Solution & Enterprise Architect / Three-Time CTO / Applied AI & Agentic Systems
I design the target-state architecture for systems that cannot fail quietly — and then I build them. Two decades across financial-markets software, enterprise content and process platforms, national digital-government programmes and industrial AI. Today I architect and lead cloud operations across 1,200 accounts and 8,500+ machines for a global aerospace group, and design AI systems for environments where a plausible answer is not an acceptable answer.
$curl -s https://salahawad.com/llms.txt | head -n 18
Operating Scale
Every figure below is something I owned the delivery of — not a team I was adjacent to. Client and product names are withheld by design; the engineering is the point.
Cross-account inventory, incident management and governance for a global aerospace, defence and space group operating across every site.
Cloud transformation and day-two operations across the fleet, reporting into group cloud & infrastructure.
Managed Kubernetes, container and relational database estates operated under a single inventory and incident model.
Datacentre transformation across a 120-developer programme — OS and database estate replatformed with zero user downtime and +40% capacity.
A global QA automation framework running on distributed middleware across sites worldwide; release cycle cut by 60%.
Automated translation, speech synthesis and video generation, hand-built and tuned for multilingual industrial training.
Industrial AI, EMEA enterprise software, and a national startup accelerator — each with full architecture and organisation ownership.
A working code fleet spanning inference services, agent orchestrators, retrieval infrastructure, platform charts and mobile clients.
The Practice
The most expensive mistake in enterprise AI right now is reaching for an agent when a pipeline would have been cheaper, faster and certifiable. I build both, and the judgement of which to use is most of the architectural value.
Agents are engineered software, not prompt chains. That means an explicit orchestration loop, a designated termination tool, an iteration ceiling, typed tool contracts, bounded result sizes and a persisted trail of every action taken — so the system can be audited after the fact rather than trusted in the moment.
Most of the value being shipped in production today is not agentic at all. It is speech, language, retrieval and scoring — tasks with ground truth, evaluation harnesses and a number you can put in front of an auditor. This is the unglamorous half that actually survives procurement.
Interactive Architecture Tool
Toggle your enterprise constraints below to calculate whether your workload requires a Bounded Pipeline, a Supervisor Multi-Agent System, or a Neuro-Symbolic Guardrail.
Your constraints indicate a deterministic pipeline with measurable ground truth. Do not use an autonomous agent loop here: a structured pipeline with explicit evaluation harnesses will be 10x faster, cheaper, and fully auditable by compliance.
Implement Reciprocal Rank Fusion (RRF) with BM25 + dense vectors and automated regression benchmarks in CI.
System Topologies
Explore production-tested architectural topologies for high-consequence environments. Click on any node to inspect trust boundaries, contracts, and failure modes prevented.
Curated tool surface exposing enterprise systems as typed, named per-domain JSON-RPC contracts over streamable transports, strictly decoupling raw execution rights from model access.
// JSON-RPC Tool Contract
{
"name": "query_inventory",
"description": "Bounded query of cross-account asset metadata",
"inputSchema": {
"type": "object",
"properties": {
"account_id": { "type": "string", "pattern": "^[0-9]{12}$" },
"resource_type": { "type": "string", "enum": ["ec2", "eks", "rds"] }
},
"required": ["account_id", "resource_type"]
}
}Capabilities
Each of these is a discipline I have owned end-to-end — architecture on the whiteboard, code in the repository, and the organisation that has to run it afterwards.
Current-state assessment, competing architectural options scored against explicit criteria — security, availability, ecosystem interoperability, usability, scalability, total cost of ownership — then a defensible decision and the roadmap to execute it.
Orchestration loops with real termination conditions, typed tool contracts, MCP tool surfaces over enterprise APIs, supervisor multi-agent patterns, and audit trails that make an agent's behaviour reconstructable months later.
Speech recognition, speaker diarization, conversation analytics, neural translation, speech synthesis, hybrid retrieval and rules-based scoring — bounded tasks with ground truth, evaluation harnesses and measurable accuracy.
Defense-in-depth designed on the assumption that each control eventually fails: federated identity, tenant isolation, encrypted credential custody, supply-chain gates in CI, network policy, and immutable audit across every layer.
