Projects I've run

1. IT departmentsSecurity

   Building IT for a software company from 0 to 450 people

   Venture-backed software company · two-person IT team

   The problem

   The company grew fast and had no IT function. Laptops, accounts, and SaaS apps grew without a plan. Enterprise customers then asked for a SOC 2 Type 2 report.

   What I did

   • Designed the IT function and scaled it to 450 people with one other IT person.
   • Put every laptop under device management with full-disk encryption.
   • Set an offboarding policy of 24 hours. Most departures were done in about 10 minutes.
   • Moved chat to Slack Enterprise Grid.
   • Owned the IT controls for access and endpoints in the SOC 2 Type 2 audit.

   Result

   Two people supported 450 employees. Laptop encryption had no gap when the company was acquired, and most offboarding took about 10 minutes.

2. IT departments

   Rebuilding IT operations after a run of acquisitions

   About 1,600 people in 18 countries

   The problem

   After a run of acquisitions, IT support tickets increased by 60%. The team did not get more people. Reports were wrong, much of the work was not tracked, and documentation was thin.

   What I did

   • Corrected the service-level reports. 106 tickets showed as breached, but the team had resolved them.
   • Set standards for ticket status and category. No ticket stays open longer than 90 days.
   • Put all non-ticket work on boards: one for acquisitions, one for IT operations, and one for executives.
   • Wrote runbooks where none existed and proposed a tiered support model.
   • Wrote ownership charts with Facilities and Security, so each task has one owner.
   • Set a patch standard: deploy within 30 days, and keep each operating system no more than one version behind.
   • Built an app catalog that records the budget owner, contract owner, and admin for each app.

   Result

   The team handles more work with the same headcount. An 11-part roadmap, approved by leadership, sets the next year.

3. AI and automationIT departments

   Turning an inherited IT bot into a useful tool

   Internal IT and HR help bot · work in progress

   The problem

   The IT team inherited a chat bot for IT and HR questions. Few people used it, and it did little real work.

   What I did

   • Set the design rules. AI reads the request, and fixed automation makes the change, so every change has an audit trail.
   • Added a human approval step. The bot cannot approve its own requests.
   • Pointed the bot at work that repeats every week, starting with app license requests.
   • Defined how the team measures success before the next launch.

   Result

   The work continues. The goal is a bot that closes simple requests and gives the team time back.

4. AI and automationSecurity

   Putting limits on AI spend and AI models

   Company-wide AI tools · finance and leadership reporting

   The problem

   AI tools spread across the company quickly. Costs went up each month, and nobody owned the list of approved models.

   What I did

   • Set a low-cost model as the default and blocked the most expensive model for coding tools.
   • Made premium models available by approval only.
   • Created a group that freezes spend for users who reach the monthly limit.
   • Started a monthly AI spend report to finance and to the CTO.
   • Proposed a monthly review that removes old models and makes IT the owner of the approved model list.

   Result

   AI spend is visible every month. Spend limits now apply to coding assistants, and new models go through one approval path.

5. AI and automationIT departments

   Teaching an IT team to build with AI

   IT team of about 20 · AI coding tools

   The problem

   People on the team built quick scripts with AI, but other teams were not able to run them. Each script depended on the person who wrote it.

   What I did

   • Built a Slack channel migration tool with an AI coding assistant and deployed it on Google Cloud. It uses AI to match users across workspaces.
   • Made a rule that every AI-built tool gets a user interface and documentation, so the business can run it without IT.
   • Started a team exercise every two weeks. Each person builds and plays a small game on the internal AI platform.

   Result

   The team builds tools that other departments use. The exercise became the team-building goal for the year.

6. AI and automation

   An AI agent that keeps project tickets current

   Meeting notes, Slack, email, and Jira

   The problem

   Decisions made in meetings and in chat often did not get back to the ticket that tracked the work.

