Metafive.ai FR Book a call

Leading, designing and hardening critical platforms.

Thirty years of technology leadership in Tunisia, Qatar, the United Arab Emirates, Germany and France. I work in four ways: in technology leadership roles, as a consultant, as a trainer, and in my lab applying AI to quantitative trading.

Mohamed Ben Lakhoua · Infrastructure & Cloud Architect · 30 years of critical platforms

In production, where downtime is expensive

99.99%
availability sustained on a global platform with 8 million users
60+
operational contracts with SLAs and OLAs negotiated and upheld, covering over 150 different products and services
14 years
of ISO 27001, ISO 22301 and BSI audits with no critical finding
€13M
P&L managed, at 40% EBIT

NATO · European Patent Office · Stuttgart Stock Exchange · Abu Dhabi e-Government · a major French banking group

Technology leadership

For a CTO, VP Engineering or Platform, or Director Infrastructure & Cloud role: thirty years building, leading and running critical platforms, with teams spread across countries and a P&L to deliver.

Target roles

  • CTO
  • VP Engineering / VP Platform
  • Director Infrastructure & Cloud Operations
  • Head of Platform Engineering

Track record

  1. 2022 – 2026

    Global Director, Platform Engineering & Cloud Operations

    The Sandbox · Paris

    Global consumer platform, 8M+ users; reporting to the CTO, with Executive Committee exposure.

    • 25 engineers in five international squads
    • 99.99% availability on AWS, MTTR under 15 minutes
    • From monthly releases to 20+ production deployments a day (DORA Elite)
    • $3M cloud budget, $250K to $750K annual savings
  2. 2018 – 2022

    Head of Platform Operations & Cloud Delivery

    ]init[ AG · Berlin

    Public sector and regulated financial services: NATO, European Patent Office, Stuttgart Stock Exchange.

    • €13M P&L at 40% EBIT
    • 60+ operational contracts with SLAs and OLAs negotiated and upheld, covering over 150 products and services
    • Cloud-native transformation of 15+ German federal agencies (BSI IT-Grundschutz)
    • 100% compliance in ISO 27001 and ISO 22301 audits for 14 consecutive years
  3. 2008 – 2018

    Director, Regional Operations & Platform Delivery

    ]init[ AG · Abu Dhabi

    e-Government programme: a sovereign Tier-4 platform connecting 50+ ministries, agencies and banks, run 24/7.

    • 144-person organisation across four countries
    • 99.9% SLA met six years in a row
    • eLAB: a self-service developer platform, Platform Engineering before the name existed
  4. 1997 – 2008

    Chief Information Officer

    Qatar Foundation · Doha

    National digital services under formal service commitments.

    • Three Tier-3/4 data centres with full disaster recovery
    • The Gulf's first Microsoft e-Learning academy: 1,000+ professionals trained

What I bring to a leadership team

Reliability as a commitment
Service objectives that are measured, met and defended in front of customers, auditors and the Executive Committee.
Organisations that scale
Teams of 25 to 144 people, international squads, leads who grow, shared standards.
Economic steering
P&L, cloud budgets, supplier negotiations, engineering KPIs translated into business metrics.
Transformation without disruption
Cloud-native, Platform Engineering, DevSecOps: changing how software ships without degrading the service.
Compliance as an advantage
NATO, European institutions, banking: audits passed with no critical findings, year after year.
AI put to work
AI agents governed by a charter, evidence and controls, proven in my own lab.

Letters of recommendation and thanks from ministers and public institutions in Europe and the Middle East, available on request.

Consulting

Engagements that start from the strategic context, translate it into architecture, then into measurable service commitments. On site or hybrid in the Paris region, or remote.

Consulting

The strategic context in 2026

A critical platform has to grow, stay compliant and keep its commitments while regulation, AI and costs all change at once. These requirements often conflict: architecture is where they are arbitrated, and measurement is what makes them verifiable.

Regulation

DORA has applied since January 2025, Cyber Resilience Act reporting since September 2026, NIS2 is arriving in France with the loi Résilience, and the AI Act is coming into application in stages. Regulators expect controlled risk and suppliers under control.

  • DORA
  • NIS2
  • Cyber Resilience Act
  • AI Act
  • ISO/IEC 27001
Supplier dependency

A few clouds and a few model providers concentrate the risk: you need to know what holds when one of them fails, and be able to exit.

  • ISO 22301
  • DORA: third-party risk
  • Reversibility
AI in production

AI agents now act on systems: they require guardrails, evidence and suitable service levels.

  • AI Act
  • ISO/IEC 42001
Cloud and AI costs

GPUs, inference and tokens add to the cloud bill: without unit cost and trade-offs, they drift.

  • FinOps
  • Measured capacity
Sovereignty

Where the data lives, who can access it, and under which law.

  • SecNumCloud
  • ISO/IEC 27017 and 27018
Operational excellence

Service processes built on shared objectives, and metrics that show whether you are improving.

