Seven practices, one engineering team. We design, build, benchmark and operate the compute layer beneath your hardest problems — on-premise, hybrid or sovereign cloud.
A genomics pipeline and a trading engine are not the same machine. We start from your regulatory perimeter, your data gravity and your deadlines — then design backwards.
About Cloud Natives
Cloud Natives designs, builds and operates sovereign AI, HPC, storage and low-latency infrastructure for Australian research, government, defence and industry. Every claim on this page is meant to be checkable. Where a figure is still unverified we have said so in the markup rather than quietly rounding it.
Mission
It usually arrives as a procurement clause — data stays onshore, the supplier is local — and then nobody specifies the fabric, the filesystem, the support path or the key custody that would make the clause true.
Where the data already sits, and what it costs to move it. Nearly every estate we are asked to build is really a data-gravity problem wearing a compute badge. A telescope archive, a genomics cohort, a decade of tick data or a classified imagery holding cannot be shifted twice for convenience. The machine goes to the data, the residency boundary follows the data, and the network bill is decided long before anyone picks a GPU.
Australia funds ambitious science and ambitious defence programmes, then rents the layer underneath them by the hour inside someone else's control plane. That is a reasonable trade for bursty work. It stops being reasonable when the workload is classified, when the dataset is too large to egress, or when a three-year training run meets a capital budget.
So we build that layer in-country: the cluster, the interconnect, the parallel filesystem, the scheduler policy, the key hierarchy, the change process and the people who can be phoned at three in the morning. None of it is exotic. It is unglamorous, it is chronically under-resourced, and it is the part that decides whether a research programme lands or slips a year.
We are deliberately small. That caps how many estates we can hold at once, and it is the reason the engineer who chose your blocking ratio is still the one who owns it two years later. When we are at capacity we say so rather than hiring a bench to absorb the work.
A data residency clause is not a design. Someone still has to decide where the metadata lives.
Operating principles
Not values on a wall. Each one is checkable during an engagement, each one has a cost we absorb, and we have lost work over every single one of them.
Send us the workload, not the requirement. An input deck, a packet capture, a model checkpoint, a day of market data, a Nextflow run — whatever the real thing is. We profile it, we find the term that dominates elapsed time, and the quote arrives with the measurement attached. If the workload cannot leave your environment we quote a benchmarking engagement first and nothing else, and we will run it on your hardware under your supervision.
Every figure we state carries how it was produced: the tool and version, build flags, node and rank count, dataset shape, the run-to-run spread, and the runs we discarded and why. Where a result is a p50 we say p50. Where it is a best case we say best case. We also write up the engagements where our own design lost to a cheaper one, because a vendor who has never been beaten is a vendor who has not measured.
Vendor reference designs are useful and we read all of them. We will not hand one back with a cover page and a design fee. If your configuration genuinely is a standard build — and often it should be, because standard builds have firmware that has been tested — we tell you that and price it as integration work. The bespoke engineering goes where your constraint is unusual, which is rarely the node and frequently the data path.
Design, build and operations sit with the same small team. The person who chose your oversubscription ratio is named on the escalation roster for it, and that name is in the contract. The cost of this is capacity: we cannot take unlimited engagements, and we would rather close intake for a quarter than break the link between the design and the on-call roster.
Some workloads belong on a hyperscaler. Some belong on a national research facility where you already hold an allocation and are not using it. Some need a software engineer for six weeks, not a cluster — a single-threaded I/O loop is cheaper to fix than to out-build. When the measurement points somewhere other than us we write that down with the numbers, hand it over, and bill only the benchmarking effort we agreed in advance.
Team
Six practice owners. Each one is accountable for a layer of the stack end to end, from the specification through acceptance testing to the on-call rotation for the systems they designed.
Founder & Managing Director
Spent eleven years specifying research and trading infrastructure for other people before starting Cloud Natives to do the measurement work properly. Still writes the acceptance test plan personally for every engagement above a set contract value.
Chief Engineer — High Performance Computing
Owns cluster design and Slurm policy, from fair-share weighting and QoS tiers through to topology-aware placement and backfill behaviour. Has spent more of his career on queue wait than on FLOP rates, which is roughly the correct ratio.
Principal Engineer — AI Infrastructure
Designs GPU fabric and the inference path: vLLM serving topology, KV-cache behaviour, quantisation trade-offs and GPUDirect data movement. Argues that most training clusters are storage projects wearing an accelerator badge, and is usually right.
