[{"data":1,"prerenderedAt":1621},["ShallowReactive",2],{"references":3},[4,484,776,1045,1350],{"_path":5,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":9,"description":10,"date":11,"period":12,"sector":13,"scale":14,"role":15,"mandate":16,"category":17,"tags":18,"body":25,"_type":477,"_id":478,"_source":479,"_file":480,"_stem":481,"_extension":482,"sitemap":483},"\u002Freferences\u002Ftechnical-dethernety","references",false,"","Dethernety: a graph-native threat modeling platform","A solo-built threat modeling platform where security models live in version control. The build process shifted partway through from traditional development to a spec-first, agent-reviewed, human-adjudicated workflow.","2024-01-01","2024 – present","Security tooling and AI-native development","Solo-built platform: multi-tier SaaS on AWS, Claude Code plugin, open-core monorepo","Founder and builder","Build a graph-native threat modeling platform usable by engineers day to day, designed commercially from the start with an open core.","Technical",[19,20,21,22,23,24],"threat modeling","AI-native development","graph databases","SaaS architecture","Claude Code","security",{"type":26,"children":27,"toc":461},"root",[28,37,43,48,53,58,64,69,75,80,93,99,106,117,148,153,163,185,195,201,221,227,237,242,282,304,310,340,346,351,356,361,366,372,377,382,387,392,397,401,409],{"type":29,"tag":30,"props":31,"children":33},"element","h2",{"id":32},"context",[34],{"type":35,"value":36},"text","Context",{"type":29,"tag":38,"props":39,"children":40},"p",{},[41],{"type":35,"value":42},"Dethernety started as a side project. Several things lined up: a chance to sharpen my development, graph, security, cloud, and AI work in the same place; something I could use directly in client engagements; and a genuine product underneath if it landed. I went full focus when I closed my last consulting engagement in mid-2025.",{"type":29,"tag":38,"props":44,"children":45},{},[46],{"type":35,"value":47},"The existing tooling sat on the wrong foundation. Security is a graph problem — components, trust boundaries, attack paths, and controls all relate as a graph — and graph-native threat modeling did not exist. It still does not, beyond what I have built.",{"type":29,"tag":38,"props":49,"children":50},{},[51],{"type":35,"value":52},"The status quo is the part you might recognize. Threat modeling as most organizations practice it produces diagrams that sit on shelves: models that are not executable, not versionable in any real sense, and not connected to the code they describe. Security architects draw them once and move on. Engineers never see them again. The gap between \"we did threat modeling\" and \"our threat model reflects what we actually ship\" is where most of the risk lives.",{"type":29,"tag":38,"props":54,"children":55},{},[56],{"type":35,"value":57},"What I set out to build was a graph-native threat modeling platform that treats models as code and lives in the engineer's editor.",{"type":29,"tag":30,"props":59,"children":61},{"id":60},"mandate",[62],{"type":35,"value":63},"Mandate",{"type":29,"tag":38,"props":65,"children":66},{},[67],{"type":35,"value":68},"A self-set one. Build Dethernety as a graph-native threat modeling platform that engineers can use day to day, not only security architects. Design it commercially from the start, with multiple plausible revenue paths in mind: SaaS in tiers, on-prem deployment, a module marketplace, supporting tools like Studio, and services around the product. Ship the SaaS first, with an open core. The open-source layer has to be genuinely useful on its own; the proprietary layer handles the infrastructure and provisioning nobody wants to solve themselves.",{"type":29,"tag":30,"props":70,"children":72},{"id":71},"role",[73],{"type":35,"value":74},"Role",{"type":29,"tag":38,"props":76,"children":77},{},[78],{"type":35,"value":79},"Solo builder. Product, architecture, code, ops, documentation, every decision. No team, no cofounder, no external sponsor pushing for a specific direction. Every technical call is mine; every misjudgement is mine to recover from.",{"type":29,"tag":38,"props":81,"children":82},{},[83,85,91],{"type":35,"value":84},"The shape of solo building is not what it looks like from the outside. A material share of the work is deciding what ",{"type":29,"tag":86,"props":87,"children":88},"em",{},[89],{"type":35,"value":90},"not",{"type":35,"value":92}," to do. Solo time is the most finite resource on the project, and there is always more work visible than can fit into it.",{"type":29,"tag":30,"props":94,"children":96},{"id":95},"approach",[97],{"type":35,"value":98},"Approach",{"type":29,"tag":100,"props":101,"children":103},"h3",{"id":102},"platform-components",[104],{"type":35,"value":105},"Platform components",{"type":29,"tag":38,"props":107,"children":108},{},[109,115],{"type":29,"tag":110,"props":111,"children":112},"strong",{},[113],{"type":35,"value":114},"Backend.",{"type":35,"value":116}," The backend is a NestJS service exposing a GraphQL API with queries, mutations, and subscriptions. The domain model is a graph, so the storage is a graph: Neo4j or Memgraph holds the live model, with components, trust boundaries, data flows, attack paths, and countermeasures as first-class graph entities. GraphQL query definitions are shared across the platform's consumers: the web UI, the CLI, the Claude Code plugin, and the MCP server all pull from one source of truth.",{"type":29,"tag":38,"props":118,"children":119},{},[120,125,127,132,134,139,141,146],{"type":29,"tag":110,"props":121,"children":122},{},[123],{"type":35,"value":124},"Module ecosystem.",{"type":35,"value":126}," A module provides the classes of the system: ",{"type":29,"tag":86,"props":128,"children":129},{},[130],{"type":35,"value":131},"design classes",{"type":35,"value":133}," for the things being modelled, ",{"type":29,"tag":86,"props":135,"children":136},{},[137],{"type":35,"value":138},"analysis classes",{"type":35,"value":140}," for the lenses applied to them, and ",{"type":29,"tag":86,"props":142,"children":143},{},[144],{"type":35,"value":145},"issue classes",{"type":35,"value":147}," for issues and their integration with external trackers like GitHub or Jira. Modules are JavaScript libraries, so the integration surface is extensible: a new tracker means a new module, not a platform change. The MITRE ATT&CK and D3FEND frameworks are loaded as graph; how a model's components link to specific techniques and countermeasures is decided by the module's logic on the relevant attributes, not by a platform default.",{"type":29,"tag":38,"props":149,"children":150},{},[151],{"type":35,"value":152},"Analysis runs at two levels. Component-level analyses evaluate one element at a time, and the engine is swappable per module: a generic module can use OPA\u002FRego, another can use static graph queries, others can do something different again. Model-level analyses operate across the whole graph, and that is where the graph-native shape matters most; an integrated LangGraph service is one of the paths a module can take for AI-assisted analyses. The first-party modules cover the core domain and the MITRE frameworks; custom rules ship as new modules, not platform forks.",{"type":29,"tag":38,"props":154,"children":155},{},[156,161],{"type":29,"tag":110,"props":157,"children":158},{},[159],{"type":35,"value":160},"Web frontend.",{"type":35,"value":162}," The web UI is a Vue 3 single-page application built around an interactive diagram, and the module system extends into it. Property panels are generated from module-defined JSON Schemas via JSONForms, so when a module ships new classes the form UI for those classes appears without a frontend release. Modules can also register custom Vue components at runtime, with the host application exposing the Vue runtime and composables so modules do not bundle their own. Vue Flow drives the data-flow editor, with hierarchical trust boundaries and direct assignment of MITRE techniques on diagram elements. Authentication is OIDC with PKCE against the usual identity providers, Cognito and Keycloak among them.",{"type":29,"tag":38,"props":164,"children":165},{},[166,171,173,183],{"type":29,"tag":110,"props":167,"children":168},{},[169],{"type":35,"value":170},"Dethereal plugin.",{"type":35,"value":172}," The platform's second frontend is a Claude Code plugin for building threat models, sitting in the engineer's editor. It replaces the blank-page problem of traditional threat modeling tools with a fixed eleven-step staged-delegation workflow, where each step is a specialist agent proposing changes the user adjudicates before anything persists. The assumption underneath: novice modellers cannot articulate what a threat model needs up front, but they can recognize good answers. A staged workflow with agent proposals moves the work from articulation to recognition, and that shift is the innovation. Models persist as disk files, resumable across sessions and committable to git. I wrote the plugin design up separately in ",{"type":29,"tag":174,"props":175,"children":177},"a",{"href":176},"\u002Finsights\u002Feleven-steps-you-dont-type",[178],{"type":29,"tag":86,"props":179,"children":180},{},[181],{"type":35,"value":182},"Eleven Steps You Don't Type",{"type":35,"value":184},".",{"type":29,"tag":38,"props":186,"children":187},{},[188,193],{"type":29,"tag":110,"props":189,"children":190},{},[191],{"type":35,"value":192},"Studio.",{"type":35,"value":194}," Authoring modules has its own surface. Studio is a standalone application for designing, testing, and packaging modules: AI-assisted class generation through LangGraph pipelines, a form editor