Audit to the Rescue? – Investments Unlimited Series: Chapter 12

Welcome to the twelfth installment of IT Revolution’s series based on the book Investments Unlimited: A Novel about DevOps, Security, Audit Compliance, and Thriving in the Digital Age, written by Helen Beal, Bill Bensing, Jason Cox, Michael Edenzon, Tapabrata Pal, Caleb Queern, John Rzeszotarski, Andres Vega, and John Willis.

Last time, our hero Michelle rebounded from executive roasting to rally her exhausted but willing Turbo Eureka crew! But after initial triumphs taming IUI’s vast, unwieldy governance beast, progress has stalled! With the deadline in sight but some applications still unaccounted for, can Michelle spur her squad toward one final foolproof push past the plateau? Or will the bumpy road toward modernization still throw stubborn obstacles, foiling even Michelle’s sterling track record of skill, passion, and grit? Stay tuned as the future of reform at Investments Unlimited hangs delicately in the balance!

Tuesday, December 13th

After two months of steady growth, the onboarding progress had stalled. At their weekly meeting, Barry pointed to a chart that one of his associates created with data pulled from the Turbo Eureka API.

“You see? It’s leveling out. Right there,” he said as he pointed to the right side of the chart, which depicted a linear growth in onboarding numbers until the last two weeks, when the slope of the line turned horizontal. “You all were making such great progress, but now I’m concerned.”

To date, Turbo Eureka had onboarded over 850 components across 94 TLCs. It was impressive progress, but Barry was right—the numbers were leveling off and the team didn’t know why.

Michelle and Omar looked at each other in dismay.

“What do you think it could be?” Omar whispered.

Michelle shrugged.

After the meeting, Michelle darted back to her desk. She knew that applications were being built because it was one of the busiest times of the year for IUI, so it didn’t make sense that their onboarding had leveled off.

Michelle remembered that IUI’s CI platform stored some build data in a database. A few years ago the platform team hired a few contractors to implement basic platform monitoring. As a part of that work, the contractors installed some custom scripts on the platform that shipped a subset of the raw data to an external database. She opened a high-priority service ticket to get an extract of the data for the past six months.

As a hands-on technical person, Michelle never shied away from ad hoc coding and scripting to get her work done. She opened up Jupyter notebook and after half an hour or so, she had her notebook ready with some Python code to analyze the data extract.

Two hours later, Michelle received the data extract download link from the platform team and ran her code. While looking at the charts, she muttered to herself, “That’s interesting,” and then she headed to Carol’s office.

“Carol, take a look at this,” Michelle said. She walked Carol through her findings that showed that Turbo Eureka had only captured about 60% of the builds that occurred in the pipeline since they implemented the automated onboarding feature. “As I looked through the missed builds, I noticed a trend. See the pipeline library that they’re using? That’s the old pipeline library.”

“The old pipeline library?” Omar looked confused. “I didn’t know we had an old one.”

“Yes,” Carol said. She had been at IUI longer than Michelle or Omar. “The enterprise standard pipeline library was part of IUI’s original digital transformation six years ago. One of the primary efforts was to establish a standard across the enterprise for building and deploying code. Adoption of this standard library was very slow until two years ago, when an internal audit began pressing for teams to comply with enterprise standards. But, as this data shows, some application teams are still on the legacy pipeline.”

The applications that Michelle’s data identified to be using the legacy pipeline library were unable to migrate to the enterprise standard because their code bases were old, in some cases over fifteen years old. These required highly tailored build scripts that were so specific that the pipeline development team didn’t have the resources to migrate them to the new standard. These applications, deemed “legacy,” were not required to migrate to the new enterprise standard pipeline library, and therefore remained out of reach for onboarding.

Thursday, December 15th

Later that week, members of Team Kraken presented the findings to Barry and Tim.

Recently, Security had taken an even keener interest in Turbo Eureka. After Turbo Eureka’s early successes, they started seeing opportunities for reducing the less-scalable manual processes that had been employed through the years.

“I’ve been giving regular updates to Tim on your progress, and he’s here today to help remove anything that may be blocking you.” Barry turned to his boss. “Tim, as you know, I’ve worked very closely with Michelle and her team through the development phase and now during the onboarding. I’m here to make sure that we’re all communicating with one another and that the expectations of each team are clear.”

Omar rolled his eyes, as Barry always seemed to make himself the hero when his boss was in the room.

