Writing
Searchable posts on AI governance, security, leadership, and platform engineering.
Featured
Your Security Program Is a Sales Asset. Start Treating It Like One.
Why provable security closes deals in regulated industries — and why the next budget conversation should lead with revenue, not fear.
AWS Cost Levers That Actually Moved the Needle
Cutting ~35% off a multi-region AWS footprint with no capability loss — the levers in the order they paid back, best first.
More posts
The Eight-Domain Azure Security Review for Regulated Environments
An automated tool scores your Azure posture; an assessor walks your architecture. The eight domains I review, in the order an audit walks them, and the evidence each one has to produce.
The Audit Passed in March. Is It Still True?
Point-in-time certification is the floor, not the goal. The case for continuous assurance over annual audits.
How to Report Risk to People Who Don't Speak Security
Translating security for boards and investors — the three questions leadership actually asks, and how to answer them.
Security and DevOps Under One Roof: Why I Stopped Apologizing for It
The case for the dual mandate, and why org-chart distance doesn't create security.
Capital Allocation Governance: The Framework Companies Build Too Late
Mid-market capital allocation is rarely a strategy — it's individual capex, M&A, and debt decisions made in isolation. The governance framework that makes it programmatic.
Board Reporting That Drives Decisions, Not Status Updates
The fifty-page board pre-read is the artifact most responsible for meetings that produce no decisions. Three sections fix it.
The First 100 Days: A Post-Close Cyber Integration Playbook
The post-close decade is decided in the first 100 days. The eight cyber controls to ship by day 30, and the identity-sprawl audit every exit diligence will run.
Cloud FinOps for the Mid-Market: Where 25–40% of Spend Actually Hides
The press-release version of cloud savings cancels workloads and books compliance debt. The version that lasts is commitment management and SaaS rationalization.