with live preview that renders classes the way end users will see them, Rego authoring with sample-input validation, and module packaging for deployment. Dethereal builds threat models out of existing modules; Studio builds the modules those threat models use.",{"type":29,"tag":100,"props":196,"children":198},{"id":197},"deployment",[199],{"type":35,"value":200},"Deployment",{"type":29,"tag":38,"props":202,"children":203},{},[204,209,211,220],{"type":29,"tag":110,"props":205,"children":206},{},[207],{"type":35,"value":208},"Multi-tenant SaaS on AWS, designed for compromise.",{"type":35,"value":210}," The SaaS side is built on the assumption that any multi-tenant system will eventually be partially compromised, and that the right question is what a compromise can reach. The answer in Dethernety is: not much. Each customer gets their own network segment, their own identity pool, their own compute (single-instance on the entry tier, K3s on the higher tiers), their own CloudFront distribution over a VPC Origin, and their own IAM role scoped by hardcoded resource ARNs. Terraform state is per-customer. There is no shared runtime data plane between tenants. The entry tier runs on Fedora CoreOS with an immutable read-only root, so a compromised node cannot persist changes that survive a reboot; the higher tiers move to K3s with the same isolation posture. I wrote the architecture up across a five-part series, starting with ",{"type":29,"tag":174,"props":212,"children":214},{"href":213},"\u002Finsights\u002Farchitecture-overview",[215],{"type":29,"tag":86,"props":216,"children":217},{},[218],{"type":35,"value":219},"Architecture Overview",{"type":35,"value":184},{"type":29,"tag":100,"props":222,"children":224},{"id":223},"development-methodology",[225],{"type":35,"value":226},"Development methodology",{"type":29,"tag":38,"props":228,"children":229},{},[230,235],{"type":29,"tag":110,"props":231,"children":232},{},[233],{"type":35,"value":234},"AI-native, spec-first, agent-reviewed.",{"type":35,"value":236}," The methodology shifted partway through. Dethernety started as a normal development project: specs as prose, implementation as a series of commits, tests written against features. As the generation of tooling around Claude Code matured, I moved the project to a spec-driven, AI-native workflow that now carries most of the platform's development.",{"type":29,"tag":38,"props":238,"children":239},{},[240],{"type":35,"value":241},"The architecture stays mine. AI generates implementation; I own the system shape, the data model, the API surface, the analysis subsystem boundaries. Code review depends on the surface: the backend gets read line by line; the web frontend and Studio ride the workflow more directly, with review at the gate rather than at every line.",{"type":29,"tag":38,"props":243,"children":244},{},[245,247,252,254,259,261,266,268,273,275,280],{"type":35,"value":246},"The workflow has five phases with an explicit human-in-the-loop at each. ",{"type":29,"tag":86,"props":248,"children":249},{},[250],{"type":35,"value":251},"Intent by exploration",{"type":35,"value":253},": I describe what I want to build, and a specialist agent drafts a spec by exploring the existing code, asking clarifying questions, and proposing the shape. ",{"type":29,"tag":86,"props":255,"children":256},{},[257],{"type":35,"value":258},"Multi-agent review",{"type":35,"value":260},": the spec is reviewed by a set of agents with distinct specialties — security, architecture, graph theory, operations — each producing findings in its own voice rather than a merged consensus. ",{"type":29,"tag":86,"props":262,"children":263},{},[264],{"type":35,"value":265},"Sprint plan",{"type":35,"value":267},": once the spec clears blocking issues, it becomes a plan with user stories, definitions of done, references to the relevant code and docs, and test and evaluation strategies per story. ",{"type":29,"tag":86,"props":269,"children":270},{},[271],{"type":35,"value":272},"AI-driven implementation",{"type":35,"value":274},": the plan is executed with specialist agents where the work calls for it. ",{"type":29,"tag":86,"props":276,"children":277},{},[278],{"type":35,"value":279},"Comprehensive testing",{"type":35,"value":281},": unit, integration, and evaluation suites, with the eval layer specifically for agent-mediated work where traditional assertions fall short.",{"type":29,"tag":38,"props":283,"children":284},{},[285,287,294,296,302],{"type":35,"value":286},"Every phase gates on my judgement before the next one starts. The goal is to put the human where adjudication and direction actually matter, not where the human is a bottleneck on typing. All of this is encoded in the project's ",{"type":29,"tag":288,"props":289,"children":291},"code",{"className":290},[],[292],{"type":35,"value":293},".claude\u002F",{"type":35,"value":295}," configuration and ",{"type":29,"tag":288,"props":297,"children":299},{"className":298},[],[300],{"type":35,"value":301},".github\u002F",{"type":35,"value":303}," workflows, with slash commands gating PRs on boundary checks, security review, and documentation-staleness detection before anything ships.",{"type":29,"tag":30,"props":305,"children":307},{"id":306},"where-it-stands",[308],{"type":35,"value":309},"Where it stands",{"type":29,"tag":311,"props":312,"children":313},"ul",{},[314,320,325,330,335],{"type":29,"tag":315,"props":316,"children":317},"li",{},[318],{"type":35,"value":319},"Graph-native threat modeling platform with a multi-tier SaaS deployment on AWS, per-customer infrastructure isolation, and an open-core split (the OSS monorepo sits as a subtree of the private monorepo).",{"type":29,"tag":315,"props":321,"children":322},{},[323],{"type":35,"value":324},"Dethereal Claude Code plugin: eleven-step staged-delegation workflow, four specialist agents, a set of MCP tools, with permissions enforced at the tool layer rather than in prompts.",{"type":29,"tag":315,"props":326,"children":327},{},[328],{"type":35,"value":329},"Module system covering the core threat modeling domain and the MITRE ATT&CK \u002F D3FEND frameworks, with OPA\u002FRego policy evaluation and an extensibility boundary that avoids platform forks.",{"type":29,"tag":315,"props":331,"children":332},{},[333],{"type":35,"value":334},"AI-native development toolchain: specialist agents, slash commands, and workflow gates that operationalize the spec-first, multi-agent-reviewed, sprint-planned, agent-executed methodology across the monorepo.",{"type":29,"tag":315,"props":336,"children":337},{},[338],{"type":35,"value":339},"Six published essays on the underlying architecture and plugin design, with more in progress.",{"type":29,"tag":30,"props":341,"children":343},{"id":342},"what-made-it-hard",[344],{"type":35,"value":345},"What made it hard",{"type":29,"tag":38,"props":347,"children":348},{},[349],{"type":35,"value":350},"Solo breadth is the first constraint. Threat modeling, graph databases, SaaS infrastructure, immutable compute, AI-native tooling, and Claude Code plugin design are six different disciplines, each with depth I had to either reach into myself or delegate to a specialist agent. The scope of the work is not a decision I get to revisit. It is the shape of the product.",{"type":29,"tag":38,"props":352,"children":353},{},[354],{"type":35,"value":355},"The methodology pivot was expensive. Moving an in-flight project onto a spec-driven AI-native workflow is not a matter of configuring tools. It changes what \"done\" means, what a review looks like, and where the cost of a bad decision shows up. I lost time before I gained it. The gain came later and is now structural, but the transition was a cost I paid over several months with eyes open.",{"type":29,"tag":38,"props":357,"children":358},{},[359],{"type":35,"value":360},"Positioning is harder than the technology. A graph-native, AI-native, shift-left threat modeling platform is easy to describe technically and harder to place in a market used to document-first threat modeling tools on one side and chat-first AI copilots on the other. The product is neither of those, and naming that clearly without sounding like yet another \"we reinvented threat modeling\" pitch is a genuine writing problem.",{"type":29,"tag":38,"props":362,"children":363},{},[364],{"type":35,"value":365},"Solo pacing is its own discipline. Nobody else is going to notice that test coverage drifted, that a module interface is generating more coupling than it should, or that a dependency upgrade has sat on a branch for a week. The internal review function has to be real. The specialist agents help, and catch things a solo builder would miss, but the ultimate review is mine and I have to budget for it explicitly.",{"type":29,"tag":30,"props":367,"children":369},{"id":368},"what-i-took-from-it",[370],{"type":35,"value":371},"What I took from it",{"type":29,"tag":38,"props":373,"children":374},{},[375],{"type":35,"value":376},"Three things stuck.",{"type":29,"tag":38,"props":378,"children":379},{},[380],{"type":35,"value":381},"One: AI-native development, run with discipline, changes what you can build alone. Specialist agents do the bulk of the implementation; architecture stays human, and so does review on the parts that warrant it. The multi-year, multi-team work I have scoped for clients in the past is a different shape under that combination. The work is not easier. The ceiling of what one person can carry end to end has shifted, and I am still calibrating where the new one sits.",{"type":29,"tag":38,"props":383,"children":384},{},[385],{"type":35,"value":386},"Two: staged delegation beats free-form prompting in any domain where users cannot