Carol opened up by giving the context of the previous meeting. She recalled that the team took an action item to review pipeline data for possible explanations as to why automated onboarding had stalled. When it was her turn, Michelle explained her findings that an unknown number of components across an estimated eighty-nine TLCs were still using the old pipeline library.

She began to explain that during the digital transformation, all applications were expected to move to the new shared pipeline library, but applications that were deemed “legacy” were allowed to continue using the old pipelines. An estimated eighty-nine TLCs were still using the old pipelines that were built five or six years ago.

Carol started by saying how Michelle and her team tried to get to the bottom of some onboarding discrepancies that they were seeing. She then went on to explain why the auto-onboarding process is failing in some cases.

“Can we stop right here?” Tim said, exhibiting frustration at the growing intricacies of the conversation. “What’s the total number here? How many TLC numbers have been onboarded?”

“Almost a hundred,” Omar proudly responded.

“How many exactly?” Tim responded.

Omar was clearly annoyed, but he took a breath and replied, “Ninety-four.”

Tim continued, “Okay. And that’s out of how many?”

Carol interjected, “One hundred and eighty-three.”

Tim scrunched his eyebrows and tilted his head back. “That doesn’t sound right.” He turned to Barry for confirmation.

Carol interjected before Barry could clarify, “We have 587 TLCs across IUI, of which 183 are eligible for onboarding, and of which we have onboarded 94.”

Barry jumped in. “I think what Tim is looking for is a breakdown of this. Maybe a chart that shows the TLCs that are considered in and out of scope for automated governance.”

“Sure, we can break that down for you right now,” Omar said, rising to the board.

“No, I need something I can share at the next huddle. I want to see a slide with, like, a box here,” Tim said, gesturing above his head. “And then two boxes here  .  .  . ” He lowered his left hand and added in his right, signaling two boxes. “And then just keep stepping down with each one, explaining what’s in what category and so on.”

Omar and Michelle looked at each other and sheepishly nodded.

“We can do that,” Michelle said as she turned her head toward Tim.

“Great, thanks.” He stood up and started toward the exit.

The meeting had lasted only four minutes.

Barry hustled after Tim to chat on their way to the elevator. Carol, Omar, and Michelle stayed behind.

Omar waited until the door closed before lamenting his frustrations.

“What the heck was that?” he asked. “He didn’t even want to hear us out. Why did Barry even call this meeting? And why do executives always need a slide deck?” Omar looked toward Carol, who lightly smiled but kept her eyes on her laptop as she checked her email inbox. She always tried to keep herself out of negative conversations.

Unsatisfied with Carol’s passive response, Omar continued, “I mean, seriously! Tim didn’t even want to talk through this, he only wanted to tell us how he wanted the slide to look. Doesn’t that bother you?”

In his time at IUI, Omar had been used to engaging with leaders who always brought their whole self to a meeting. He was clearly irked by the short and dismissive tone that Tim struck.

“Yeah, it bothers me, but I get where he’s coming from,” Michelle replied. “Our pipelines are a mess, and that’s a problem.”

Michelle paused and took a deep breath before finally turning her attention away from her laptop screen toward Omar. “Last night I pulled every change record from the past year to cross-reference with our onboarding data. There are an additional twenty-two TLCs that we didn’t account for in our initial data extraction.”

“So now the total is 205?” Omar asked.

Michelle nodded.

“Wait, hang on, what does that mean? Those are all old apps, right?” Carol asked.

“Well, not necessarily,” Michelle replied. “The twenty-two that I found are all relatively new applications  .  .  . ” She briefly paused. “At least based on our definitions.”

“How were we missing them this whole time?” Carol asked, clearly upset at the apparent setback in their progress.

Michelle shrugged. “I don’t know. But we’re quickly running out of time.”

Wednesday, January 4th

For the first time in her life, Michelle was starting to feel burned out. And it wasn’t just the post-holiday blues. She was in bed with her laptop propped on a pillow. She had just finished the grueling task of getting her twins down for the night. She desperately wished she had some way of funneling a bit of their boundless energy. She could use it right now.

She felt like she had been endlessly squashing one obstacle after the next since the MRIA was first brought to IUI’s attention more than nine months ago. And now, with the final deadline for delivering their engineering solution looming ever closer, they had been hit with yet another apparently unsolvable problem.

