UN automation platform
Shared AWX platforms with controlled team access.
BigFix to Ansible migration
Modernizing endpoint automation across a banking estate.
A phased BigFix-to-Ansible migration across 20,000+ endpoints and 10+ countries, with parallel validation and integrated compliance evidence.
The context
Endpoint management covered Windows and Linux across more than ten countries. IBM BigFix supported patching, configuration baselines and compliance reporting, while evidence required manual consolidation. The work spanned VTS — Services of UniCredit (2017–2021) and Kyndryl (2021–2024).
A phased migration
The migration mapped active fixlets, tasks and baselines to Ansible roles. Both systems ran in parallel while results were compared on the same hosts. Cutover proceeded by country and platform, with rollback available before retiring each legacy scope.
- Inventory the content still in use
- Develop and test platform-specific roles
- Compare outputs on identical hosts
- Move validated scopes with a rehearsed rollback
Integrated controls
Ansible Tower ran versioned job templates and roles. Inventory came from the CMDB, privileged credentials from CyberArk, and operational records flowed into ServiceNow and Splunk. Windows and Linux received separate validation paths.
The verified result
The estate covered 20,000+ endpoints across 10+ countries. Compliance workflow execution moved from 2–5 hours to 10–15 minutes. Automation became reviewable, testable content, while evidence was recorded as part of execution.
What the work demonstrates
A migration is an operating-model change. Content mapping, comparable results, credential handling and rollback need to be solved together before a replacement platform takes over.
Let’s talk