articulate what they want. The novice threat modeler does not know what a good threat model contains, and no amount of open prompting fixes that. A fixed workflow with specialist proposals at each step meets the user where they actually are. That pattern generalizes past threat modeling, and I am watching for the other domains it applies to.",{"type":29,"tag":38,"props":388,"children":389},{},[390],{"type":35,"value":391},"Three: treating infrastructure isolation as a design principle, not a configuration task, produces a posture you cannot retrofit. Designing Dethernety from the first line for per-customer isolation was more work up front than a shared-everything SaaS would have been, and it is now the part of the architecture I have to defend the least. The right default, chosen early, pays back every month.",{"type":29,"tag":38,"props":393,"children":394},{},[395],{"type":35,"value":396},"And the residue. Building solo with AI-native methods changed how I think about what consulting can deliver. A design I wrote as a consultant assumed the team on the other side could carry it. A system I build as Dethernety carries itself, with me doing the adjudication a team would otherwise do collectively. Those are not the same craft, and knowing where they converge is a live question I expect to be answering for a while.",{"type":29,"tag":398,"props":399,"children":400},"hr",{},[],{"type":29,"tag":38,"props":402,"children":403},{},[404],{"type":29,"tag":86,"props":405,"children":406},{},[407],{"type":35,"value":408},"Sources:",{"type":29,"tag":311,"props":410,"children":411},{},[412,426,439,451],{"type":29,"tag":315,"props":413,"children":414},{},[415],{"type":29,"tag":86,"props":416,"children":417},{},[418],{"type":29,"tag":174,"props":419,"children":423},{"href":420,"rel":421},"https:\u002F\u002Fdether.net",[422],"nofollow",[424],{"type":35,"value":425},"dether.net — project site",{"type":29,"tag":315,"props":427,"children":428},{},[429],{"type":29,"tag":86,"props":430,"children":431},{},[432],{"type":29,"tag":174,"props":433,"children":436},{"href":434,"rel":435},"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss",[422],[437],{"type":35,"value":438},"dethernety-oss on GitHub",{"type":29,"tag":315,"props":440,"children":441},{},[442,449],{"type":29,"tag":86,"props":443,"children":444},{},[445],{"type":29,"tag":174,"props":446,"children":447},{"href":213},[448],{"type":35,"value":219},{"type":35,"value":450}," — entry point for a five-part series on the AWS infrastructure (the four follow-up essays are linked at the end of the overview)",{"type":29,"tag":315,"props":452,"children":453},{},[454],{"type":29,"tag":86,"props":455,"children":456},{},[457],{"type":29,"tag":174,"props":458,"children":459},{"href":176},[460],{"type":35,"value":182},{"title":8,"searchDepth":462,"depth":462,"links":463},4,[464,466,467,468,474,475,476],{"id":32,"depth":465,"text":36},2,{"id":60,"depth":465,"text":63},{"id":71,"depth":465,"text":74},{"id":95,"depth":465,"text":98,"children":469},[470,472,473],{"id":102,"depth":471,"text":105},3,{"id":197,"depth":471,"text":200},{"id":223,"depth":471,"text":226},{"id":306,"depth":465,"text":309},{"id":342,"depth":465,"text":345},{"id":368,"depth":465,"text":371},"markdown","content:references:technical-dethernety.md","content","references\u002Ftechnical-dethernety.md","references\u002Ftechnical-dethernety","md",{"loc":5},{"_path":485,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":486,"description":487,"date":488,"period":489,"sector":490,"scale":491,"role":492,"mandate":493,"category":17,"tags":494,"body":501,"_type":477,"_id":772,"_source":479,"_file":773,"_stem":774,"_extension":482,"sitemap":775},"\u002Freferences\u002Ftechnical-inm-unified-operations","Technical foundations for iNM Unified Operations at EUROCONTROL","Digital Platform redesign and four technical-foundation workstreams — observability, CMDB, target operating model, and software supply chain — inside EUROCONTROL's integrated Network Manager programme.","2023-01-01","2023 – 2025","Air traffic management, European regulated body","Unified Operations programme for a pan-European safety-adjacent platform","Senior architecture consultant, via ATOS to EUROCONTROL iNM","Deliver the technical designs that would let the Unified Operations programme stand up an enterprise-grade operations capability for the integrated Network Manager.",[495,496,497,498,499,500],"architecture","observability","CMDB","CI\u002FCD","target operating model","regulated environments",{"type":26,"children":502,"toc":763},[503,507,512,517,522,526,531,535,540,545,549,559,564,569,579,589,599,609,614,619,625,658,662,667,672,677,682,686,690,695,700,705,710,713,721],{"type":29,"tag":30,"props":504,"children":505},{"id":32},[506],{"type":35,"value":36},{"type":29,"tag":38,"props":508,"children":509},{},[510],{"type":35,"value":511},"EUROCONTROL's integrated Network Manager (iNM) runs air traffic flow management for European airspace. It is a safety-adjacent, mission-critical platform under steady pressure to modernise without disturbing the operational system flying traffic every day.",{"type":29,"tag":38,"props":513,"children":514},{},[515],{"type":35,"value":516},"I joined the Unified Operations programme as a senior architecture consultant through ATOS. Unified Operations was the initiative to raise the technical operations side of iNM to enterprise-grade maturity. It covered the foundations an enterprise needs but that had not yet been put in place consistently for iNM: observability, configuration management, software supply chain, and the target operating model that ties those together.",{"type":29,"tag":38,"props":518,"children":519},{},[520],{"type":35,"value":521},"I worked five parallel tracks. Each had its own sponsors and its own scope. The most interesting part of the job was the ground between them.",{"type":29,"tag":30,"props":523,"children":524},{"id":60},[525],{"type":35,"value":63},{"type":29,"tag":38,"props":527,"children":528},{},[529],{"type":35,"value":530},"Deliver the technical designs across five workstreams that each closed a gap in the iNM operational foundation. The designs had to be implementable by internal teams after I was gone.",{"type":29,"tag":30,"props":532,"children":533},{"id":71},[534],{"type":35,"value":74},{"type":29,"tag":38,"props":536,"children":537},{},[538],{"type":35,"value":539},"Senior architecture consultant, engaged via ATOS on the iNM Unified Operations programme. I led the Digital Platform design activity until I left the engagement, and contributed as an individual on the other tracks. I worked alongside EUROCONTROL engineers and architects and other ATOS consultants on the same programme. For a short stretch I also acted as head of the DevOps team, which gave me a closer look at the function the target operating model had to describe.",{"type":29,"tag":38,"props":541,"children":542},{},[543],{"type":35,"value":544},"The engagement shape matters for how the work got done. You contribute, you do not own. The artefact is the deliverable, and it has to survive without you in the room.",{"type":29,"tag":30,"props":546,"children":547},{"id":95},[548],{"type":35,"value":98},{"type":29,"tag":38,"props":550,"children":551},{},[552,557],{"type":29,"tag":110,"props":553,"children":554},{},[555],{"type":35,"value":556},"Digital Platform redesign.",{"type":35,"value":558}," The largest track, and the one I led. A Digital Platform was already in place when I arrived, but it was not operationally viable: a monolith where components shipped on a single version line, no clear upgrade path, insufficient observability, heavy manual overhead, high run cost, and lock-in to a specific container platform. The redesign was the response, structured around a two-phase move. A tactical phase that deconstructed the monolith into independently manageable components and externalised the shared services — secrets, observability, load balancing, identity — while holding a hard constraint of zero impact on the Digital Products running on top. And a strategic phase that shifted the platform to cloud-native managed services, GitOps-driven deployment, and a multi-cloud posture with a second hyperscaler for disaster recovery.",{"type":29,"tag":38,"props":560,"children":561},{},[562],{"type":35,"value":563},"The design work itself had three layers that fit together. An architecture framework written as a set of chapters, each covering one dimension of the platform: security, resilience, disaster recovery, cost, evolution, integration. A modernisation and cost-optimisation strategy that gave the framework a direction of travel and took the run-cost problem on explicitly, with a tiered-resource model per environment and a shared-services shift that drove most of the projected saving. And high-level designs at the cloud-platform and tenant-network layers that turned the framework into buildable artefacts, including concept work on deployment patterns and the sunsetting of the incumbent product-operator model.",{"type":29,"tag":38,"props":565,"children":566},{},[567],{"type":35,"value":568},"Alongside the written design I built a PoC on Terraform, Vault, and Kubernetes to validate the secrets-management and provisioning flows the framework assumed. The redesign also carried an organisation proposal: merging two previously separate operations teams into a single platform competence centre with a common backlog that reconciled the existing ITIL posture with a Scaled Agile delivery model. The team side ran in parallel: job descriptions for the Digital Platform design-and-implementation team and evaluations on the candidate pipeline. The track was in flight when I left; the