After three nights of combing through pipeline logs and code commits, Michelle felt herself losing sight of her original goal. She reached for her notepad and a pen, and wrote out:

• Total apps: 205  (183 + 22 new)
• Onboarded apps: 94
• Remaining: 111
• Legacy apps = ?
• Remainder = ?

She felt much more comfortable after writing it down on paper. It didn’t take her long to regain focus and dive back into the datasets.

She punched away at her keyboard as she wove an unholy web of messy, hard, duplicative Python code in her Jupyter notebook. As fervently as she espoused her beliefs of clean code when building software, she was quick to cut corners when it came to hacking scripts together to crunch data. But her sloppy scripting produced clean results, and that’s all she needed at the moment. After another hour of aggregating data across disparate systems, she found a notable trend.

“Aha!”

“Shh.” Her wife had just walked in. “You really want to wake the double tornado?”

“No! Sorry. But I think I finally figured something out.”

“Excellent. Tell me all about it tomorrow. For now, you need to sleep.” She reached across the bed and shut Michelle’s laptop, lightly kissing her on the forehead.

Thursday, January 5th

The next day, Michelle joined the team late for standup. She had brought Carol with her. As they were getting closer and closer to the end date, they needed all the senior muscle they could get. When it was her turn, Michelle displayed her Jupyter notebook in a browser window. At first glance it looked like a confusing mixture of code and spreadsheets, layered vertically such that the user had to continuously scroll to see the resulting output.

As Michelle finished scrolling, she began to describe her findings.

“As you all know, we’re now aware of 205 custom-developed IUI applications, of which we have onboarded 94. That means that we have 111 applications that remain unaccounted for. But after combing through our data, I found that at least three dozen of the 111 elusive applications shared similar idiosyncratic patterns across their code repositories.”

“What do you mean?” asked Omar.

“Well, take this repository, for example: mortgage-account-migration-service,” she pointed to the screen as she switched tabs to reveal the main page of the code repository, which displayed files and folders. “This code repository belongs to an application within the consumer lending division. Do you notice anything about the files in the root directory?” she asked.

“I don’t see a build file,” Omar added.

“Exactly!” said Michelle.

IUI used a tool for pipeline builds that required a specific type of build file in the root of the repository’s directory to provide instructions to the build pipeline on how to test, compile, and publish the code in the repository. But the mortgage-account-migration-service repository did not have such a build file, and neither did any of the three dozen repositories that Michelle discovered the night before.

“How do they build their code if they don’t have a build file?” asked Omar.

“I asked myself the same thing, but look at this file here  .  .  . ” Michelle slid her cursor over a file called “appfile.yaml” in the repository’s root directory. She right-clicked and selected Open Link in New Tab from the list of options.

“See this?” she said as she gestured back toward the screen while the page loaded. “Each of the three dozen or so apps that I mentioned use this appfile.yaml.”

“What the heck is that?” asked Omar.

“I wondered the same thing, but I called an old friend in the consumer lending division and they explained to me that a few years back they began building a framework called ‘AppRails’ that would abstract, standardize, and automate many of the nuanced configurations around consumer lending’s CI/CD processes.”

“Oh, I’ve heard of AppRails. They’re such a pain to work with! Every time they have trouble deploying they come to us and say it’s our fault,” Dillon complained.

“Yep, that’s the one,” Michelle said with a slight smile.

“How did they get away with this one-off pipeline?” Omar asked.

“Well,” Carol piped up. “It’s not a one-off, it’s legacy. Consumer lending is the newest division within IUI. When it comes to their technology, they’re always starting fresh. The group was formed in the early days of DevOps and their leadership championed DevOps practices from the start, even before the rest of IUI began to onboard those practices. Thus, consumer lending built their own CI/CD process and automation outside of the emerging enterprise standards.”

Omar interjected, “I still don’t understand  .  .  .  what is AppRails?”

Michelle responded, “AppRails is the consumer lending pipeline.”

“Well  .  .  .  it’s more than that,” Carol replied. “Yes, AppRails is the consumer lending build pipeline. But it also contains lots of ‘black box’ automation that handles things like dependency management and base images. They also use it to deploy. But the deployment part involves many manual approval steps—even though they make it look ‘automated.’”

“How have they been allowed to do that for so long?” Omar asked.

