidth links to remote sites, using SNMP polling intervals tuned to link capacity.

Results

All 44 sites integrated into the centralized NOC platform, giving real-time visibility into device status, interface utilization, and service health across the entire national network. Mean-time-to-detect (MTTD) for site outages dropped from 30+ minutes (customer-reported) to under 2 minutes (alert-triggered). Remote troubleshooting via SSH eliminated 70% of on-site visits, reducing operational costs and accelerating fault resolution. The NOC team shifted from reactive fire-fighting to proactive monitoring — anticipating capacity bottlenecks before they became outages.

Challenge

Lakson Group, one of Pakistan's largest conglomerates, had a three-building office complex housing multiple group companies including Cybernet. Each building had its own network switches and devices, but there was no centralized visibility — the IT team had no real-time view of switch health, link utilization, or device status across the complex. When a network issue occurred, troubleshooting meant physically visiting each building's telecom room to check device status. The challenge was creating end-to-end network visibility across all three buildings with 24/7 monitoring, centralized logging, and automated alerting — all within a tight budget and scope.

Solution & Architecture

Designed and deployed a network monitoring and management platform spanning all three buildings. The architecture used SNMPC (Simple Network Management Protocol for C) as the polling protocol, with each building's switches configured as SNMP agents reporting to a central management server. Centralized syslog servers collected event logs from all network devices, enabling correlation and historical analysis. A 24/7 monitoring console was established in the Cybernet NOC with a dedicated dashboard showing real-time status of all switches and devices across the complex. Alerting rules were configured for critical events (link down, interface errors, CPU thresholds) with escalation to on-call engineers via SMS.

Results

Complete network visibility delivered across the three-building Lakson Group complex. The 24/7 monitoring and management capability reduced average fault-detection time from hours (manual discovery) to minutes (automated alerting), and centralized logging enabled root-cause analysis that was previously impossible. The project became the reference architecture for Cybernet's managed-network-services offering to other enterprise clients, generating new revenue streams for the company.