team I had been building was the one that would carry it.",{"type":29,"tag":38,"props":570,"children":571},{},[572,577],{"type":29,"tag":110,"props":573,"children":574},{},[575],{"type":35,"value":576},"Observability.",{"type":35,"value":578}," The track opened with a strategy question: what stack, and how does it fit with what iNM already runs? I built an Elastic-stack PoC before writing the strategy document. The PoC ran against a representative slice of the platform and answered the architecture question faster than a paper could have. The strategy document came after and carried less weight than the PoC did. I also wrote a short analysis of where Instana could complement the Elastic stack, so the strategy did not foreclose a commercial-tool option the programme might want later.",{"type":29,"tag":38,"props":580,"children":581},{},[582,587],{"type":29,"tag":110,"props":583,"children":584},{},[585],{"type":35,"value":586},"CMDB.",{"type":35,"value":588}," The design anchored on ServiceNow CSDM. That framework choice saved me from defending the structure from first principles. The energy went into the iNM-specific content: Kubernetes and OpenShift class modelling, the technical-services decomposition, and the CI design that would let discovery and automation do real work once implemented. I wrote the design as layered documents: high-level requirements, CI design, and technical-services mapping. Each audience could read the part they needed without having to read the whole thing.",{"type":29,"tag":38,"props":590,"children":591},{},[592,597],{"type":29,"tag":110,"props":593,"children":594},{},[595],{"type":35,"value":596},"Target operating model.",{"type":35,"value":598}," The R&R work was the messy one. iNM is served by multiple organisations and functions. A target operating model across that topology has to survive sponsors who each think their own function is the one that should grow. I wrote the org blueprint, a competence matrix for the iNM digital platform, and the job descriptions for the critical roles: senior SRE, DevOps engineer, operations architect, head of DevOps. The job descriptions were the artefact that travelled furthest. A role written with real depth gets hired against; a role written with generic language gets watered down in recruitment, and the team you end up with reflects that.",{"type":29,"tag":38,"props":600,"children":601},{},[602,607],{"type":29,"tag":110,"props":603,"children":604},{},[605],{"type":35,"value":606},"Software supply chain.",{"type":35,"value":608}," Two HLDs: a Nexus proxy for artifact management, and a Jenkins-based CD toolset for deployments into the iNM environments. The environment model mattered here. OPSTEST and OPS are separated for good reasons, and the CD pipeline had to encode that separation in its deployment flows rather than work around it. I also ran a Safety Support Assessment pass on the CD toolset to check the design against the regulatory posture. In iNM that check is part of the design conversation, not a downstream gate.",{"type":29,"tag":38,"props":610,"children":611},{},[612],{"type":35,"value":613},"The through-line across the five tracks was coherence. Each design had to be internally consistent and also consistent with the others. The Digital Platform defined the environment the other four tracks served. The CMDB class model had to carry the assets the observability stack would monitor on that platform. The observability stack was supposed to read signals from workloads the CD toolset would deploy onto it. Roles defined in the target operating model were the ones that would own the platform once it landed. Move any one of those pieces and the others shift with it. Leading the Digital Platform track gave me direct control over the spine; on the other four I noticed where they leaned on each other and worked the seams where I could.",{"type":29,"tag":38,"props":615,"children":616},{},[617],{"type":35,"value":618},"Alongside the design work, a material share of the role was landing the designs with the right audiences. Each track had its own review cadence, from internal engineers and architects at one end up to CTO-level readouts at the other, with counterparts on the vendor side in between. Executive reviews were a different exercise. By that point the design being right was a given; the question was whether the programme could commit to what the design implied.",{"type":29,"tag":30,"props":620,"children":622},{"id":621},"deliverables",[623],{"type":35,"value":624},"Deliverables",{"type":29,"tag":311,"props":626,"children":627},{},[628,633,638,643,648,653],{"type":29,"tag":315,"props":629,"children":630},{},[631],{"type":35,"value":632},"Digital Platform design body of work: an architecture framework written across the platform's major dimensions (security, resilience, disaster recovery, cost, evolution, integration), a modernisation and cost-optimisation strategy, cloud-platform and tenant-network HLDs for the mission-critical environment, and a working Terraform\u002FVault\u002FKubernetes PoC for the secrets-management and provisioning flows the framework depended on.",{"type":29,"tag":315,"props":634,"children":635},{},[636],{"type":35,"value":637},"Digital Platform team build: job descriptions for the Digital Platform design-and-implementation team and evaluations on the candidate pipeline.",{"type":29,"tag":315,"props":639,"children":640},{},[641],{"type":35,"value":642},"Elastic-stack observability PoC, working against representative workloads, plus a written strategy and an analysis of Instana as a complementary commercial tool.",{"type":29,"tag":315,"props":644,"children":645},{},[646],{"type":35,"value":647},"ServiceNow CSDM-aligned CMDB design, layered across high-level requirements, CI design, and technical-services mapping, with dedicated modelling for the container platforms.",{"type":29,"tag":315,"props":649,"children":650},{},[651],{"type":35,"value":652},"Target operating model for the iNM digital platform: org blueprint, R&R matrix across organisations and functions, competence matrix, and job descriptions for the critical roles.",{"type":29,"tag":315,"props":654,"children":655},{},[656],{"type":35,"value":657},"HLDs for the software supply chain: Nexus proxy and Jenkins-based CD toolset, with environment-specific deployment flows for OPSTEST and OPS, and a Safety Support Assessment view on the toolset design.",{"type":29,"tag":30,"props":659,"children":660},{"id":342},[661],{"type":35,"value":345},{"type":29,"tag":38,"props":663,"children":664},{},[665],{"type":35,"value":666},"The regulated posture shaped everything. Routine-change definitions were a real artefact, not a formality. Maintenance windows were governed by safety assessments. A design that ignored that topology would not land, regardless of how clean it looked on paper. The regulatory shape of the platform had to be read into every track.",{"type":29,"tag":38,"props":668,"children":669},{},[670],{"type":35,"value":671},"The five tracks moved in parallel and drifted apart if you let them. Each had its own sponsors, its own review cadence, its own deliverable dates. Holding coherence across them was a second job on top of the first, and it was only partly anyone's formal responsibility. I did it because the work needed it done.",{"type":29,"tag":38,"props":673,"children":674},{},[675],{"type":35,"value":676},"The Digital Platform track was the highest-stakes of the five. Replacing an incumbent platform in a large regulated organisation is not a decision that gets taken quickly, and commitment to the redesign came in stages. Part of the work was remaking the case for it in forums where the technical argument was only one input among several.",{"type":29,"tag":38,"props":678,"children":679},{},[680],{"type":35,"value":681},"Consulting distance was its own constraint. You can write a design that is technically correct and watch it sit on a shelf. The designs that moved were the ones I spent conversation time on, not just writing time. A good design with a bad review conversation lands worse than an average design with a good one.",{"type":29,"tag":30,"props":683,"children":684},{"id":368},[685],{"type":35,"value":371},{"type":29,"tag":38,"props":687,"children":688},{},[689],{"type":35,"value":376},{"type":29,"tag":38,"props":691,"children":692},{},[693],{"type":35,"value":694},"One: parallel workstreams have a coherence problem that sits above any one of them. Each track wants to be internally consistent. The harder constraint is making them mutually consistent. If no one is watching the seams, the seams come apart, and by the time they do it is expensive to fix.",{"type":29,"tag":38,"props":696,"children":697},{},[698],{"type":35,"value":699},"Two: a running PoC changes a strategy conversation more than a strategy document does. On contested choices, the fastest way to settle the argument is to build the thing. The Elastic-stack PoC did more for the observability direction than the strategy paper that followed it.",{"type":29,"tag":38,"props":701,"children":702},{},[703],{"type":35,"value":704},"Three: a framework pays rent on your behalf. Anchoring the CMDB on CSDM meant I was not defending the structure from first principles. I was defending iNM-specific departures from a framework that was already accepted. That shift in frame saves weeks.",{"type":29,"tag":38,"props":706,"children":707},{},[708],{"type":35,"value":709},"And the residue. Writing for someone else's hands is different from writing for your own. A design owned by you and one you hand off on a consulting contract are not the same artefact. The second has to survive without its author, and that has to be designed