  • ITIL v2, v3 and 4
  • ISO/IEC 20000
  • DORA DevOps
  • PDCA cycle

Consulting

Areas of intervention

Each area can be engaged on its own; they reinforce each other when combined.

Cloud & hybrid architecture

Designing the target platform and scaling it: public cloud, private cloud and hybrid.

  • Target architecture and migration roadmap
  • IaaS, CaaS and PaaS offerings, landing zones
  • Sizing and capacity tiers
  • FinOps: cost, performance and availability trade-offs ($250K to $750K annual savings delivered)
  • AWS
  • Azure
  • OpenShift
  • Private cloud
  • ISO/IEC 27017 and 27018

Resilience & compliance

Holding up when a link fails, and proving it to auditors and regulators.

  • Business continuity and disaster recovery, business impact analysis
  • DORA compliance: ICT risk, incidents, resilience testing, third-party risk
  • Audit preparation and support (14 years of audits with no critical findings)
  • Compliance framework for AI systems
  • DORA
  • ISO 22301
  • ISO/IEC 27001
  • BSI IT-Grundschutz
  • EU AI Act

Service Level Management & operational excellence

Operations built on measured objectives rather than on the urgency of the moment.

  • Service level chain SLI → SLO → OLA → UC → SLA
  • ITIL processes, major incident management, post-mortems
  • SRE: error budgets, observability, Run model
  • DORA DevOps metrics and continuous improvement
  • ITIL v2, v3 and 4
  • ISO/IEC 20000
  • SRE
  • DORA DevOps

AI automation

AI agents that collect, calculate, detect and draft; decisions stay human.

  • IT operations automated end to end
  • Compliance evidence and reporting generated from real data
  • Governance of AI coding agents and of AI in operations
  • Guardrails, traceability, human sign-off
  • EU AI Act
  • AI agents
  • agent-constitution (open source)

Consulting

One method: measure before committing

Cloud migration, compliance or service quality: the approach is the same. Start from what the platform actually delivers, then commit. I work at every stage, from scoping to governance.

  1. Scope

    Assessment of the current state, service and dependency mapping, business and regulatory requirements, DORA and ISO gap analysis.

  2. Design

    Target architecture, resilience and redundancy, capacity tiers, service level model.

  3. Formalise

    Architecture documents, BCP and DRP, SLA, OLA and UC sheets, RACI and compliance matrices.

  4. Instrument

    Monitoring and metrics, infrastructure as code, dashboards, AI automation.

  5. Govern

    Service and architecture reviews, audits, continuous improvement, team upskilling.

Consulting

Close-up: the service level chain

A concrete example of the method. An SLA is only enforceable when it rests on achievable OLAs and UCs, themselves backed by reliable measurement. Pick an availability: the whole chain recalculates.

The commitment chain, calculated

Availability promised to the customer
  1. SLA99.9%The contractual commitment to the customer, with credits and penalties.
  2. SLO99.95%The stricter internal objective that keeps a margin before any penalty.
  3. Error budget22 min/ monthDowntime allowed per month at the SLO level. That is 4 h 23 per year.
  4. OLA per team99.988%What each of the 3 internal teams must deliver for the SLO to hold.
  5. UC per supplier99.988%What the underpinning contract (cloud, telecom, software vendor) must guarantee: the 4th link of the chain.
  6. SLI≥ 99.95%The measurement of record: successful requests / total requests, over a rolling 30 days.
  7. Measured capacity> 99.95%What the platform delivers today, measured before committing.

Illustrative assumptions: SLO = SLA with a 50% margin on the error budget; 3 internal teams and 1 supplier in series; 30-day month.

The architecture of the chain

Commitments are built from the bottom up; penalties flow from the top down.

CustomerSLA99.9%

What is promised and billed: availability, restoration times, credits and penalties.

ServiceSLO99.95%

The internal objective, stricter than the SLA, and its error budget.

Internal teamsOLA99.988%

Run, platform, network, security: what each team commits to deliver for the service.

SuppliersUC99.988%

Cloud, telecom, software vendors, data centre: the underpinning contracts that must cover the SLO.

MeasurementSLI≥ 99.95%

Indicators drawn from existing monitoring (Zabbix, Dynatrace, Centreon, Prometheus), with an auditable calculation method.

RealityMeasured capacity

Observed history: actual availability, incidents, resilience tests.

How the figures are calculated

The examples recalculate with the availability selected in the calculator. 99.9%

Error budget
B = (1 − SLO) × period

The downtime allowed over the period (here 30 days = 43,200 min).

ExampleWith an SLO of 99.95%: (1 − 99.95%) × 43,200 min = 22 min per month.

SLO from the SLA
SLO = 1 − (1 − SLA) × (1 − m)

A margin m = 50% of the SLA budget is kept to react before any penalty.

