Managed Infrastructure : Cloud, on-prem, and the data center. Owned end to end.
Azure · AWS · Google Cloud · on-prem · data center
Golonex takes ownership of the architecture, availability, and change control of your estate — a named engineer for a smaller estate, a dedicated team for a larger one. One named lead answers for it either way, and you get one report every month.
Under Fractional Leadership. Managed infrastructure is the operational layer under the seat — run by Golonex, overseen by the same named owner.
Cloud — Azure, AWS, Google Cloud
One standard across every cloud you run.
Most firms end up multi-cloud by accident: Azure for Microsoft workloads, AWS for a product, Google Cloud for data. We hold all three to one set of guardrails, one tagging and cost model, and one change process.
- Landing zones and account, subscription, and project structure built as infrastructure-as-code (Terraform, Bicep, CloudFormation)
- Network design: hub-and-spoke, private endpoints, VPN and ExpressRoute / Direct Connect / Cloud Interconnect
- Cost governance: tagging, budgets, rightsizing, and reservations reviewed in the monthly report
- Cloud posture held to CIS benchmarks: Azure Policy and Defender for Cloud Secure Score, AWS Security Hub, Google Security Command Center
- Compute, containers, and managed databases operated with defined backup and recovery objectives
On-prem servers, storage & network
The estate in the building still needs an owner.
Servers in a comms room, a SAN nobody has touched since it was installed, firewalls with rules no one can explain. We take ownership of what is on-site and run it to the same standard as the cloud.
- Windows Server and Linux administration, Active Directory, DNS, and DHCP
- Virtualization: VMware vSphere, Microsoft Hyper-V, and Proxmox clusters, including host lifecycle
- Storage: SAN and NAS, replication, and capacity planning
- Network: switching, routing, firewalls, VPN, and Wi-Fi, with rule reviews on a schedule
- Hardware and firmware lifecycle tracked against vendor support dates
Data center configuration
Designed, documented, and built to be audited.
Whether it is your own server room, a colocation cage, or a regional data center, the configuration is designed on paper first and every change after go-live is recorded.
- Rack layout, power, and cooling capacity planning, with redundancy that matches the workload
- Structured cabling and network topology, documented as built
- Colocation setup, cross-connects, and remote-hands coordination
- Out-of-band management so the estate can be reached when the primary network cannot
- Physical access and environmental controls recorded as evidence for ISO 27001, CMMC, and PCI DSS
Migrations & hybrid
Move it in waves, with a way back.
On-prem to cloud, cloud to cloud, or two data centers into one. Every migration is planned in waves, tested in parallel, and carries a rollback plan the business has signed off before cutover.
- Discovery and dependency mapping before anything moves
- Wave plans with parallel runs, acceptance criteria, and a written rollback for each wave
- Hybrid connectivity and identity so on-prem and cloud work as one estate during and after the move
- Data center consolidation and exit, including decommissioning with evidence of data destruction
Monitoring, patching, and change control — with the evidence kept.
Whatever the mix of cloud and on-prem, the estate is operated the same way, and every month you see what changed, what is open, and what needs your decision.
Monitoring and alerting
Availability, capacity, and performance monitored across cloud and on-prem, with alerts routed to the on-call rota.
Patch management with evidence
Operating systems, hypervisors, firmware, and network devices patched on a published cycle, with a compliance report each month.
Configuration baselines
Hardened builds held to CIS benchmarks, with drift detected and corrected rather than discovered at audit.
Change control
Every change requested, approved, tested, and recorded, so an auditor can follow any change from request to result.
Capacity and lifecycle
Growth forecast before it becomes an outage; hardware, licences, and support contracts tracked to renewal.
Runbooks and documentation
The estate is written down: diagrams, runbooks, and recovery procedures that do not live in one person’s head.
Fixed every month, known before it starts.
Whether it is one engineer or a full team, every seat has a fixed monthly price, dedicated or fractional. When a team runs the estate, its delivery team is always dedicated to you; the project manager can be dedicated or fractional.
- Engineer and lead seats: six-month minimum, then auto-renew with 60 days’ notice
- Teams: three to six months, set by the scope of the estate
- Escalation tiers written into the engagement — who acts, who decides, how fast
- US-person-only teams available where CUI is in scope for CMMC or DFARS
Who runs it
One engineer or a full team — sized to the estate.