into the writing itself. A lot of how I write designs now traces back to that second kind.",{"type":29,"tag":398,"props":711,"children":712},{},[],{"type":29,"tag":38,"props":714,"children":715},{},[716],{"type":29,"tag":86,"props":717,"children":718},{},[719],{"type":35,"value":720},"Sources (public record on EUROCONTROL iNM and the programme context):",{"type":29,"tag":311,"props":722,"children":723},{},[724,737,750],{"type":29,"tag":315,"props":725,"children":726},{},[727],{"type":29,"tag":86,"props":728,"children":729},{},[730],{"type":29,"tag":174,"props":731,"children":734},{"href":732,"rel":733},"https:\u002F\u002Fwww.eurocontrol.int\u002Fproject\u002Fintegrated-network-management",[422],[735],{"type":35,"value":736},"integrated Network Management (iNM) programme, EUROCONTROL",{"type":29,"tag":315,"props":738,"children":739},{},[740],{"type":29,"tag":86,"props":741,"children":742},{},[743],{"type":29,"tag":174,"props":744,"children":747},{"href":745,"rel":746},"https:\u002F\u002Fwww.eurocontrol.int\u002Fpress-release\u002Feurocontrol-indra-atos-cronos-design-next-gen-nm-ops-system",[422],[748],{"type":35,"value":749},"EUROCONTROL enters into new partnership with Indra and Atos-Cronos to design the next generation of Network Management operational systems",{"type":29,"tag":315,"props":751,"children":752},{},[753],{"type":29,"tag":86,"props":754,"children":755},{},[756],{"type":29,"tag":174,"props":757,"children":760},{"href":758,"rel":759},"https:\u002F\u002Fatos.net\u002Fen\u002F2024\u002Fpress-release_2024_11_26\u002Fatos-secures-e165-million-contract-extension-with-eurocontrol",[422],[761],{"type":35,"value":762},"Atos secures €165 million contract extension with EUROCONTROL, November 2024",{"title":8,"searchDepth":462,"depth":462,"links":764},[765,766,767,768,769,770,771],{"id":32,"depth":465,"text":36},{"id":60,"depth":465,"text":63},{"id":71,"depth":465,"text":74},{"id":95,"depth":465,"text":98},{"id":621,"depth":465,"text":624},{"id":342,"depth":465,"text":345},{"id":368,"depth":465,"text":371},"content:references:technical-inm-unified-operations.md","references\u002Ftechnical-inm-unified-operations.md","references\u002Ftechnical-inm-unified-operations",{"loc":485},{"_path":777,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":778,"description":779,"date":780,"period":781,"sector":782,"scale":783,"role":784,"mandate":785,"category":786,"tags":787,"body":793,"_type":477,"_id":1041,"_source":479,"_file":1042,"_stem":1043,"_extension":482,"sitemap":1044},"\u002Freferences\u002Fstrategy-regional-security-programme","Regional security strategy for a standalone CEE infrastructure group","Designing and driving a multi-year security strategy for a newly independent CEE neutral-host infrastructure group: standardization across markets, regional SOC build, security as an external service, and a regional organization redesign.","2021-01-01","2021 – 2023","Telecommunications, CEE","Multi-country CEE neutral-host infrastructure group","Regional Security Director, CEE","Design and drive a multi-year regional security strategy for the newly independent infrastructure group, across all markets, while keeping day-to-day security running.","Strategy",[788,789,790,791,792],"security leadership","CEE","telecoms","SOC","strategy",{"type":26,"children":794,"toc":1032},[795,799,804,808,813,818,822,827,832,836,841,846,851,856,861,866,870,903,907,912,917,922,927,932,937,941,946,951,956,961,966,969,977],{"type":29,"tag":30,"props":796,"children":797},{"id":32},[798],{"type":35,"value":36},{"type":29,"tag":38,"props":800,"children":801},{},[802],{"type":35,"value":803},"After the separation closed, the infrastructure side of a CEE telecoms group stood up as an independent neutral-host operator. Regional footprint, multi-country, its own board, its own regulators to talk to. Security had been split and rebuilt through the carve-out. Now it had to become a strategy: a function that belonged to the new company, not a shared-services legacy.",{"type":29,"tag":30,"props":805,"children":806},{"id":60},[807],{"type":35,"value":63},{"type":29,"tag":38,"props":809,"children":810},{},[811],{"type":35,"value":812},"Design a multi-year regional security strategy for the newly independent infrastructure group, aligned with the parent group's security direction, and drive the execution across every market.",{"type":29,"tag":38,"props":814,"children":815},{},[816],{"type":35,"value":817},"Three ambitions to land. Security as a condition of growth and resilient operation, the defensive baseline. An agile and efficient operating model, fit for a lean post-carve-out company. And an ambition with no internal template: security offered to external customers as a service, a revenue line on top of the internal cost centre.",{"type":29,"tag":30,"props":819,"children":820},{"id":71},[821],{"type":35,"value":74},{"type":29,"tag":38,"props":823,"children":824},{},[825],{"type":35,"value":826},"I was Regional Security Director for CEE, continuing the mandate I had carried through the separation, now inside the standalone infrastructure group. Reporting into the group Chief Security Officer layer. Remit covered every operating company across the region and the regional coordination layer above them.",{"type":29,"tag":38,"props":828,"children":829},{},[830],{"type":35,"value":831},"I designed the strategy myself. I wrote it up. I carried it through the approval chain. And then I drove the execution: standardization, SOC, service portfolio, reorganization. All of it while keeping day-to-day security running.",{"type":29,"tag":30,"props":833,"children":834},{"id":95},[835],{"type":35,"value":98},{"type":29,"tag":38,"props":837,"children":838},{},[839],{"type":35,"value":840},"Three strategic ambitions, one five-year roadmap. Designed and executed in parallel.",{"type":29,"tag":38,"props":842,"children":843},{},[844],{"type":35,"value":845},"On the baseline, I ran a regional standardization programme. I went capability by capability: monitoring, identity, endpoint, privileged access, data leakage, vulnerability management, firewall management, web application protection, DNS, PKI. For each one I set criticality tiers and drove the markets to the same floor. A mandatory baseline for every operating company; higher tiers where the risk or the revenue case justified it. Delivered as infrastructure-as-code where the target technology allowed, so deployments scaled across countries rather than being repeated per market.",{"type":29,"tag":38,"props":847,"children":848},{},[849],{"type":35,"value":850},"The SOC came up in iterations. The first one was a pilot, to learn on live problems: borrowed people, ad-hoc infrastructure, a minimum set of playbooks. The second formalized it, with dedicated analysts, defined procedures, signed commercials, proper governance. The third automated it, with orchestration, standard playbooks, and scope widened by the efficiency gains. Three iterations over roughly two years. Each one closed a real capability gap and produced enough operational proof to justify the next.",{"type":29,"tag":38,"props":852,"children":853},{},[854],{"type":35,"value":855},"The service side was the outlier. I designed a security service portfolio for external customers: consultancy, enterprise services, SOC services. A shared-delivery model behind it, so one team and one knowledge base served every customer off a multi-tenant platform. Positioning: specialized service provider for the SME and mid-market segments that the big integrators do not fight over. Sales went through the retail-side B2B channels and a few partner agreements. Unusual angle for a tower-and-fibre operator: security as a product to sell, not only a line in the operating budget.",{"type":29,"tag":38,"props":857,"children":858},{},[859],{"type":35,"value":860},"Organization design came alongside all of this, pulling in two directions on purpose. Engineering and O&M decentralized to local security teams, for local adaptation, local language, and presence in the moments that matter. Monitoring and analysis went the other way, centralized, with local analysts kept for language and context. A regional architect pool sitting horizontally across markets. Working groups for the cross-country projects.",{"type":29,"tag":38,"props":862,"children":863},{},[864],{"type":35,"value":865},"I designed each track and drove it to delivery. Nothing handed off.",{"type":29,"tag":30,"props":867,"children":868},{"id":621},[869],{"type":35,"value":624},{"type":29,"tag":311,"props":871,"children":872},{},[873,878,883,888,893,898],{"type":29,"tag":315,"props":874,"children":875},{},[876],{"type":35,"value":877},"The regional security strategy itself. One document tying the three ambitions, the enablers, the initiatives, and the five-year roadmap into a coherent plan.",{"type":29,"tag":315,"props":879,"children":880},{},[881],{"type":35,"value":882},"A regional standardization programme with defined capability tiers and a rolling delivery plan per market.",{"type":29,"tag":315,"props":884,"children":885},{},[886],{"type":35,"value":887},"A regional SOC, progressed from pilot to operational service, with commercial annexes signed, SLA and KPI framework formalized, and a dedicated analyst pool in place.",{"type":29,"tag":315,"props":889,"children":890},{},[891],{"type":35,"value":892},"A security service portfolio and commercial framework for external customers, under a shared-delivery model.",{"type":29,"tag":315,"props":894,"children":895},{},[896],{"type":35,"value":897},"A redesigned regional security organization: decentralized engineering, centralized monitoring, a regional architect pool, and formal