Short notes on the risks I found, the tradeoffs I made, and what changed once the controls met real users. Grouped roughly by where I spend my time now versus where I started.
Most of my recent work: who gets access to what, how that is decided, and how it expires.
Every provisioning and authorization service had its own idea of who someone was and what they should get, so they drifted apart and nobody could say which one was right. I built the API and system of record for personas and access policies, with a single lifecycle model the others read from instead of keeping private copies. Once there was one answer, joiners, movers and leavers stopped being three separate problems.
Read case studyAccess was granted per person per system, which does not survive a reorg. I worked with system owners across the business to inventory the access levels that actually existed, defined personas over them, and standardized the team attribute in HR data so group membership derived from employment facts rather than from tickets. Changing teams changed access on its own.
Getting elevated access meant knowing who to ask. I built a chat-based workflow, in the tool engineers already had open, that handled scoped requests, approval, grant issuance and automatic expiry under one operating model across every privileged system in scope. Approval stayed human; the parts that were only ever bookkeeping stopped being manual.
Read case studySecret writes had become the fastest-growing reason people asked for elevated access, which meant handing out broad privilege for a narrow task. The fix was not another approval step: I built a CLI that provisioned scoped write roles from existing ownership data, inside the identity the engineer already had, so there was nothing new to learn and nothing to escalate. Most of that category stopped needing privileged access at all.
Database work drove the other large share of recurring escalation, but session capture, credential rotation and audit logging are solved problems and rebuilding them would have been vanity. I ran the evaluation, the commercial negotiation and the internal deployment for a managed platform instead, then wired it to persona-based roles with write grants that expired on their own. I also wrote the onboarding runbook, so adding the next database did not route through me.
Access reviews were only as good as what system owners remembered to declare, which is the wrong place to source audit evidence. Owners reviewed independently collected effective-access data against the written policy, with drift remediated before sign-off rather than noted beside it. The evidence came from the systems themselves, not from the people being reviewed.
Machine credentials were multiplying faster than human accounts, nobody owned them, and there was not even a list. I wrote the connectors that crawled each source into a single inventory with an owner attributed to every credential, plus the control indicators that scored hygiene and the findings worklist that fell out of them. Visibility first, and it was the input to automated cleanup.
Emergency access had drifted into being routine access. I made justifications mandatory and built a workflow that reviewed every session and summarized what the engineer actually did, which was a depth of review nobody was ever going to reach by hand. Then I interviewed the heaviest users, because the useful question was not who used it but which requests were habit that a better path would remove.
Standing privileged AWS access had spread until it covered effectively all of engineering, which makes the privilege meaningless and the audit trail worse. I set up a recurring entitlement cleanup that expired access nobody was exercising, bringing the standing population down to a small reviewed group. Making it recurring was the point; a one-off cleanup drifts back within a quarter.
High-risk internal platform APIs were reachable by far more people than needed them, and nobody had a map of who could call what. I built the authorization inventory that produced that map, which gave a working group what it needed to redesign roles deliberately instead of guessing. Access to the risky endpoints came back to the teams that actually used them.
We could not say how far identity governance had actually got, which makes prioritization guesswork and progress unprovable. I built a coverage funnel that tracked every system through four stages: inventoried, policy defined, connected, and governed. Leadership got a live view instead of an anecdote, and the next investment went where the funnel was narrowest.
The platforms the company connects and works through, and the automation that keeps them honest.
I led the zero-trust access platform the whole company connected through, which is by definition a system where mistakes are expensive and immediately visible. That included a full client and appliance upgrade delivered without user-facing downtime, and a DNS rework that cut what it cost to operate. Most of the effort went into planning the failure cases, and the upgrade itself was uneventful, which was the point.
Some teams were stuck on the old VPN because local development broke over zero-trust access and nobody had chased down why. I reproduced the failures on my own machine instead of trading logs, found the real cause, and fixed it through personas so the whole team inherited the fix rather than each person carrying a workaround. That closed the last dependency keeping those teams on the legacy path.
Network access did not care whether a laptop was managed, so a personal machine could reach internal systems. I designed and implemented device-posture enforcement at the access layer, along with the scheduled jobs and monitoring that kept the posture data current, because a posture check is worthless if the data behind it is stale. Unmanaged devices stopped being a way in.
Answering whether anything on our laptops was affected by a given threat used to take days of asking around. I shipped an osquery-based platform where a merged query became a fleet-wide report, so the question ran on demand. It was the fastest route to checking exposure during supply-chain scares and to inventorying things we did not know were installed, including shadow AI tooling.
Offboarding depended on someone remembering a checklist, which is how departed employees keep working laptops. I wrote the services that tagged device owners, off-boarded on exit and wiped automatically, and built it with the People team so it fit how departures actually ran rather than imposing a security-shaped process on them. Adoption was the whole game with this one.
Admin activity in our identity and network tooling was visible only inside each vendor console, which is useless in the middle of an incident. I wrote services in Go and Rust that forwarded governance and audit logs into central monitoring, with dashboards over them, so who-changed-what-and-when was a query. Investigating stopped meaning logging into five consoles.
Rotating SSO signing certificates is the kind of routine task that locks the entire company out if you get it wrong. I worked through every SAML application with its owner, sequenced the rollover, and nobody lost the ability to log in. Unremarkable by design.
Earlier work, and where my instinct for how things break came from.
Every internet-facing resource needed a WAF, including several that no team still owned and had to be tracked down first. The part that mattered was defining all of it in Terraform with a deployment pipeline behind it, which turned a rule change from an unaudited console edit into a reviewed pull request that shipped in minutes. That was why Log4Shell was a tuning exercise rather than an outage, and why we could run in block mode without eating real revenue.
Security review that happens after code ships is mostly archaeology. I wired static analysis into every Go project in the company so vulnerabilities and hygiene problems surfaced in the pull request, while the author still had the context to fix them cheaply. Coverage was the point: a scanner on some of the repositories tells you very little.
Bug bounty and dependency findings arrive faster than one team can fix them, and the security team never owns the code. I ran triage with security champions across six engineering teams, including P1 and P2 reports, and drove fixes through the owners instead of filing tickets at them. Building the champion relationships turned out to be more of the job than the triage.
One misconfigured bucket is a data breach, and the estate had accumulated exceptions nobody could justify. I worked through them and blocked public access across the board, which turned the failure from something you have to keep catching into something the platform refuses outright. Clearing the exceptions was the slow part.
Our WAF logs were capturing Authorization headers into storage that plenty of people could read, so a security control was itself creating a credential exposure. I got them redacted at the source.