   What I did

   • Built an agent that reads the meeting notes after each meeting and comments on the matching Jira issue.
   • Limited the agent to two projects and to comments only. It cannot move or close work.
   • Made updates from Slack and email ask for approval before the agent posts them.

   Result

   Tickets show what the team decided, and nobody types it twice.

7. Acquisitions

   Merging an acquired company into the parent Google Workspace

   About 100 people · cutover over one weekend

   The problem

   An acquired company used its own Google Workspace. Its people had to move to the parent tenant with mail, calendars, files, groups, and integrations intact. In an earlier migration, copies of Drive files broke every shared link.

   What I did

   • Created 118 groups and 717 group memberships before the cutover.
   • Wrote an Apps Script tool that moves Drive files instead of copying them, so links continue to work. It logs each move and can restart where it stopped.
   • Automated shared drive creation and user mapping with a service account.
   • Listed every app that used Sign in with Google. Each app got a color for who had to act: IT, the user, or nobody.
   • Reviewed 23 workflow automations that depended on the old accounts.

   Result

   The cutover took one weekend. All Drive files and links came through. Duplicate calendar events were the main problem, and they affected 11 people.

8. AcquisitionsDevices

   Moving acquired laptops to company management

   Three acquisitions · Mac and Windows

   The problem

   The old company of each acquired team managed its laptops. The laptops had to move to the parent device management and endpoint protection. IT did not have the time to touch every machine.

   What I did

   • Built a self-service Mac migration with about 30 minutes of work for each person and a 30-day window.
   • Wrote the guide and the announcement, reminder, and last-day messages for email and Slack. Each round used the feedback from the last round.
   • Ran the Windows migration in waves. Problems showed up in a small group first.

   Result

   All 38 Macs in the last round enrolled by the deadline. Three days before the deadline, 27 were still open. The Windows fleet reached 75% after two waves, and 15 machines needed no help.

9. Acquisitions

   Integrating acquisitions on short notice

   Small acquisitions in several countries

   The problem

   Some acquisitions closed with almost no warning. The new people still needed email, accounts, and laptops on day one.

   What I did

   • Brought a 28-person company into IT with one day of notice before close.
   • Migrated the full email environment of one acquisition alone in one week.
   • Shipped laptops to new staff in other countries and set them up remotely.
   • Started a pre-close questionnaire and a playbook with one owner for each workstream.
   • Added a rule to the playbook. The acquired company hands over all assets and credentials within 30 days of close.

   Result

   Each new team started work on day one. The next acquisition starts from a written plan.

10. IdentityAcquisitions

    Retiring two inherited identity providers

    Entra ID · SAML, OIDC, and SCIM

    The problem

    Two acquired companies kept their own Okta tenants. Employees signed in in two places, and IT paid for both. Some people use their original company address, and other people use the parent address.

    What I did

    • Moved apps to Entra ID one at a time. The old and new sign-in ran in parallel, so nobody lost access during a move.
    • Wrote a NameID rule that uses a directory attribute when it has a value and the primary email when it does not. Provisioning uses the same split.
    • Set up OIDC and SCIM for a product admin platform. One group provisions the user, and a separate group gives admin rights without a reset of other settings.
    • Increased the rate of new SSO apps from about one each week toward one each day, against a backlog of about 100 apps.

    Result

    The CRM moved to automated provisioning with no interruption. Both inherited identity providers have a shutdown date early next year.

11. DevicesSecurity

    Tying every laptop to an owner

    About 1,600 devices · five systems of record

    The problem

    The asset tracker, two device management platforms, endpoint protection, and the HR system did not agree. Each one had a different list of laptops and owners.

    What I did

    • Designed a report that matches each employee to a laptop serial number and to an endpoint protection record. It started as a quarterly audit at an earlier company.
    • Directed the build of the report with a member of my team.
    • Wrote a script that moved 60 laptops from the wrong endpoint protection account to the correct one.
    • Fixed 66 devices from three acquisitions and resolved 56 endpoint vulnerabilities in one day.

