Principal Solutions Architect

Michael Stavridis

Sales Engineering · Cloud Identity Security · Zero Standing Privilege

Sales engineer and solutions architect specializing in cloud identity security. I help Fortune 500 teams eliminate standing privilege, enforcing least-privilege and just-enough access across human, non-human (NHI), and agentic-AI identities through just-in-time authorization. I win the technical evaluation with demos, proofs of value, RFP/RFI responses, and custom integrations.

◆ Wesley Chapel, Florida  ·  open to Principal and Staff solutions-architect and sales-engineering roles

Michael Stavridis, Principal Solutions Architect
Currently @ P0 Security

Profile

I sell the technical win, and I can build the thing I'm selling.

Principal Solutions Architect and sales engineer with more than 20 years in enterprise IT and cloud across AWS, Azure, and GCP, focused on cloud identity, continuous authorization, and least-privilege. Reporting to the VP of Sales Engineering, I own the technical strategy: architecting demos, creating RFP/RFI responses, running proofs of value, building client integrations, and working directly with accounts like Splunk, Wells Fargo, PayPal, P&G, and CNA Insurance, then turning what those customers need into product. I stay hands-on: cloud engineering, scripting, full-stack coding, and CI/CD. On the side I ship real systems: Nostalgia Lab, a non-profit retro-game platform built to production standards on GCP and Cloudflare, and OpenMW, a full 3D game engine I cross-compiled to run in the browser. It is the same identity, cloud, and engineering skill set I sell, kept sharp in code.

the trade

Sales engineering

Technical strategy, demo architecture, proofs of value, RFP/RFI, and client integrations that close, turning complex cloud-identity requirements into deals and into product.

the edge

Development & Architecture

Hands-on engineering across the stack: cloud architecture, CI/CD, and full-stack development. I design the systems and write the code, so a demo is never more than one commit away from something real.

Experience

Two decades, from the network closet to the control plane

Selected roles from a 20+ year career. Named clients are real engagements; the numbers are outcomes I owned or led.

  1. P0 Security

    Principal Solutions Architect

    2025 – Present San Francisco, CA

    P0 is the AuthZ control plane for production environments. It replaces standing privilege with short-lived, least-privilege, auditable access across every identity type.

    • Own pre-sales technical strategy for the AuthZ Control Plane, architecting scalable demo environments, standardized demo scripts, and enablement guides that carry customer conversations at major security conferences.
    • Drive product management and customer communication: technical documentation, release detail, and requirements for continuous authorization and Zero Standing Privilege (ZSP).
    • Run the CX lifecycle with structured problem-intake workflows and Quarterly Business Reviews that turn complex identity and access needs into product strategy.
    • Partner with enterprise customers to implement runtime access controls and continuous privilege governance for human, non-human (NHI), and AI-agent identities.
    Clients
    • Splunk
    • CNA Insurance
  2. Sonrai Security

    Cloud Security Solutions Architect

    2021 – 2025 New York City, NY

    Sonrai built the industry's first Cloud Permissions Firewall: default-deny guardrails and automated JIT access on top of an identity graph.

    • Delivered pre-sales and post-sales technical wins on the CIEM+ platform and Cloud Permissions Firewall, running risk assessments, technical demos, and tailored proposals for Fortune 500 accounts.
    • Built API-driven automation integrating Sonrai's identity-graph analytics with client ITSM and ChatOps, cutting manual policy-writing and accelerating privilege remediation.
    • Shrank identity attack surface by identifying and quarantining dormant machine, human, and emerging AI-agent identities, reducing operational overhead.
    • Aligned continuous identity governance and least-privilege with strict regulatory compliance for tier-1 enterprise accounts.
    Clients
    • Wells Fargo
    • PayPal
    • Albertsons
    • P&G
  3. Concertium

    Principal IT Architect

    2019 – 2021 Tampa, FL

    A Tampa managed cybersecurity provider offering 24/7 monitoring, compliance, and incident response.

    • Directed a cross-functional DevOps initiative for hybrid-cloud migrations across 100+ MSP clients, reducing IT cost.
    • Served as Azure SME migrating critical workloads with zero downtime, improving scalability and operational efficiency.
    • Established CI/CD processes that cut deployment times and lifted performance.
    • Mentored a senior engineering team into a culture of learning and innovation.
  4. Xerox Business Solutions

    Cloud Architect

    2018 – 2019 Tampa, FL

    Xerox's Microsoft-CSP managed-services arm, spanning four acquired MSPs.