Head of Sovereign Delivery & Security
Leads IRAP engagement, Essential Eight uplift and the key-custody design that turns a residency claim into something demonstrable. Writes the system security plan before the rack elevations, not after the assessor asks for it.
Principal Architect — Storage & Data
Designs the tiering from NVMe scratch and NVMe-oF through Lustre or BeeGFS to object and tape, plus the metadata layer that decides whether any of it is usable. Benchmarks small-file and metadata operations first, because that is where estates actually fail.
Operations Lead — Sovereign NOC
Runs the in-country operations roster, the on-call rotation and the post-incident review process. Holds the rule that no change ships without a documented rollback, a named owner and a stated blast radius.
Partnerships
A partner tier buys firmware access, an engineering escalation path and spares logistics in-country. It should never be the reason a component appears in your bill of materials.
Real engineering value, and it is specific.
The specification. Rebate structures move on a quarterly cycle and estates live for five to seven years, so a design tuned to this quarter's incentive is a design that ages badly. We keep three rules.
One harness, one dataset, one set of build flags, run across every candidate. The comparison goes to you with the raw output, including the configurations we could not make work and what we think that means. Vendor-supplied numbers are recorded as vendor-supplied and are never mixed into our own results.
Certifications & governance
An accreditation without a certificate number, a scope statement and an expiry date is a logo, not a control. Treat every row below as unproven until the evidence column is filled in.
| Accreditation | Scope as stated | Status | Evidence we must supply |
|---|---|---|---|
| IRAP assessment | Sovereign managed platforms and the NOC that operates them, to PROTECTED | To confirm | Assessor name, assessment date, security assessment report, residual risk register |
| ISO/IEC 27001 | Information security management across engineering delivery and operations | To confirm | Certificate number, certifying body, scope statement, current Statement of Applicability |
| ISO 9001 | Quality management for design, build and acceptance testing | To confirm | Certificate number, last surveillance audit date, open non-conformances |
| Defence Industry Security Program | Membership category and the facilities and personnel it covers | To confirm | Membership confirmation, entry level for each of the four categories, sponsor |
| Essential Eight | Our own corporate and management environments, not the client estate | To confirm | Target maturity level, whether the assessment is self-assessed or independent, date |
| Personnel clearances | Which roles hold Baseline, NV1 or NV2, and which engagements require them | To confirm | Count by level and sponsoring entity. Individual names are never published |
| Insurance | Professional indemnity, public liability and cyber liability | To confirm | Insurer, policy numbers, limits and expiry — buyers request these at tender stage |
Ownership and control are in the fact list at the top of this page and must be confirmed against the current company register before you rely on them. For sovereign engagements we accept a change-of-control notification clause with a defined notice period and a termination right, because a change in beneficial ownership is exactly the event a residency requirement exists to survive.
We subcontract physical work — cabling, fit-out, freight and some facilities trades — and we name those parties before award. Engineering, operations and incident response stay with our own staff in Australia. Vendor support is the honest exception: a firmware defect can require a vendor engineer offshore, and we design the access path for that case in advance, with session recording, time-boxed credentials and a nominated Australian escort on the call.
Everything we build is documented to the standard another team could take over: as-built topology, configuration in version control you hold, runbooks, the acceptance test suite and the monitoring definitions. We use open orchestration and open filesystems by default — Slurm, Kubernetes, Lustre, BeeGFS, Ceph — so the exit path does not depend on us existing. Ask for the handover pack during evaluation rather than at termination.
A single workstation or a two-node build is worth a conversation and is often the right first step for a research group or an early-stage team. What we decline is work where nobody will own the outcome operationally, or where we are being asked to supply a quote to make someone else's tender look competitive. We would rather say no in week one than deliver something with no owner.
Careers
There is no graduate programme and no bench. If you want breadth across silicon, fabric, filesystem and scheduler, this is a good place to work. If you want to specialise very narrowly at enormous scale, a hyperscaler will serve you better.
Ask us something specific
We would rather answer a hard due-diligence question early than win a tender we cannot evidence. Bring the security questionnaire, the residency constraint or the awkward architecture review — whichever one is currently blocking you.
Sydney · Melbourne · Canberra. Australian owned, Australian staffed.