Carol shrugged. “Back then there was no policy that mandated conforming to a single enterprise build and deploy pipeline, so they obtained admin service accounts to all of the tool chain platforms and servers, and they’ve been running their own CI/CD ever since.”

“Michelle, what are we going to do?” Omar asked.

“I’m not sure,” Michelle replied. How they were going to onboard a completely incompatible pipeline before their next meeting with Tim seemed an impossible mission.

“As much as I hate to admit failure, I don’t think there’s any way to get them onboarded in the time we have until the final completion date for remediation of the MRIA is here.” Michelle turned to Carol.

Carol looked back at Michelle. “I think we’ll have to get Jennifer involved.”

“What have you got for me?” Jennifer said, getting straight to the point. It was late, and it was obvious she was eager to get through this meeting.

Carol had been able to get some time scheduled with Jennifer, the SVP of Engineering and CIO, at the end of the day for a brief fifteen-minute meeting. Michelle just hoped that would be enough time to convince her that Team Kraken had addressed enough of the MRIA’s findings to move forward with the final report without onboarding every TLC, including the AppRails team. They would just need more time to finish the full transfer to the new system.

Carol started, “Well, as you know, Michelle and her team are working toward Tim’s desire to achieve 100% onboarding of the new automated governance system before the project completion date with the regulators. But they’ve recently made a discovery that will certainly hinder that goal, if not derail it completely.” 

“Right. So as you know, we were hitting some great trajectory with onboarding using the automated onboarding at the ‘checkout’ stage for apps. But then it plateaued. We couldn’t figure out why until we discovered that some of the apps weren’t using our standard build files but were using  .  .  . ” Michelle paused. Jennifer looked like she was losing patience.

“Anyway, the point is that one of the consumer divisions is using AppRails, a completely different pipeline from the rest of IUI. There’s just no way to get them onto Turbo Eureka before our deadline. We’ll need at least a few months, if not more  .  .  . ”

“Hold on,” Jennifer interrupted. “Why can’t we just require them to make the switch? This is no time to be nice about it. Just get them onboard.”

“Well, it’s not quite that simple, Jennifer,” Carol said.

“Enlighten me.”

“Well, migrating the AppRails pipeline onto the enterprise pipeline will take a lot of money and time, and obviously we don’t have the time at this moment. Even if we did, it’s going to require a ton of hand holding  .  .  . ”

“If they can’t migrate, then just combine the two pipelines. Smash them together or do whatever it is you need to do to make them compatible.”

“It doesn’t work that way. It’s like having the wrong plug, Jennifer,” Michelle interjected. “It’s like you’re trying to connect your phone’s USB-C cable to your laptop but your laptop only has USB-A ports. And unlike in the real world, there is no converter out there. It’s just not possible to smash the two systems together.”

“So invent a converter and do it fast. We have to submit that final status report to Susan and the other execs next Tuesday. And we can’t pass the external audit and the regulators with such a large number of important apps remaining outside the scope of onboarding for this automated governance solution. And  .  .  . ” Jennifer paused, took a deep breath, and said gravely, “If we don’t pass, then I don’t think I have to tell you that we’ll all be on the job hunt. And good luck in the future with this failure on our heads.”

Jennifer sat down, indicating an obvious end to the meeting. Carol and Michelle walked out and shut the door behind them.

“Shit,” Michelle said, half under her breath. That had been no help at all.

Michelle left the office that day feeling defeated, to say the least. It was obvious that the stress of the looming deadline was putting everyone on edge. But Michelle had never been on a receiving end that bad before. It didn’t seem like Carol had any sway here. They were going to have to find support from somewhere else. But where?

Over the next few weeks, Michelle and her team wracked their brains trying to come up with a solution. All the while they continued onboarding as many TLCs as they could. 

The Friday before the “big meeting,” as the team had come to call it, Michelle went home with a feeling of dread she hadn’t experienced before. On Tuesday they would have to present their final MRIA response to the executive team. They would be showing how Turbo Eureka was addressing and solving every concern from the MRIA and the preceding MRAs before they took it to the CEO, then the board, and finally to the regulators. If the regulators weren’t satisfied that IUI had mitigated the concerns from the MRAs and MRIAs, Michelle and her whole team, not to mention the rest of IUI, would be in serious trouble.

It was safe to say Michelle was feeling miserable. How were they going to convince everyone that they had accomplished enough in the last year to meet the MRIA findings? How could they convince everyone that 100% onboarding of the new system wasn’t just unrealistic—it was simply impossible?