governance.",{"type":29,"tag":315,"props":899,"children":900},{},[901],{"type":35,"value":902},"A regional security governance baseline aligned with ISO 27001 and with the parent group's security governance.",{"type":29,"tag":30,"props":904,"children":905},{"id":342},[906],{"type":35,"value":345},{"type":29,"tag":38,"props":908,"children":909},{},[910],{"type":35,"value":911},"The company was still finding its feet. The separation had closed, but the commercial model, the contracts, and the operating rhythm of the new entity were all stabilizing at the same time I was trying to commit it to a five-year security strategy. Every decision I asked the business to make was competing with ten other decisions the business had to make.",{"type":29,"tag":38,"props":913,"children":914},{},[915],{"type":35,"value":916},"The service-provider ambition cut against the culture. Tower and fibre operators do not think of themselves as commercial security vendors. Getting the organization to treat security as something to sell was more organizational change than technical design. Pricing, delivery model, sales channel, commercial terms, service management: none of that machinery existed, and all of it had to be built from zero by people who were also doing their day jobs.",{"type":29,"tag":38,"props":918,"children":919},{},[920],{"type":35,"value":921},"Multi-country execution meant the standardization programme had to respect local regulators, local hiring markets, and local language. I kept the target state common and let the delivery path localize. Per-market strategies would have been faster to sell and impossible to run.",{"type":29,"tag":38,"props":923,"children":924},{},[925],{"type":35,"value":926},"Standardization also had a political face the technical plan didn't capture. Each market came with inheritance: technology choices made earlier by people who were no longer there, or, more awkwardly, by people who still were. And real skills and experience the local teams had built up around those choices. Every market also had its own agenda, its own priorities, its own politics. And because security was now a service provider to those markets, the relationship was commercial: local businesses were customers of the regional security function, not subordinates of it. Pushing a standard was never a purely technical call. Stakeholder management became part of the standardization job, not a side effect.",{"type":29,"tag":38,"props":928,"children":929},{},[930],{"type":35,"value":931},"The org redesign asked for two different motions at once. Decentralizing engineering and O&M meant giving local teams more authority. Centralizing monitoring meant taking authority back in the other direction. Both were right for different reasons, and both had to be sold on their own merit to the same people.",{"type":29,"tag":38,"props":933,"children":934},{},[935],{"type":35,"value":936},"And running all of this on top of business as usual was the constant pressure. Security for the network and IT of an infrastructure group cannot pause while the strategy is being built. Every change to monitoring, access, or endpoint controls had to carry the day-to-day through the transition.",{"type":29,"tag":30,"props":938,"children":939},{"id":368},[940],{"type":35,"value":371},{"type":29,"tag":38,"props":942,"children":943},{},[944],{"type":35,"value":945},"After the separation, I expected the hard part to be behind me. It wasn't. Just different. The separation work rewarded fast, right-now decisions. The strategy work rewarded patience and sequence. The two gears do not come naturally together, and switching between them is a skill in itself.",{"type":29,"tag":38,"props":947,"children":948},{},[949],{"type":35,"value":950},"Two things stuck.",{"type":29,"tag":38,"props":952,"children":953},{},[954],{"type":35,"value":955},"One: a multi-year strategy only works if the first year is visibly delivering. I backloaded nothing. Every one of the three ambitions had something real standing by the end of year one: the standardization baseline moving, the SOC taking live cases, the first external service contracts in place. Strategy that only shows up in year three does not survive the boards and budget cycles that happen in year two.",{"type":29,"tag":38,"props":957,"children":958},{},[959],{"type":35,"value":960},"Two: the service-provider ambition was the test. It was the one most likely to fail, the one with no internal template, the one the organization instinctively resisted. Getting it to actually work, with real customers, real revenue, and real SLA, taught me more about what it takes to change an organization than the other two ambitions combined. Security as a cost line is easy to run. Security as a product forces every other capability to sharpen up.",{"type":29,"tag":38,"props":962,"children":963},{},[964],{"type":35,"value":965},"And the residue. Running a multi-year strategy inside a company still stabilizing its own model taught me how to keep a long horizon visible while staying useful on short-horizon problems. A different muscle from the programme-delivery one I built through the separation, and both of them shape how I think about this kind of work now.",{"type":29,"tag":398,"props":967,"children":968},{},[],{"type":29,"tag":38,"props":970,"children":971},{},[972],{"type":29,"tag":86,"props":973,"children":974},{},[975],{"type":35,"value":976},"Sources (public record on the group and its post-separation operation):",{"type":29,"tag":311,"props":978,"children":979},{},[980,993,1006,1019],{"type":29,"tag":315,"props":981,"children":982},{},[983],{"type":29,"tag":86,"props":984,"children":985},{},[986],{"type":29,"tag":174,"props":987,"children":990},{"href":988,"rel":989},"https:\u002F\u002Fwww.cetinbg.bg\u002Fw\u002Fppf-group-separates-commercial-infrastructure-business-of-telenor-branded-operators-establishes-cetin-group",[422],[991],{"type":35,"value":992},"CETIN Group — retail \u002F infrastructure separation across Bulgaria, Hungary, Serbia",{"type":29,"tag":315,"props":994,"children":995},{},[996],{"type":29,"tag":86,"props":997,"children":998},{},[999],{"type":29,"tag":174,"props":1000,"children":1003},{"href":1001,"rel":1002},"https:\u002F\u002Fwww.cetin.hu\u002Fw\u002Fhungary-telco-market-sees-launch-of-new-telenor-spin-off-infrastructure-company-named-cetin",[422],[1004],{"type":35,"value":1005},"Launch of CETIN Hungary as infrastructure spin-off, 1 July 2020",{"type":29,"tag":315,"props":1007,"children":1008},{},[1009],{"type":29,"tag":86,"props":1010,"children":1011},{},[1012],{"type":29,"tag":174,"props":1013,"children":1016},{"href":1014,"rel":1015},"https:\u002F\u002Fwww.cetin.eu\u002Fdocuments\u002Fd\u002Fguest\u002F1679582471ut77x-cetin-group-annual-accounts-2022-public-pdf",[422],[1017],{"type":35,"value":1018},"CETIN Group N.V. — public annual accounts",{"type":29,"tag":315,"props":1020,"children":1021},{},[1022],{"type":29,"tag":86,"props":1023,"children":1024},{},[1025],{"type":29,"tag":174,"props":1026,"children":1029},{"href":1027,"rel":1028},"https:\u002F\u002Fwww.cetin.hu\u002Fwhat-we-do\u002Fservices",[422],[1030],{"type":35,"value":1031},"CETIN Hungary — current service portfolio, including security consultancy, SOC functions, and managed enterprise security services",{"title":8,"searchDepth":462,"depth":462,"links":1033},[1034,1035,1036,1037,1038,1039,1040],{"id":32,"depth":465,"text":36},{"id":60,"depth":465,"text":63},{"id":71,"depth":465,"text":74},{"id":95,"depth":465,"text":98},{"id":621,"depth":465,"text":624},{"id":342,"depth":465,"text":345},{"id":368,"depth":465,"text":371},"content:references:strategy-regional-security-programme.md","references\u002Fstrategy-regional-security-programme.md","references\u002Fstrategy-regional-security-programme",{"loc":777},{"_path":1046,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":1047,"description":1048,"date":1049,"period":1050,"sector":782,"scale":1051,"role":1052,"mandate":1053,"category":786,"tags":1054,"body":1057,"_type":477,"_id":1346,"_source":479,"_file":1347,"_stem":1348,"_extension":482,"sitemap":1349},"\u002Freferences\u002Fstrategy-corporate-programme","Security stream of a CEE telecoms group separation","Designing and executing the target operating model of the regional security organization through a multi-country CEE telecoms retail\u002Finfrastructure separation. Technical split, financial model, organization setup, legal inputs, all while keeping day-to-day security running.","2019-01-01","2019 – 2021","Multi-country CEE mobile operator group, carved out into a regional neutral-host infrastructure company","Regional Director, group shared-services entity; security workstream lead","Design and deliver the future target operating model of the regional security organization through the separation, across multiple markets, without disrupting day-to-day operations.",[1055,1056,788,789,790],"M&A","separation",{"type":26,"children":1058,"toc":1337},[1059,1063,1068,1073,1077,1082,1087,1091,1096,1101,1106,1110,1115,1120,1125,1130,1135,1140,1145,1150,1155,1160,1165,1169,1202,1206,1211,1216,1221,1226,1231,1235,1240,1244,1249,1254,1259,1264,1267,1275],{"type":29,"tag":30,"props":1060,"children":1061},{"id":32},[1062],{"type":35,"value":36},{"type":29,"tag":38,"props":1064,"children":1065},{},[1066],{"type":35,"value":1067},"A CEE mobile operator group had just changed hands. The new owner wanted to separate network infrastructure from retail, the same carve-out it had done in another market five years earlier. The infrastructure side became a large regional neutral-host tower and fibre operator.",{"type":29,"tag":38,"props":1069,"children":1070},{},[1071],{"type":35,"value":1072},"Several operating