Situation
S1 was moving its EDR platform and management console into the cloud. The product had started life self-hosted, shipped as a VMware image running Docker containers. Compliance gaps in the cloud move were affecting sales. Before I joined, I helped the future CISO build the plan for what S1 needed to do: a diagnosis of the architecture and tech stack and the proposed fixes. He was given the Cloud Ops org and invited me in as Senior Director of Cloud Operations.
The EDR data platform was S3 fronted by Presto, which I flagged before I started as likely the wrong choice for the workload. There was no analysis of cloud spend. The working model in accounting was that cloud spend scales with deployed agents. The existing route to AWS Security Competency was a two-year plan with an outside firm.
Objective
Land six things in roughly 18 months, ahead of the IPO. That window was set when I joined in January 2021, before the IPO was accelerated to June 2021. The six:
- AWS Security Competency certification.
- FedRAMP Moderate recertification.
- SOC 2 Type 2 certification.
- Support the SOX audit.
- Renegotiate a long-term AWS contract and drive cost optimization.
- Strengthen the Cloud Ops team, a small team of about four in Israel.
Approach
- Cost analytics first. With a data contractor, I pulled S1’s actual AWS spend into a small analytics environment and built the real picture. Kubernetes practices and the Presto platform were driving inefficient spend. I modeled a new spend plan, a migration to Graviton and other optimizations, and pushed to remove Presto.
- Architecture and the AWS relationship. I set a contractor to documenting the cloud architecture and building the relationship with the AWS account team.
- The organization. With the IPO accelerated, an engineering reorg handed me about 60 people: Cloud Ops, the Kubernetes engineering and ops teams, and the data org. I flew to Tel Aviv to meet them, reshaped them into a CI/CD/SRE function, a Cloud Ops group and others, and promoted several people to manager and director.
- Certifications. With a small team, I completed a substantial number of corrective actions and drove S1 through SOX, SOC 2 Type 2 and the FedRAMP Moderate recertification, ahead of the accelerated IPO schedule.
- Scalyr. Through the Scalyr acquisition I was briefly given its engineering org. I sponsored and funded moving Scalyr onto Kubernetes and mandated cloud-first practice: integrated CI/CD and right-scaling.
- AWS Security Competency, done lean. I replaced the multi-year outside-firm plan, filled in the paperwork myself, and scoped the certification tightly to the Scalyr platform in a hardened AWS account that exceeded the control requirements. That bypassed the planned two-year migration to a new landing zone.
- Data and analytics. I put forward a dedicated budget for an Enterprise Data & Analytics org, justified by the cloud-cost savings. The org was filled in February 2022.
- Scale. A major European retailer required S1 on GCP in the EU, which meant porting the custom Kubernetes machinery to GCP: a custom HPA for Presto and extensions letting any engineering team request any EC2 instance type. Thousands of nodes across 100+ EC2 instance types were hard to manage and hard to cost-optimize with reservations. With development expanding to India, my teams spanned the US for FedRAMP support, Tel Aviv, the EU and India.
In April 2022 a new leader took the org and I moved to a Principal Engineer role focused on architecture and data analytics across AWS and GCP spend.
Net results
- The IPO landed in June 2021.
- On October 13, 2021, S1 announced it had achieved AWS Security Competency. That put S1 on the AWS Marketplace: AWS customers can buy S1 with the spend counting against their AWS commitments, and AWS trains its own sales force to sell it.
- S1 came through SOX, SOC 2 Type 2 and the FedRAMP Moderate recertification.
- I also joined S1’s interview team.
Takeaway: scope a certification tightly to a hardened account and it can land fast instead of on a two-year plan.
Scope and technologies
AWS, including S3 and Graviton; Presto, the EDR data platform; Kubernetes; GCP; Docker and VMware for the legacy self-hosted console image; Scalyr; the EDR/XDR platform; AWS Security Competency, FedRAMP Moderate, SOC 2 Type 2 and SOX; FinOps and cost analytics.