Michelle felt like a zombie as she sat through dinner that night. Later on she laid in her bed staring at the ceiling, listening to her wife’s soft breathing. Most nights she would be asleep before her head hit the pillow, but not tonight. She could even hear the twins turning over in the other room. Her brain just couldn’t shut off. There had to be some answer she hadn’t thought of. Some silver bullet or golden ticket that would magically make everything fall neatly into place. In the early hours of the morning, she drifted off to sleep, but as she awoke, the sun just peeking through her blinds, her brain picked up where it had left off and whirred until the twins piled in, clamoring for cuddles.

All weekend, Michelle tried to forget about work and focus on her family. But she wasn’t very successful. She found herself constantly sniping at her twins until her wife finally broke the tension by insisting on a movie marathon, complete with carpet picnic.

They watched some superhero flick, and Michelle actually cracked a smile watching her twins zooming around the room like characters from the movie, pretending to rescue their stuffed animals together. It was an unusual union, the two of them working together. More often than not they were like oil and water.

And she knew the feeling. It was like having to work with Audit: different points of view that never seem to mix. But sometimes, just like the success they had working with Bill, Barry, and Andrea, an unlikely union forms and you see the impossible become possible. Suddenly, an idea popped into Michelle’s head. Yes, that’s it! she thought with glee.

Monday, February 6th

Monday morning Michelle all but sprinted into the office and made her way straight to Andrea’s desk. She wasn’t in yet, so Michelle plopped herself down in Andrea’s chair, bouncing her leg with impatience. There was a framed picture of Andrea on her desk, her back to the camera, but her piles of red hair cascading down her back were unmistakable. She was on top of a mountain, looking up at the Milky Way. A blonde dog sat next to her. Next to the picture, an empty South Park coaster sat and a cute pink and white striped jar of candy grabbed Michelle’s attention. Michelle couldn’t help herself. She lifted the lid and had just stuck her fingers in when she heard someone.

“Help yourself.”

“Oh, sorry!” Michelle spun around, dropping the lid back on the jar a bit more forcefully than she meant to. Andrea laughed. “Sorry. Um, good morning. I have a request of you—well, of Audit, I meant.” Michelle stood up, offering Andrea her seat.

“Okay. You have a request of Audit? Go ahead,” Andrea said, sitting down in her chair and looking at Michelle with an air of curiosity.

Michelle launched into the same explanation she had given Jennifer, keeping it as succinct as she could, pacing herself as she saw that Andrea was actively and thoughtfully listening. “So, I’ve come here looking for some support from Audit. If Audit could back us up, if they could show that we’ve made a good-faith effort and that we have plans to onboard the rest of the TLCs, but that we just need more time, then we might all make it through the Big Meeting with our jobs still intact.”

“Why can’t these teams using AppRails be merged?” Andrea asked.

“They can be, but it will take more time than we have,” Michelle tried to explain.

“Okay, now let’s walk this back,” Andrea said. “AppRails can’t be migrated in time to meet the deadline. But that 100% onboarding deadline was set by Tim, right? But tomorrow’s meeting is all about showing that we’ve delivered on our promises to the regulators. All we need to do is ensure that our response has specifically addressed the concerns in the MRIA to be compliant. So what was the exact language from the MRIA again?”

“You’re right! Wait a second. Let me pull that up.” Michelle opened her laptop, glad she came straight to Andrea’s desk before dropping her stuff off at her own. “Here it is. The MRIA said they found ‘inconsistent process, ineffective in ensuring security and compliance, resulting in unauthorized and vulnerable software with a significant number of defects being released to production.’”

Andrea read the line over and over again. Michelle just stared at her, impatient but trying to give her the time she needed to figure out a solution.

“I need coffee,” Andrea blurted out. Michelle gaped at her as Andrea walked off and came back a few minutes later with a steaming mug in her hands. She sat back down and looked at the MRIA findings again.

“So,” Michelle prodded.

“Shh,” was Andrea’s only response.

Michelle slumped onto the floor, her back against Andrea’s cubicle wall. Just as she thought she was about to nod off, Andrea broke the silence.

“Aha!” Andrea said, with a bit too much enthusiasm. “Sorry, but this is perfect. It’s so simple. You have your answer right there.”