Not every estate needs a team, and not every estate can be run by one person. We size it to what you run and how it has to be available.
A named engineer
One Golonex engineer who knows your environment, dedicated or fractional, with a second engineer briefed to cover leave and escalation.
Fits when
- One cloud, or one site with a server room, in steady state
- Business-hours support with an agreed out-of-hours escalation
- Change volume one person can plan, test, and record properly
A dedicated team
A lead who owns the outcome, a project manager (dedicated or fractional), and a dedicated delivery team with the specialists the work needs.
Fits when
- Two or more clouds, or several sites, run as one estate
- A data center or colocation footprint
- Availability commitments that need 24×7 on-call
- A migration or consolidation running alongside day-to-day operations
Always a team: data center builds, migrations, and 24×7 on-call. They need network, storage, and cloud specialists at the same time, and cover that one person cannot give.
Either way, one named lead answers for it — and reports to you every month.
Where the neighbouring work lives.
Recovery plans and control evidence
Disaster recovery planning, patch assurance, and proof that the controls on this infrastructure work belong to security assurance, with its own accountable lead.
Security assurance →Microsoft 365, Azure Virtual Desktop, Intune
The Microsoft workplace — tenant, identity, endpoints, and Dynamics 365 — is run as the managed Microsoft ecosystem.
Managed Microsoft ecosystem →Cloud and DevOps engineers on your team
If you want the engineers inside your own team rather than a managed service, they come as supervised seats.
Cloud, DevOps & DBA seats →Managed infrastructure — your questions, answered
Do you manage AWS and Google Cloud, or only Azure? +
All three. Azure, AWS, and Google Cloud are held to one set of guardrails, one cost model, and one change process, so a multi-cloud estate is run as one estate rather than three.
Can you run our on-prem servers and our cloud together? +
Yes. That is the normal case. Servers, virtualization, storage, and network on-site are run to the same standard as the cloud, under the same accountable lead and the same monthly report.
What does data center configuration cover? +
Rack layout, power and cooling capacity, structured cabling, network topology, colocation setup, and out-of-band management — designed before the build, documented as built, and every later change recorded.
How do you handle a migration without disrupting the business? +
In waves. Each wave has discovery, a parallel run, acceptance criteria, and a rollback plan signed off before cutover. Hybrid connectivity keeps on-prem and cloud working together while the move is under way.
Who owns backups and recovery? +
The backup platform is yours or your vendor’s, run on this infrastructure. Recovery objectives, the plan, and the tests that prove it sit with security assurance. The two leads work from the same escalation tiers, so a restore is rehearsed, not improvised.
Is it one engineer or a team? +
Either — it depends on the estate. A single cloud or a single site in steady state is well served by one named engineer, dedicated or fractional, with a second engineer briefed for cover. Multi-cloud, several sites, a data center, a migration, or round-the-clock availability needs a dedicated team. Data center builds, migrations, and 24×7 on-call are always a team.
How is it priced? +
Every seat — engineer, lead, project manager, team member — has a fixed monthly price, dedicated or fractional, set before the month starts. Engineer and lead seats carry a six-month minimum; teams three to six months, set by the scope of the estate.
Can the team be US-person-only for CMMC? +
Yes. Where Controlled Unclassified Information is in scope, the engagement can be staffed with US-person-only teams. Scoping decides which parts of the estate that applies to.
One estate. One accountable lead. One monthly report.
Tell us what runs where — clouds, servers, sites — and thirty minutes is enough to see what it takes to own it.
Managed delivery — seven practices · All managed delivery →
Managed GCC
Your Global Capability Center — set up, run, and handed over
02Managed talent
Supervised engineering seats in six practices
03Managed software delivery
Teams and builds with a Golonex lead on every engagement
Managed infrastructure
Azure, AWS, Google Cloud, on-prem, and the data center
You are here
Security assurance
Recovery, patching, evidence, identity, and people — tested, not assumed
06Managed Microsoft ecosystem
Microsoft 365, Azure workplace, and Dynamics 365
07Managed process & AI automation
A process lead in your business, automating the work