ExampleSLA 99.9%: SLA budget 43 min per month, half of which is kept ⇒ SLO 99.95%.

Links in series
A = A₁ × A₂ × … × Aₙ ⇒ Aᵢ ≥ SLO^(1/n)

If 3 teams and 1 supplier are all required (n = 4), each must do better than the SLO.

Example99.95%^(1/4) = 99.988% for each of the 4 links (3 OLAs + 1 UC).

Redundancy
A = 1 − (1 − a)ᵏ

Two independent instances at 99.5% each give 99.9975%: architecture is what lets you promise more.

Example2 × 99.5% in parallel ⇒ 1 − 0.005² = 99.9975%.

SLI
SLI = good events / valid events

Measured over a rolling 30 days. Example: 999,600 successful requests out of 1,000,000 = 99.96%.

Example999,600 / 1,000,000 = 99.96%.

Consulting

Automating operations end to end with AI

Monitoring, capacity, cost, compliance, service levels: once the rules are set, the chain can run on its own. AI agents collect, calculate, detect and draft; decisions and commitments stay human.

  1. Collect

    Metrics, incidents, changes, cloud inventory and costs, extracted automatically from monitoring, ITSM and cloud consoles.

  2. Calculate

    Availability, error budgets, capacity, costs and DORA DevOps metrics, recalculated continuously by tested and auditable code.

  3. Detect

    Capacity or cost drift, a budget burning too fast, an OLA or UC putting the SLA at risk, a compliance gap, a missing measurement.

  4. Draft

    Drafts of architecture documents, SLA, OLA and UC sheets, post-mortems, compliance registers and evidence.

  5. Report

    Dashboards, the monthly service review and the compliance report generated automatically, ready for sign-off.

Guardrails

  • Calculations are done by code, not by the language model: AI explains and drafts, it does not compute.
  • Every figure stays traceable to its source and its calculation method.
  • No contractual commitment is published without human sign-off.
  • Agents follow a written, versioned charter (agent-constitution, open source).

Training 2026

The topics IT teams need to master this year: AI moving into production, regulation coming into application, costs to control. In-house, in French, English or Arabic, built on your own services.

See the detailed catalogue

AI and quantitative trading

Metafive 360° is my lab: an algorithmic trading platform where several AI agents design, test, review and deploy code under written governance. Trading is the proving ground; the object of the research is the governance of multiple AI agents on a system where every mistake is measured.

Architecture

  • Four-lane signal router, each lane scored by machine learning
  • Routing by market regime (volatility, dollar)
  • Replay engine over four years of history and a dozen instruments
  • Two separate instances: execution and research

Research discipline

  • Systematic out-of-sample validation
  • Permutation tests and bootstrap confidence intervals
  • Overfitting guards: configurations tested are declared, free parameters are capped, plateau stability
  • Meta-labelling (López de Prado) from live outcomes

Agent governance

  • Written constitution and append-only decision log
  • Evidence grammar and review contract
  • AI code review against a list of domain invariants
  • Continuous integration gates before any deployment

What this lab brings to my engagements: hands-on practice of agentic AI in production, agent governance and statistical rigour, reused directly in consulting and training. The agent-constitution governance framework (open source)

Personal research and engineering project. This site provides no investment advice, no signals and no third-party asset management. Trading leveraged products carries a high risk of capital loss.

References

Thirty years of production platforms where downtime is expensive.

Environments

  • Abu Dhabi e-Government — 50+ ministries, agencies and banks, Tier-4, 24/7
  • NATO
  • European Patent Office
  • Stuttgart Stock Exchange
  • 15+ German federal agencies (BSI IT-Grundschutz)
  • The Sandbox — consumer platform, 8M+ users
  • A major French banking group

Certifications

  • ITIL v2, v3 and 4
  • ISO 22301 Lead Implementer
  • MIT Sloan — AI: Implications for Business Strategy
  • Certified AI Security Expert (CAISE)
  • Certified Web 3.0 Professional (CW3P)
  • Generative AI for Leaders — Vanderbilt University

Standards experience

  • DORA (financial sector)
  • DORA DevOps metrics
  • ISO/IEC 27001
  • ISO/IEC 20000
  • ISO/IEC 27017 and 27018 (cloud)
  • EU AI Act
Mohamed Ben Lakhoua

About

I am Mohamed Ben Lakhoua, Infrastructure & Cloud Architect and founder of Metafive.ai. Since 1995 I have designed and governed critical platforms in Tunisia, Qatar, the United Arab Emirates, Germany and France, and led organisations of 25 to 144 people across four continents.

Today I support infrastructure leaders on the architecture of their platforms, their resilience, their compliance and the quality of their operations, and I train teams to sustain them. SUP'COM engineer; I work in French, English and Arabic.

Let's talk about your platform

A first 30-minute conversation to understand your context: architecture, compliance stakes, commitments, deadlines.

Based in Paris – La Défense. On-site, hybrid or remote engagements.