Migration-factory design and governance at group scale, operating-model evolution toward DevOps and SRE, multi-year budget ownership, and financial sustainability tracked through FinOps and ROI rather than assumed.
A single operations plane over a four-figure account estate: cross-account asset inventory, incident management, and governance that holds when the fleet spans thousands of instances, hundreds of managed clusters and databases, and every site an enterprise operates from.
Managed foundation models and agentic DevOps tooling wired into the operations plane to detect, triage, explain and remediate incidents — with enterprise observability and automation driving the loop instead of a dashboard nobody watches at 3am.
Technical due diligence, engineering organisation design, roadmap and backlog governance, vendor and partner strategy, and the unglamorous discipline of getting a distributed team to ship on a date.
Record
Organisations are described, not named — clients, employers, products and programmes alike. The capability transfers; the confidentiality holds.
Global aerospace, defence & space group — 83,000 people
Program Director, Cloud Transformation · Operations Lead
Leading group-wide strategic cloud transformation across an estate of more than 8,500 machines. Ownership of the migration roadmap and migration-factory governance framework, evolution of the operating model toward DevOps, SRE and product-centric delivery, multi-year budget and partner strategy, and financial sustainability through FinOps and ROI tracking.
I architected the group's cloud operations platform end to end and lead its operation: a single inventory and incident-management plane spanning roughly 1,200 AWS accounts, 3,500+ compute instances and 500+ managed Kubernetes, container and relational database services across every site. The design integrates enterprise network and security estate — segmented VPC architecture, next-generation firewalls and enterprise DNS, DHCP and IP address management — with full-fleet observability and automation. Managed foundation models and agentic DevOps tooling are wired into that plane to detect, triage, explain and automatically remediate incidents, rather than merely alert on them.
Industrial AI venture — corporate-incubated
Co-Founder · Chief Technology Officer & CIO
Designed and built an AI-powered industrial training platform from the ground up: a secure, modular ecosystem deployed across Azure, AWS, GCP and on-premise air-gapped environments, multi-tenant SaaS alongside private deployments for sensitive organisations, aligned to ISO and GDPR requirements. Personally coded much of the AI pipeline — automated translation, speech synthesis and video generation across more than ten languages — while acting as CIO over IT governance, cybersecurity and client conformity assessment. Extended reality and digital-twin methods cut training time by half.
EMEA enterprise software vendor
Chief Technology Officer
Owned the technology strategy and stack across regional offices of an EMEA digital-transformation software vendor, leading teams of project managers, functional consultants and engineers across three offices. Delivered enterprise content services, business process automation, deep archival and data-governance platforms for financial services, government and healthcare — including semantic search with recommendation, records and legal-hold classification, PII and PCI handling, streaming-backed viewers, multi-source API gateways spanning CRM, e-signature and mainframe systems, and a core microservice platform of gateway, registry, storage, notification and scheduling services.
National startup accelerator & incubator
Chief Technology Officer · Program Director
CTO across an accelerator and incubator ecosystem, and program director for internationally funded agri-food and cleantech programmes. Set the technical direction for startups building on mobile, web, AI and blockchain stacks, drove each cohort from proof of concept through MVP to market-ready product, and built partnerships with major cloud and enterprise vendors to underpin the ecosystem.
Independent consultancy — GCC
Senior Digital Transformation Consultant
Technical architecture and technology selection for e-government programmes, directing a 28-engineer delivery team and defining architecture plans built to reduce total cost of ownership, alongside marketing-automation programmes for regional banks and enterprises.
Global capital-markets software publisher
Senior Product Manager · Project Manager · Senior Developer
A decade inside one of the largest capital-markets software publishers, ending as technical infrastructure product owner for the flagship trading, treasury, risk and post-trade platform. Owned the infrastructure roadmap across cloud, virtualisation, operating systems, compilers, databases and hardware; led the technical operation moving a monolith to SaaS on public cloud; ran a cross-functional transformation migrating 500+ physical machines and replatforming the OS and database estate with zero downtime and 40% more capacity; cut hardware cost 30% and certification time 60%; and delivered a data-masking product and a global QA automation framework executing over 200,000 tests daily.