    Result

    The report found 373 people with no assigned device and 28 laptops in a storage locker that no system knew about. Full compliance went from 66% to 77% in two months. The target is 98% by year end.

12. Security

    Choosing and rolling out a secure web gateway

    About 1,700 endpoints · two proofs of concept

    The problem

    The company used DNS filtering only. It needed a full secure web gateway that worked with the existing VPN and with offices on three continents.

    What I did

    • Ran two vendor proofs of concept at the same time.
    • Removed the first vendor because it conflicted with the full-tunnel VPN.
    • Tested the second vendor with 10 people in India, Argentina, and North America.
    • Negotiated a two-year agreement through the reseller.

    Result

    Testing found no problems in the three regions. The gateway replaces the old DNS filter.

13. CloudAI and automation

    One source of truth for people data

    Google Cloud · HR, identity, and security pipelines

    The problem

    Data pulls from the HR system and the endpoint security platform ran as scripts on an on-prem server. The vendors accept API calls only from an IP address on their allowlist.

    What I did

    • Designed a gateway project in Google Cloud with one static outbound IP for all vendor allowlists.
    • Moved each pipeline to Cloud Run in its own project, with results in BigQuery. HR data and security data stay separate.
    • Made the HR pipeline refresh every day and stop the sync when it finds an error.
    • Wrote the architecture document with an AI assistant and reviewed it with the team.

    Result

    IT, HR, and identity tools read one daily copy of people data. Vendors allowlist one IP, and the old server is on its way out.

14. Offices

    Fixing an overheated server room, then every server room

    Office network room · planned power outage

    The problem

    During a planned building power outage, an office server room went above 30°C. The portable air conditioner was on the same circuit as the network equipment, so it lost power too.

    What I did

    • Measured the heat load of the room: about 1,020 W, or 3,425 BTU per hour.
    • Specified a dedicated 1.25-ton cooling unit on its own circuit.
    • Started an audit of the server room at every site against written temperature standards.

    Result

    The cooling fix came from measurements. Every office now has one standard instead of one fix for one room.

15. Offices

    Two new floors, one closed office, and a refresh cut to budget

    High-rise build-out · office closure · meeting rooms

    The problem

    In one quarter, two floors of a high-rise office needed a network build-out, and one office closed. A meeting room refresh came back far over budget.

    What I did

    • Scoped low-voltage cabling for access points, cameras, card readers, check-in displays, and meeting rooms on two floors.
    • Closed the office and arranged certified laptop destruction weeks before the lease ended.
    • Cut the refresh from five meeting rooms to three when the bid came in at three times the budget.
    • Replaced the door access, cameras, and network in an office in India.

    Result

    Each project had one owner and ran through vendors. IT did not need staff on site full time.

16. Acquisitions

    Moving an acquired team to the company phone system

    About 100 people · RingCentral

    The problem

    An acquired team had to move to the parent phone system. Seven of their extensions were already in use by some of the 130 existing users.

    What I did

    • Changed the 7 extensions that conflicted. The 130 existing users kept their numbers.
    • Told each person who was affected about the new number before go-live.
    • Kept franchise numbers for non-employees out of scope after a review of the deal terms.

    Result

    The team went live on the new system. The old phone licenses ended four days later.

17. AcquisitionsIT departments

    Finding every tool an acquisition brought with it

    Tools and contracts from 18 sources

    The problem

    Each acquisition brings its own SaaS subscriptions, chat workspaces, device accounts, and contracts. Nobody had the full list.

    What I did

    • Built an acquisition tracker in one night. It pulls tool and contract data from 18 sources.
    • Found 172 Slack workspaces on company domains and made the case for one organization.
    • Removed 187 unused licenses from nearly 2,000 seats in one platform.
    • Merged 8 Apple Business Manager accounts into one.
    • Stopped duplicate billing that came with acquired companies.

    Result

    One list shows what each acquired company pays for, and fewer seats are paid for twice.

No projects match that filter.