“I do? But we haven’t got all the TLCs onboard with our automated governance, and we won’t be able to before the deadline. Tim is adamant that we need 100%  .  .  . ”

“Tell me, dear Watson,” Andrea said, a small smirk forming on her face. “Where in the MRIA does it say the word ‘automated?’”

Michelle chewed on that for a moment. “Well, uh, it doesn’t.”

“Exactly. Based on the language in the MRIA, I think we’re satisfactorily meeting the requirements as long as every TLC at IUI is following the same set of rules that we laid out, which are:

• Enforce peer reviews of code that is pushed to a production environment.
• Identify and enforce minimum quality gates.
• Remove all elevated access to all production environments for everyone.

The MRIA doesn’t give us any specifications about how to follow those rules. Turbo Eureka has solved this for most of the TLCs for the enterprise that are using enterprise standard. It’s on AppRails pipeline users to provide evidence of these for every production release from now onwards,” Andrea explained.

“So, as is, AppRails deployment has manual processes involving multiple approval steps,” Michelle replied. “But it’s not going to be easy for them with this extra manual work, and they may not have a system to store the evidence.”

“Well, AppRails and other teams will have to manually upload the evidence to the CMDB system. They need to review those with the CAB and get their approval captured before they release anything.” Andrea sounded like she wanted to make things harder for teams that weren’t willing to onboard onto automated governance. “And we’ll audit them frequently to make sure they are following all the policies laid out in the automated version.”

“Seriously? ’Cause I just don’t think that’s going to fly with Tim and Jennifer.”

“Well, let’s get some more muscle to back us up.” Andrea winked. “And by the way, between you and me, I hope this manual work causes some extra pain to the AppRails users. It may actually push them to migrate to the enterprise standards sooner.”

Andrea turned to her computer and began typing a message into the interoffice chat. “I’ll see if we can’t get on Jada’s calendar before the end of the day. She’s usually good about keeping a few ten-minute spots on her calendar open for unexpected asks from her team.”

“Do you really think it’s this easy? That we’ve actually fulfilled the requirements?”

“You know, Audit isn’t out to make your lives difficult. We’re actually here to help,” Andrea said with a smile. “So, yeah. As long as these other teams are manually following the policies laid out in the automated governance, then we’ve achieved our goal. We are doing what we say we are doing.”

Michelle smiled back. It felt good to have Audit on her team instead of feeling like they were against her. In fact, she finally felt like they were really fulfilling on all the promises made by DevOps in the first place. There didn’t need to be walls between silos. Audit didn’t need to be the enemy, the oil to their water. They really could work together. And it felt great when they did.

Another gut check as Michelle borders on burnout striving to uphold her initial reform promises while key culture clashes, staffing churn, and complex legacy loopholes threaten pace! Mercifully, lucid Lucy of log monitoring returns with visionary notions of risk transparency! But Omar’s skepticism persists given IUI’s piecemeal digitization! Can Michelle maintain morale and momentum after constant fire drills and mixed messages? Are accumulating quick-fix loops now unfixable without a complete paradigm flip? Hold onto your hats with just three months until judgment day! Join us next time for the continuation of the story. Or, go to your favorite book retailer and pick up a copy of Investments Unlimited today.

- About The Authors

IT Revolution

Trusted by technology leaders worldwide. Since publishing The Phoenix Project in 2013, and launching DevOps Enterprise Summit in 2014, we’ve been assembling guidance from industry experts and top practitioners.

Follow IT Revolution on Social Media

• 
• 
• 

Helen Beal

Coauthor of Investments Unlimited.

Follow Helen on Social Media

• 
• 

Bill Bensing

Bill Bensing tranforms Shadow IT into legitimate software development organizations. Bill's recent thought-leadership is proving software devliery velocity and highly secure and compliant software are not mutally exclusive. He lives in Tampa Bay, FL, area.

Follow Bill on Social Media

• 
• 

Jason Cox

Director, Global SRE @ Disney | Speaker | Co-Author of Investments Unlimited

Follow Jason on Social Media

• 
• 

Michael Edenzon

Michael Edenzon is a senior IT leader and engineer that modernizes and disrupts the technical landscape for highly-regulated organizations. Michael provides technical design, decisioning, and solutioning across complex verticals and leverages continuous learning practices to drive organizational change. He is a fervent advocate for the developer experience and believes that enablement-focused automation is the key to building compliant software at scale.

Follow Michael on Social Media

• 
•