    • Directed cloud infrastructure and technical strategy across 4 Xerox-owned MSPs, orchestrating Azure migrations spanning 40+ enterprise portfolios.
    • Led the senior cloud engineering team refactoring legacy environments into secure architectures, saving $300K to $600K per month in Azure ($3M+ annualized) at 99.99% uptime.
    • Enforced cross-tenant compliance frameworks (SOX, PCI-DSS) and optimized multi-organization resource allocation.
    • Centralized identity boundaries and joint support across all four MSPs, cutting incident-response and access-remediation times.
  5. MediaLab 3D Solutions

    Senior System Engineer · Senior System Administrator

    2014 – 2018 Tampa, FL

    A digital-visualization studio producing photoreal 3D for Whirlpool, KitchenAid, Jenn-Air, and Lennar.

    • Designed and ran the render farm and datacenter operations across the U.S. and India, the compute backbone for the studio’s 3D visualization pipeline.
    • Built 10Gb networking and SAN storage, and stood up virtualization environments holding 99.99% uptime through critical deployment windows.
    • Implemented the first CI/CD pipelines for render-node deployment, improving release frequency and reliability.
  6. Florida Gulf-to-Bay Anesthesiology

    Network Administrator III

    2011 – 2014 Tampa, FL

    A 200+ clinician anesthesiology group handling roughly 160k cases a year across 8 hospitals and 11 surgery centers.

    • Migrated on-prem Exchange to Office 365 and physical servers to Hyper-V and Azure, improving performance and security.
    • Hardened the network with targeted firewall upgrades, ensuring HIPAA and HITECH compliance for the practice.
    • Managed core Microsoft services (SQL, Exchange, SharePoint, Domain Controllers) at a 99.9% uptime baseline.

Capabilities

What I work in

Everything from winning the technical deal to building the systems behind it.

Sales Engineering

  • Pre-sales technical strategy
  • Demo architecture
  • Proofs of value
  • RFP / RFI response
  • Client integrations
  • Technical enablement
  • Executive & QBR delivery
  • Competitive positioning

Cloud Identity & Security

  • CIEM / CIEM+
  • IAM & entitlements
  • Zero Standing Privilege
  • Just-In-Time access
  • Least-privilege enforcement
  • Continuous authorization
  • Non-human & AI-agent identity
  • SSO / OAuth / JWT
  • Threat modeling
  • SOX · PCI-DSS · HIPAA

Cloud Platforms

  • AWS
  • Azure
  • Google Cloud
  • OCI
  • Kubernetes (EKS / AKS / GKE)
  • Cloud Run
  • Cloudflare
  • Workload Identity Federation
  • Amazon Bedrock
  • Azure OpenAI
  • Vertex AI

Engineering

  • CI/CD
  • Docker
  • Python
  • TypeScript
  • GraphQL
  • SvelteKit / Vue
  • Node / Express
  • Git-based delivery
  • WebAssembly

Credentials

Certified deep, and recently

Current where it counts, with the Azure Solutions Architect Expert, on a deep foundation of infrastructure certifications.

All 20+ certifications

Microsoft

  • Azure Solutions Architect Expert (AZ-305) 2025
  • Azure Administrator (AZ-104) 2022
  • MCSA: Server Infrastructure 2012 2013
  • MCSA: Windows 7 2012
  • MCITP: Enterprise Desktop Administrator 2012
  • MCTS: Windows 7 Configuration 2012
  • MTA: Network / OS / Security / Server 2011

Cisco

  • CCNA 2012
  • CCDA 2012
  • CCNA: Security 2012
  • CCNA: Wireless 2012
  • CCNA: Voice 2012
  • CCENT 2012

CompTIA

  • Security+ 2011
  • Server+ 2011
  • Network+ 2011
  • A+ 2011
  • Healthcare IT Technician 2012

Education

Hillsborough Community College · Tampa, FL

A.S. in Network Administration, Telecommunications specialization

  • Network Communications – LAN (2013)
  • Wireless IP Communications Technician (2013)
  • IT Support Specialist (2013)
  • IT Analysis (2013)

Beyond the day job

Personal projects, built like production

Separate from my professional timeline, but proof I still ship: a non-profit platform I run end to end, plus a series of heavyweight native applications, game engines and desktop CAD software, cross-compiled to run in the browser.

Live · Chrome, Edge, Firefox

FreeCAD · Web

FreeCAD, the full parametric CAD suite, cross-compiled to WebAssembly and running in the browser.

