Job History Pt2
Well… I’m glad to see the whole “Keep me honest” shtick has really worked on me…
The last 9 months has been a little bit of a whirlwind, I’ve managed to complete my SANS SEC301, attended Black Hat EU in London last December… and then there’s fact that this post is an update on a very new happening, in keeping with the topic at hand! So, without further ado… Job History Pt2:
“Slightly Larger water”, was in fact Amazon. I joined Amazon as an IT Support Engineer based out in a data center, looking after the folk who ran the infrastructure that keeps AWS ‘in the cloud’. I was lucky to be working in a highly secure environment, which very few folks got to actually see, and was able to make a difference.
I quickly realized that there were very few IT Support folks out on the ground in data centers. Mainly because there was an abundance of data techs, networking folk and other highly technical people… There were also, however some less “IT” technical folk out there (Engineering folk are very technical but not with computers!)… So I set about trying to find all the other IT folk, and created a mini program to align all our practise, and to help the central support teams (like helpdesk and product teams) to have enough information to help support folk in data centers. (DCs are different to offices, I promise ya!)
Meanwhile I also, was helping out in Amazon’s Corporate UK HQ in London at least one day a week, and travelling up to Cambridge to help in our development center up there too (and to see the rest of my team!).
I also managed an employee engagement program called “Voice of the engineer”. Once a month I selected ~10 engineers from across Europe at random to take part in a set of calls with a focus on influencing change. One call had a guest speaker from IT leadership, another would have a guest speaker from a part of the business the engineers had discussed on an early call and the outcome was to make small changes which impacted everyday life, PLUS have the chance to feedback to senior leaders. It was rare for junior engineers to have the chance to meet senior leaders in such an intimate environment and the leaders were equally keen to hear what the folk on the “shop floor” had to say.
Whilst I was looking after the data center folk, I was lucky enough to be landed a number of seriously huge projects, often by accident which had a wide reach and really, unwittingly prepared me for what was to come; I deployed the SIP phone system to over 50 sites across Europe and created runbook for local sites to onboard as part of standard site build process, I managed an emergency asset management program in response to a security issue, trying to identify and locate over 4,000 devices worldwide, and I deployed iPad based timeclocks to 50 sites in 10 countries working with vendors to build and prepare the iPad/stands so that all local staff had to do was switch on and set it to their site!
And then… the world decided to throw a spanner in the works – COVID19.
COVID 19 changed the way that the world worked, with the cloud becoming more important that ever, this meant scaling up, hiring more critical employees and growing teams.
I asked how we were sending laptops to new employees working in data centers. Long and short answer was, we weren’t… but it wasn’t an issue because this would “all blow over in 2 weeks”…
2 days later, the phone rang and this was now my problem to solve… not just for data centers but for all corporate employees!
Together with a crack team of some of the cleverest people I know, we set out to turn Amazon’s onboarding program on it’s head… Historically if you were based at home or in a place with only a small office, you’d get flown in to the nearest large campus to receive your laptop. Now all of a sudden, no one could go out of their house!
Between us, working more hours that I knew were possible to fit into a day, we worked out a way to begin to manage the gargantuan number of employees onboarding to corporate roles per week (4,000 was a “small week”).
I worked on physically securing the device to meet the security team’s needs – Tamper proof bags, separate shipping of laptops and keys… I helped to prepare the security key portal to be accessible outside of the network, and prepared the workflows and documentation for managers and new employees…
I managed large scale onboarding events, working out who got which sort of device and then I re-engineered the entire onboarding instructions from start to finish – our original ones had been created with a “2 weeks only” mindset!
As we realised that this might be going on for longer than 2 weeks, I also developed a program to monitor and alert us and managers on new hires that hadn’t logged in on their first day. In the space of about 3 days, a group of us wrote scripts to check user accounts, prepared endless video call bridges and prepared for a mammoth Monday of monitoring.
I started things off about 11pm checking in with Australia, and then was back up at 7am working through Europe, and then America… The pilot was successful, even though we did manage to accidentally email Jeff B (that’s a story for some beers!)… and we were hitting an 85% success rate… plus lots of feedback to make things better! (I think by the time I moved on we were hitting about 96-98%!)
I was blessed with the privilege to talk about my pandemic work at two internal conferences; one about how we obsessed over customers to make things better, and the other about how we used Agile practise for non-software to improve the way we delivered!
As the pandemic stabilized, and then started the long road to winding down, I managed to get my job title changed to reflect what I was actually doing (TPM) but, I started to get bored. I had felt the rush of the chase, and needed something new to dig my teeth into! A colleague of mine said to me one day “You’ve been doing security for ages, why don’t you actually come and do some security” …
Thinking I stood no chance, I applied for an internal role, interviewed (in what was probably my hardest interview cycle ever!) and somehow… got the job!
I spent the first 9 months in security working on how Amazon asses, manages and deprecates third party software packages being used by developers. A ‘baptism of fire’ would be an understatement! I got deep into the weeds of how Amazon’s build systems, package managers and deployment tools worked. I’m immensely grateful to those who helped teach me how all the things worked (you know who you are!) and helped me make sure I didn’t make lots of silly mistakes… (I think I only wrote 2 COEs aka correction of errors reports/Root cause analysis… that’s good, right?).
From there I looked at setting the strategies for building new AWS regions with security tools being built automated to reduce manual work and then moved into creation strategies for Vulnerability management in some of AWS’s more unique environments.
Finally, I looked after Compliance Summaries for the VM team, and identification and migration from operating systems that will soon be End-of-life being used by teams supporting AWS Services – I was so lucky during my time at AWS to be able to work closely with so many of the teams that support and operate the tools we take for granted every day (S3, EC2 etc).
As many of you will know, after 5.5 years of being an Amazonian, I decided I needed a new challenge and so on the 6th of August, my time as ‘sphllp’ ended!
I’m super excited to be starting a new chapter as IT Security Manager at CFC Underwriting this week – My ‘ticklist’ for a new role was:
- Stick within Security
- Do something/work for someone you believe in
- Try and step a little bit outside your comfort zone.
Well, I think “Market Leading Cyber Insurance” ticks the boxes for staying within security and something I believe in… and leaving Amazon is certainly a step outside of my comfort zone! I’m super excited to see where this takes me, for the challenge ahead, and to meet new people in a new environment and learn lots of new things!
Let’s see if it encourages me to write more on this blog!