companies had to be separated at the same time. Every corporate function had to land on one side of the new boundary, or on both under a transitional arrangement.",{"type":29,"tag":30,"props":1074,"children":1075},{"id":60},[1076],{"type":35,"value":63},{"type":29,"tag":38,"props":1078,"children":1079},{},[1080],{"type":35,"value":1081},"Design and deliver the target operating model for the regional security organization through the separation. Multiple countries, multiple legal entities per country. Every capability had to be allocated: identity, network, SOC, incident response, GRC, physical. The transition had to be smooth, and both sides had to stand on their own on day one.",{"type":29,"tag":38,"props":1083,"children":1084},{},[1085],{"type":35,"value":1086},"Four dimensions, designed and executed in parallel: the technical split, the financial model, the organization setup, and the legal inputs into the inter-company contracts.",{"type":29,"tag":30,"props":1088,"children":1089},{"id":71},[1090],{"type":35,"value":74},{"type":29,"tag":38,"props":1092,"children":1093},{},[1094],{"type":35,"value":1095},"I was Regional Director at the group's regional shared-services entity, reporting to its CEO. That entity was restructured at the end of the separation, and I continued afterwards as Regional Security Director for CEE inside the new infrastructure group.",{"type":29,"tag":38,"props":1097,"children":1098},{},[1099],{"type":35,"value":1100},"I owned the security stream end to end. I designed the target operating model myself, across all four dimensions, and I drove it to go-live: resourcing it, running the workstream, and carrying the regional security function as a day-to-day service while everything underneath it was being rebuilt.",{"type":29,"tag":38,"props":1102,"children":1103},{},[1104],{"type":35,"value":1105},"The remit spanned several countries. In each country, multiple legal entities: the local NetCo, the local ComCo, and the regional shared-services entity above them. The remit didn't own the commercial negotiation between the retail and infrastructure sides, but every decision with a security angle fed into it.",{"type":29,"tag":30,"props":1107,"children":1108},{"id":95},[1109],{"type":35,"value":98},{"type":29,"tag":38,"props":1111,"children":1112},{},[1113],{"type":35,"value":1114},"The programme had a hard go-live date. My method was to get to a clean, defensible split first and accept some transitional inefficiency, then schedule optimization for the year after. The first test for any decision was \"does this work on day one.\" The second was \"does this scale.\"",{"type":29,"tag":38,"props":1116,"children":1117},{},[1118],{"type":35,"value":1119},"I designed each dimension and drove it to delivery at the same time. The four dimensions ran in parallel and had to reconcile with each other every week.",{"type":29,"tag":38,"props":1121,"children":1122},{},[1123],{"type":35,"value":1124},"On the technical side, I went capability by capability: identity, network segmentation, security monitoring, endpoint, vulnerability management, cryptography and key material, physical, OT, network management. For each one I decided whether it duplicated, migrated, or stayed shared under a transitional arrangement. Each one got a target state and a transition path.",{"type":29,"tag":38,"props":1126,"children":1127},{},[1128],{"type":35,"value":1129},"Financially, I priced the steady-state cost of every capability on each side, the cost of duplicating it, and the price of any transitional service the shared-services entity would keep delivering. The model had to line up with the group's financial case for the whole separation.",{"type":29,"tag":38,"props":1131,"children":1132},{},[1133],{"type":35,"value":1134},"Organization design came next. Target security organizations on both sides, down to roles, headcount, seniority mix, reporting lines, critical skills, and hiring sequence. For every role I decided whether an existing person could fill it and on which side they should land, or whether we had to hire.",{"type":29,"tag":38,"props":1136,"children":1137},{},[1138],{"type":35,"value":1139},"Legal pulled it all into contract language. Security schedules, SLAs, liability, data-sharing, incident-cooperation clauses in the inter-company contracts and transitional services agreements. Of the four tracks, legal was the one that forced every decision to become explicit and signed.",{"type":29,"tag":38,"props":1141,"children":1142},{},[1143],{"type":35,"value":1144},"Each market had its own operating company, its own regulator, and its own legacy. I designed one target model centrally and localized it per market with a variance register, rather than running per-market redesigns.",{"type":29,"tag":38,"props":1146,"children":1147},{},[1148],{"type":35,"value":1149},"Then there was the entity structure. Each country had its own local NetCo and its own local ComCo, each a separate legal entity. A regional security function had to sit across all of them. The operating model had to carry through several contract layers: inter-NetCo agreements across the region, because the security team stayed regional while the NetCos were country-level, and commercial contracts between each NetCo and its local ComCo.",{"type":29,"tag":38,"props":1151,"children":1152},{},[1153],{"type":35,"value":1154},"Regional security had to get paid under this structure. The cost allocation followed a provided-versus-consumed logic that had to reconcile across every pair of legal entities and sign off consistently against the local commercial contracts. That part was as much engineering as negotiation.",{"type":29,"tag":38,"props":1156,"children":1157},{},[1158],{"type":35,"value":1159},"Security also had two roles inside the new architecture: securing the services delivered under the inter-company contracts, and providing security services directly to the retail side for the business applications that stayed with them. Both roles had to be priced, contracted, and run.",{"type":29,"tag":38,"props":1161,"children":1162},{},[1163],{"type":35,"value":1164},"All of this had to land, not just look good on paper. Go-live was one date, across every market, with the security function still running.",{"type":29,"tag":30,"props":1166,"children":1167},{"id":621},[1168],{"type":35,"value":624},{"type":29,"tag":311,"props":1170,"children":1171},{},[1172,1177,1182,1187,1192,1197],{"type":29,"tag":315,"props":1173,"children":1174},{},[1175],{"type":35,"value":1176},"The TOM itself. One document tying the technical, financial, organizational, and legal work into an end state and a transition path.",{"type":29,"tag":315,"props":1178,"children":1179},{},[1180],{"type":35,"value":1181},"A capability-level security separation blueprint, with a target state and transition path for every in-scope domain.",{"type":29,"tag":315,"props":1183,"children":1184},{},[1185],{"type":35,"value":1186},"A regional security cost-allocation model that reconciled across every legal-entity pair.",{"type":29,"tag":315,"props":1188,"children":1189},{},[1190],{"type":35,"value":1191},"Target organization designs for both sides of the split, down to role definitions, headcount, seniority mix, and hiring sequence.",{"type":29,"tag":315,"props":1193,"children":1194},{},[1195],{"type":35,"value":1196},"Security schedules and annexes for the inter-NetCo and NetCo-to-ComCo contracts.",{"type":29,"tag":315,"props":1198,"children":1199},{},[1200],{"type":35,"value":1201},"A programme risk register for the security-specific risks through to go-live.",{"type":29,"tag":30,"props":1203,"children":1204},{"id":342},[1205],{"type":35,"value":345},{"type":29,"tag":38,"props":1207,"children":1208},{},[1209],{"type":35,"value":1210},"The commercial track moved faster than the technical facts. The boundary between retail and infrastructure kept shifting, and every shift reopened decisions already documented, modelled, and drafted into contracts. Every artefact had to be a living document, with one source of truth that the legal, financial, and technical tracks all pulled from.",{"type":29,"tag":38,"props":1212,"children":1213},{},[1214],{"type":35,"value":1215},"The legal-entity structure multiplied the number of documents. A regional security function sitting across several country-level NetCos, each with its own ComCo and its own commercial agreements, meant every document had to be consistent with every other. Getting alignment was an engineering job on top of a negotiation: the cost allocation, the service scope, and the security schedules had to close at the same time.",{"type":29,"tag":38,"props":1217,"children":1218},{},[1219],{"type":35,"value":1220},"The stakeholder map was wide. Every legal entity brought its own people, each of them with their own interests, their own culture, their own expectations. The upstream programme execution sat above the security stream with its own tempo and its own agenda. Alongside, my own team and my own line management needed a different kind of conversation again. Different interests, different cultures, different communication approach for each. Carrying the TOM through all of them, and then delivering against it, was as much a communications job as a design job.",{"type":29,"tag":38,"props":1222,"children":1223},{},[1224],{"type":35,"value":1225},"Running in parallel with business as usual meant nothing could be interrupted for the separation. Changes to identity, monitoring, or network controls had to work for the pre-separation group and the post-separation entities at once.",{"type":29,"tag":38,"props":1227,"children":1228},{},[1229],{"type":35,"value":1230},"Multi-country regulatory