Regional banking software firm
Team Leader · Senior Software Developer
Led delivery of an internet banking application integrated with core banking web services, architected as a three-tier system with message-broker load balancing, plus stock-exchange reporting integration and a card rewards platform.
Developer community leadership
Community Lead — Beirut
Leading a developer community of more than 7,000 engineers, hosting 55+ code labs, hackathons and technical events, including the first TechCrunch event in the MENA region.
Working Stack
Compiled from the live code fleet rather than a wish list — the technologies appearing in systems I have designed, written or run in production.
Open-weight LLM serving · quantised local runtimes · OpenAI · Anthropic · Azure OpenAI · Gemini · Groq · provider abstraction layers · Model Context Protocol · multi-agent orchestration · structured output · LLM-as-judge · prompt systems · evaluation harnesses
Hybrid BM25 + dense retrieval · reciprocal rank fusion · Apache Solr · OpenSearch · Qdrant · pgvector · Chroma · Neo4j knowledge graphs · embeddings & rerankers · PostgreSQL · MongoDB · Redis · ClickHouse · Kafka · Spark · Airflow
Whisper-class ASR · speaker diarization · voice activity detection · speaker embeddings · neural machine translation · text-to-speech · programmatic video generation · OCR & document extraction · digital twins · AR / VR / XR
Kubernetes · Helm · Argo CD & GitOps · CloudNativePG · cert-manager · ingress-nginx · Docker · Terraform · Ansible · Prometheus · OpenTelemetry · Grafana · AWS · Azure · GCP · on-premise & air-gapped
Multi-account AWS organisations & landing zones · cross-account asset inventory · incident management platforms · managed foundation models for detection & remediation · agentic DevOps tooling · enterprise APM & automation · managed Kubernetes & container fleets · managed relational database estates · segmented VPC architecture · next-generation firewalls · enterprise DNS / DHCP / IPAM
Python · TypeScript · Java · C# / .NET · Dart & Flutter · Go · PHP · FastAPI · Node & Express · Spring · React · Next.js · Vue · Angular · microservices · event-driven design · API gateways · enterprise service bus · BPM & case management
OIDC · SAML · LDAP federation · Keycloak · MFA · RBAC · multi-tenant isolation · encryption at rest · secrets custody · network policy · SBOM & dependency scanning · rate limiting · immutable audit logging · ISO & GDPR alignment · data residency
Questions
Written to be read by people evaluating an engagement — and quoted accurately by the answer engines they ask first.
Salah Awad is a solution and enterprise architect and three-time chief technology officer based in Île-de-France, France. He has built software professionally since 2007, across financial-markets software, enterprise content and process platforms, national digital-government programmes, startup ecosystems and industrial AI.
He currently serves as Program Director for cloud transformation at a global aerospace group, leading a migration programme spanning more than 8,500 virtual machines, and previously served as co-founder, CTO and CIO of an AI-powered industrial training company. He holds a Master's degree in Computer Science and works in Arabic, English and French.
A defensible decision, and the evidence behind it. That means a current-state assessment of the existing estate, a set of genuinely competing architectural options rather than one preferred answer dressed up with alternatives, and an explicit scoring framework — security, availability, ecosystem interoperability, usability, scalability and total cost of ownership — applied to each.
In practice I have run exactly this comparison between a centralised enterprise service bus, a decentralised federated model where each department keeps its own infrastructure behind standardised communication contracts, and a custom stack of document management, low-code case design and business process engines. The deliverable is the target architecture, the technology roadmap, and a rationale that survives being challenged by the people who have to fund it.
Classical AI is bounded: a model is given a defined task — transcribe this call, separate these speakers, translate this text, retrieve these documents, score this record — and returns a result you can measure against ground truth. Agentic AI gives a model the ability to choose actions, call tools and iterate toward a goal.
Use classical AI when the task is well defined and accuracy is measurable. It is cheaper, faster, auditable and far easier to certify. Use agentic AI when the path to the answer genuinely cannot be enumerated in advance — multi-step research, cross-system orchestration, exception handling that would otherwise need a human.