Screenshot FreeCAD · Web screenshot
  • 25+ CAD workbenches in the browser
  • 5 native runtimes fused into one binary
  • Python 3.13 embedded, numpy included
  • Qt 6.9 the real desktop GUI

FreeCAD 1.1.3, the full parametric CAD suite, cross-compiled to 64-bit WebAssembly and running the real Qt desktop in a browser tab, with about twenty-five workbenches, the OpenCASCADE geometry kernel, and an embedded Python. The hard part is the tower: OpenCASCADE, a complete CPython, the Coin3D 3D engine, the Qt GUI, and the PySide bindings that tie them together, native runtimes that normally live in separate libraries and processes, all cross-compiled and fused into a single WebAssembly binary.

  • The real CAD suite, not a viewer The actual FreeCAD desktop, the same C++, running in a browser tab: parametric modeling, sketching, the full menu of roughly twenty-five workbenches, and a live 3D view.
  • A tower of native runtimes, fused FreeCAD stands on a stack of big native pieces: the OpenCASCADE geometry kernel, an embedded Python, the Coin3D 3D engine, the Qt interface, and the PySide bindings that tie them together. Each was compiled to WebAssembly and linked into one program, which is a large part of the challenge.
  • Python that actually runs A complete Python 3.13 is embedded and works, right down to running numpy in the browser, so FreeCAD’s scripting console and its Python-driven tools function as they do on the desktop.
  • Two canvases, hand-composited The browser would not let the 3D engine draw onto the page through Qt, so its rendered pixels are read back and painted onto a second canvas layered over the interface, a compositor built from scratch.
  • FEM that solves in the tab The CalculiX finite-element solver, a Fortran program, is compiled to WebAssembly through a custom Fortran-to-C pipeline, so meshing and solving both run locally. Results are checked against closed-form answers, not just run to completion.
  • Your work stays with you Documents and settings are saved into the browser and restored on the next visit, and nothing is uploaded to a server. Sessions can be shared by link, and an MCP endpoint lets AI tools drive the app.
  • C++
  • Python 3.13
  • Emscripten 3.1.70
  • OpenCASCADE 7.8
  • Qt 6.9
  • Coin3D / pivy
  • PySide6
  • WebGL2
  • pthreads
  • NumPy
  • IndexedDB
  • CalculiX
  • wasm64
Playable · Chrome · v1.0

OpenMW · Web

A full 3D game engine, the open-source Morrowind engine, cross-compiled to WebAssembly and playable in the browser.

Screenshot OpenMW · Web screenshot
  • 60 FPS 0.61 ms/frame, in-browser
  • 1.5 GB growable WASM heap
  • 20+ native deps cross-compiled
  • 0.52.0 OpenMW, core gameplay intact

The real OpenMW C++ engine, the open-source reimplementation of The Elder Scrolls III: Morrowind, cross-compiled to WebAssembly with Emscripten and run multithreaded on WebGL2. Built on OpenMW 0.52.0, it renders the actual game at a smooth 60 FPS. Not a browser reimplementation and not a streaming service: the engine executes locally, reads game data straight from your disk, and keeps your saves in the browser. Porting it meant re-satisfying every assumption a native game engine makes about threads, a GPU, a filesystem, and codecs, on the web platform.

  • The whole engine, not a rewrite The real desktop OpenMW, the same C++, running in a browser tab. It boots the actual 3D world, with combat, magic, saving, and AI all intact.
  • Game files that stream from your disk A native engine expects to read gigabytes of game data instantly, the way a desktop app does; browsers do not allow that. A custom streaming filesystem feeds it in on demand, and your own copy of the game stays on your disk and is never uploaded.
  • Tuned to boot in a browser Starting an engine this large in a browser took careful low-level tuning of memory, threads, graphics, and a browser-friendly frame loop, each dialed in by hand.
  • The renderer, rebuilt for the browser Browser graphics speak a stricter, more modern dialect, so the 3D renderer was patched across fifteen files. One fix alone un-blanked every reflection and preview that had been rendering black.
  • Bugs that only exist in the browser Shadows that swam, an intro video that froze, audio that deadlocked: a long tail of problems that worked fine on the desktop and only broke in the browser, each tracked down and fixed.
  • Made to link at all The engine expected a Linux desktop windowing system that simply is not there in a browser. Filling in about fifty empty placeholder functions was the only way to get it to even build.
  • C++
  • Emscripten 6.0.1
  • OpenSceneGraph 3.6.5
  • WebGL2 / GLES3
  • SharedArrayBuffer
  • pthreads
  • SDL2
  • Bullet
  • MyGUI
  • RecastNavigation
  • FFmpeg
  • Lua 5.4
Playable · Chrome

JA2 · Web

Jagged Alliance 2, the Stracciatella engine, cross-compiled to WebAssembly, Rust core and all.

Screenshot JA2 · Web screenshot
  • 2 languages in one WASM binary (Rust + C++)
  • 8 MB stack, up from a 64 KB default
  • 4 GB max heap, 8-thread pool
  • 0.22.1 Stracciatella, full engine

The full Jagged Alliance 2 Stracciatella engine, its C++ core and its Rust library both, cross-compiled into a single WebAssembly binary and run in the browser off the original game data. It boots to the main menu and into live turn-based tactical combat, with saves kept in the browser. The hard part is not one language but two: a Rust static library and a C++ engine linked into one module over a C ABI, sharing a single allocator and one thread pool.

  • Two languages, one program This engine is written in both C++ and Rust. To run in the browser, both had to be compiled and fused into a single WebAssembly program that shares one block of memory and one set of threads, which is genuinely hard to pull off.
  • Rebuilding Rust for the browser Rust’s standard library does not ship in a form that can share memory across threads in the browser, so I rebuilt it from source with the right low-level features enabled, and worked around a compiler bug that was corrupting file paths.
  • An 8 MB stack, learned the hard way Loading a battle map quietly overran the browser’s tiny default memory and corrupted the program, showing up as random crashes far from the real cause. The fix was giving it a desktop-sized stack.
  • Teaching an old game to share the browser The game wanted to own the whole loop and freeze on animations, which locks up a browser tab. I turned its main loop into something the browser drives frame by frame and removed the parts that would hang.
  • Drawing and sound on the web The 2D battlefield renders crisp and full-screen while the menus stay pixel-perfect, and the audio was corrected so it does not play sped-up and pitch-shifted through the browser’s sound system.
  • Bring your own game data The original game files stay on your machine; nothing copyrighted ships in the build. Your saves live in the browser and survive a reload.
  • C++17
  • Rust (nightly)
  • Emscripten 6.0.1
  • SDL2
  • WebAssembly
  • pthreads
  • SharedArrayBuffer
  • Lua 5.1
  • cbindgen
  • IndexedDB
  • miniaudio
Live

Nostalgia Lab

A free, non-profit retro console preservation platform: a quarter-million-ROM archive you can play with friends.

Screenshot Nostalgia Lab screenshot
  • 238K ROMs auto-matched
  • 104K game releases
  • 887K media assets
  • 20+ console systems

A retro-gaming archive and player I designed, built, and operate end to end. It auto-identifies a quarter-million ROM dumps against a hash database and links them to 104,000 catalogued releases, plays 20+ classic consoles in the browser, syncs encrypted cloud saves, and lets you play multiplayer with friends over WebRTC. Seven services on GCP Cloud Run, fronted by Cloudflare.

  • Industrial ROM cataloging Auto-identifies ROMs against 374,000 Redump/No-Intro DAT hash signatures (CRC32/MD5/SHA1), then links them to releases through a four-tier resolver: exact hash, then CRC, then filename, then fuzzy trigram match at 92% similarity. An autonomous daemon reconciles orphans continuously.
  • Play in the browser 20+ consoles run client-side on libretro cores compiled to WebAssembly. You bring your own ROMs (they never leave your device), so it stays legal by design.
  • Friends & multiplayer Host-authoritative WebRTC netplay: the host runs the emulator and streams video while guests send controller input over a data channel. Live presence, controller-entry friend codes, and Redis pub/sub room state across auto-scaled instances.
  • Encrypted cloud saves Save states and SRAM sync to Google Drive or OneDrive, encrypted with per-user AES-256-GCM keys escrowed under a KEK in Secret Manager. Your progress is stored in the cloud; your games stay yours.
  • Metadata & media at scale 887,000 media assets (box art, screenshots, marquees) transcoded to WebP/WebM and served from object storage through a Cloudflare CDN. An LLM-assisted enrichment pipeline fills genre, descriptions, and semantic-search embeddings.
  • Production-grade platform Single sign-on across seven services with signed JWTs and an instant Redis denylist; Cloudflare-worker origin gating that fails closed; reproducible infrastructure across dev, stage, and prod, shipped through GitHub Actions with Workload Identity Federation and no long-lived keys.
  • SvelteKit
  • Vue 3
  • Express
  • GraphQL Yoga
  • PostgreSQL
  • pgvector
  • Redis
  • WebRTC
  • WebAssembly
  • GCP Cloud Run
  • Cloudflare Workers

Contact

Let’s talk about
the technical win.

I’m a solutions architect, sales engineer, and team lead in cloud identity security, open to Principal and Staff roles. Whether it’s a deal to win or a team to build, let’s talk.