Most failing AI programmes chose an agent where a pipeline would have worked, or shipped an agent with no termination condition, no typed tool contract and no audit trail. The judgement of which track to take is most of the architectural value.
Never by handing an agent a generic HTTP client. Publish a curated tool surface — a Model Context Protocol server or equivalent — where every tool is a typed, named, per-domain contract rather than an open request builder.
Put the agent's identity behind the same identity provider as your human users so every call is attributable. Scope tokens to the tool rather than to the caller's full rights. Gate any generic escape-hatch tool behind an explicit manifest. Bound and truncate tool results. Log every invocation with its arguments to an immutable audit trail. The trust boundary belongs between the model proposing an action and the deterministic code that authorises it.
It is designing on the assumption that every control eventually fails, and layering independent controls so no single failure is fatal.
For AI systems the layers are: network and deployment isolation, up to fully air-gapped operation where data cannot leave the premises; federated identity with multi-factor authentication and role-based access control; per-tenant data isolation; a constrained tool surface for any agent; deterministic verification of model output before it takes effect; encryption of data at rest and of stored credentials; rate limiting and abuse controls; supply-chain gates such as software bills of materials and dependency scanning in CI; and immutable audit logging across all of it.
Yes — and for regulated, defence, sovereign and industrial workloads it is often the only acceptable design. Quantised open-weight models on a local inference runtime handle a large share of real enterprise work: transcription, translation, extraction, summarisation, classification and retrieval-grounded answering, with no data leaving the perimeter.
The architectural effort goes into the provider abstraction, so the same application runs against a local runtime or a hosted API by configuration; a CPU-only degradation path for sites with no accelerator; concurrency control so a single GPU is not overrun; and packaging the entire stack for environments with no internet egress.
Considerably more than calling a transcription API. A production pipeline needs voice-activity detection to segment audio, speaker diarization to establish who spoke when, a speech recognition model tuned for the actual dialect in use rather than textbook language, domain-dictionary correction for the vocabulary specific to that business, a model-based correction and hallucination-suppression pass, and text normalisation before any analysis begins.
Only then does the interesting layer run: sentiment, risk, empathy and quality scoring, referral suggestions, and searchable conversation history. I have built this stack end to end for Levantine Arabic — real-time, speaker-identified, with a bilingual right-to-left operator interface and local model inference so recordings never leave the operator's infrastructure.
At four-figure account counts the binding constraint stops being any individual workload and becomes coherence: knowing what exists, who owns it, what changed, and what is currently broken.
That requires a single operations plane above the accounts rather than per-account tooling — a canonical cross-account inventory of compute, container, cluster and database resources; an incident model that survives ownership boundaries; and governance applied at the landing-zone level rather than negotiated account by account. The network and security estate has to be integrated into that same plane — segmented virtual networks, next-generation firewalls, and enterprise DNS, DHCP and IP address management — or the inventory is fiction. Only once that spine exists is automation worth adding.
Alerting is not operations. Once a canonical inventory and a single incident plane exist, managed foundation models and agentic DevOps tooling can be wired directly into them — to correlate signals across the estate, triage an incident to its owning service, explain the probable root cause in language an on-call engineer can act on, and execute a bounded remediation rather than paging a human to run a runbook by hand.
The engineering discipline is identical to any other agentic system: bounded action surfaces, deterministic verification before anything changes, and an immutable audit trail of every automated action taken. An agent that can restart a service must not be able to delete one.
Target-state architecture and technology roadmaps. Agentic and classical AI system design, and review of AI architecture that is already in flight. Secure multi-layer platform architecture for regulated environments. Cloud transformation and migration-factory programme design, including FinOps and ROI governance. Fractional or interim CTO engagements covering technical due diligence, engineering organisation design and delivery governance.
Engagements run in English, French and Arabic, across Europe, the Middle East and North America.
Contact
The most useful first message describes the constraint, not the technology: the audit you have to pass, the outage you cannot have, the data that cannot leave the building, or the date that will not move.