variance, inside and outside the EU, meant \"one target model, several localizations\" was the only affordable path. Per-market redesigns would not have finished on time.",{"type":29,"tag":30,"props":1232,"children":1233},{"id":368},[1234],{"type":35,"value":371},{"type":29,"tag":38,"props":1236,"children":1237},{},[1238],{"type":35,"value":1239},"Running both the design and the delivery of a transformation this broad is a rare experience. Business, technical, organizational, financial, all at once. A lot of how I think about this kind of work now comes from having been in the middle of it.",{"type":29,"tag":38,"props":1241,"children":1242},{},[1243],{"type":35,"value":376},{"type":29,"tag":38,"props":1245,"children":1246},{},[1247],{"type":35,"value":1248},"One: designing and executing in the same head is where the learning is. Reality corrects your design in time to fix it, and you learn things about the model no hand-off could teach you. I don't take strategy seriously when it's separated from delivery anymore.",{"type":29,"tag":38,"props":1250,"children":1251},{},[1252],{"type":35,"value":1253},"Two: a transformation at this shape is as much a communications job as a design job. Every legal entity, every level of line management, the upstream programme execution, and my own team each needed a different kind of conversation. The TOM moves only as fast as the slowest conversation, and the conversations are not interchangeable. I budget communication effort on that basis now.",{"type":29,"tag":38,"props":1255,"children":1256},{},[1257],{"type":35,"value":1258},"Three: the four dimensions only work if they reconcile, and the reconciliation is the hard part. Technical decisions break the financial model. Financial decisions break the organization design. Legal forces every technical and organizational decision to become specific. Holding all four at the same time, not sequentially, was what required the hardest thinking, the most flexibility, and the fastest switching between contexts.",{"type":29,"tag":38,"props":1260,"children":1261},{},[1262],{"type":35,"value":1263},"And the residue. I came out of it sharper at the practical habits a programme of that density demands. Focusing hard while changing context constantly. Telling important from less important. Deciding fast. Carrying the stress without it leaking into the work.",{"type":29,"tag":398,"props":1265,"children":1266},{},[],{"type":29,"tag":38,"props":1268,"children":1269},{},[1270],{"type":29,"tag":86,"props":1271,"children":1272},{},[1273],{"type":35,"value":1274},"Sources (public record on the transaction and the resulting infrastructure group):",{"type":29,"tag":311,"props":1276,"children":1277},{},[1278,1291,1304,1315,1326],{"type":29,"tag":315,"props":1279,"children":1280},{},[1281],{"type":29,"tag":86,"props":1282,"children":1283},{},[1284],{"type":29,"tag":174,"props":1285,"children":1288},{"href":1286,"rel":1287},"https:\u002F\u002Fwww.ppf.eu\u002Fen\u002Fpress-release\u002Fppf-group-completes-its-acquisition-of-telenors-telecommunications-assets-in-cee-countries",[422],[1289],{"type":35,"value":1290},"PPF Group completes its €2.8bn acquisition of Telenor's CEE operations, 31 July 2018",{"type":29,"tag":315,"props":1292,"children":1293},{},[1294],{"type":29,"tag":86,"props":1295,"children":1296},{},[1297],{"type":29,"tag":174,"props":1298,"children":1301},{"href":1299,"rel":1300},"https:\u002F\u002Fec.europa.eu\u002Fcompetition\u002Fmergers\u002Fcases\u002Fdecisions\u002Fm8883_299_3.pdf",[422],[1302],{"type":35,"value":1303},"European Commission merger clearance, Case M.8883 — PPF Group \u002F Telenor Target",{"type":29,"tag":315,"props":1305,"children":1306},{},[1307],{"type":29,"tag":86,"props":1308,"children":1309},{},[1310],{"type":29,"tag":174,"props":1311,"children":1313},{"href":1001,"rel":1312},[422],[1314],{"type":35,"value":1005},{"type":29,"tag":315,"props":1316,"children":1317},{},[1318],{"type":29,"tag":86,"props":1319,"children":1320},{},[1321],{"type":29,"tag":174,"props":1322,"children":1324},{"href":988,"rel":1323},[422],[1325],{"type":35,"value":992},{"type":29,"tag":315,"props":1327,"children":1328},{},[1329],{"type":29,"tag":86,"props":1330,"children":1331},{},[1332],{"type":29,"tag":174,"props":1333,"children":1335},{"href":1014,"rel":1334},[422],[1336],{"type":35,"value":1018},{"title":8,"searchDepth":462,"depth":462,"links":1338},[1339,1340,1341,1342,1343,1344,1345],{"id":32,"depth":465,"text":36},{"id":60,"depth":465,"text":63},{"id":71,"depth":465,"text":74},{"id":95,"depth":465,"text":98},{"id":621,"depth":465,"text":624},{"id":342,"depth":465,"text":345},{"id":368,"depth":465,"text":371},"content:references:strategy-corporate-programme.md","references\u002Fstrategy-corporate-programme.md","references\u002Fstrategy-corporate-programme",{"loc":1046},{"_path":1351,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":1352,"description":1353,"date":1354,"period":1355,"sector":782,"scale":1356,"role":1357,"mandate":1358,"category":1359,"tags":1360,"body":1364,"_type":477,"_id":1617,"_source":479,"_file":1618,"_stem":1619,"_extension":482,"sitemap":1620},"\u002Freferences\u002Fmanagement-regional-organization","Rebuilding a regional security organization after a CEE telecoms acquisition","Taking over a fragmented, demoralized regional security function at a CEE telecoms operator under new ownership. Rebuilding team cohesion first and organizational foundation second, across four markets.","2018-01-01","2018 – 2020","Regional security function across four CEE markets","Security Director, regional shared-services entity","Take over a fragmented regional security organization after a change of ownership and rebuild it, team first, structure second.","Management",[1361,1362,1363,789,790],"leadership","org design","team building",{"type":26,"children":1365,"toc":1608},[1366,1370,1375,1380,1384,1389,1394,1398,1403,1408,1412,1417,1422,1427,1432,1437,1442,1447,1452,1457,1462,1467,1471,1504,1508,1513,1518,1523,1528,1533,1537,1541,1546,1551,1556,1561,1564,1572],{"type":29,"tag":30,"props":1367,"children":1368},{"id":32},[1369],{"type":35,"value":36},{"type":29,"tag":38,"props":1371,"children":1372},{},[1373],{"type":35,"value":1374},"After PPF acquired Telenor's CEE operations in 2018, I joined as Security Director at the group's regional shared-services entity, reporting direct to the CEO. The security organization was in the state most post-acquisition handovers leave behind. The seller's management was on the way out, the buyer's wasn't yet in. The function had been ground down in the interim.",{"type":29,"tag":38,"props":1376,"children":1377},{},[1378],{"type":35,"value":1379},"It was also fragmented by design. Security operations sat inside the operations org. Architecture sat inside planning. GRC was the only piece that had been centralized, and it was not working well. The team sat in two countries, Hungary and Serbia, and covered four markets: the two home countries plus Montenegro and Bulgaria, served remotely. The two sites barely spoke to each other. A few meetings on the calendar, but not much real coordination. People were frustrated. As far as I could tell, all of them were actively looking for other jobs.",{"type":29,"tag":30,"props":1381,"children":1382},{"id":60},[1383],{"type":35,"value":63},{"type":29,"tag":38,"props":1385,"children":1386},{},[1387],{"type":35,"value":1388},"Rebuild the regional security function. Get the team back on its feet first, and the structure standing second.",{"type":29,"tag":38,"props":1390,"children":1391},{},[1392],{"type":35,"value":1393},"Nobody set me a deadline. The context did. With the new owners' arrival and the programmes already forming behind the scenes, security needed to be functioning, and quickly.",{"type":29,"tag":30,"props":1395,"children":1396},{"id":71},[1397],{"type":35,"value":74},{"type":29,"tag":38,"props":1399,"children":1400},{},[1401],{"type":35,"value":1402},"Security Director at the regional shared-services entity, reporting to the CEO. Remit across four markets and the regional layer above them. End to end: security operations, architecture, GRC.",{"type":29,"tag":38,"props":1404,"children":1405},{},[1406],{"type":35,"value":1407},"I designed the rebuild and I ran it. What this role needed first was presence, not process, so there was not a lot to hand off.",{"type":29,"tag":30,"props":1409,"children":1410},{"id":95},[1411],{"type":35,"value":98},{"type":29,"tag":38,"props":1413,"children":1414},{},[1415],{"type":35,"value":1416},"What I walked into was closer to the absence of a team than a team with problems. Phase one was salvage.",{"type":29,"tag":38,"props":1418,"children":1419},{},[1420],{"type":35,"value":1421},"I started with cohesion. A few people on the team were blocking the rest from moving forward. I had to let them go. The call was sensitive and I took my time reading it, but when it happened the rest of the team received it well. Some of them told me so out loud, which was the signal the read had been right.",{"type":29,"tag":38,"props":1423,"children":1424},{},[1425],{"type":35,"value":1426},"I moved fast on one appointment. The team was split between two sites and I needed a local lead in the one I wasn't based in. Not necessarily a functional lead, but someone the team could walk up to when I wasn't there. The person I picked was early in their career and already good at the work: sharp on practical problems, interpersonally mature, and trusted by the team in small moments. Those were the criteria. Not seniority. The offer was accepted only after the rest of the team had been consulted first. That detail said more about the fit than any interview could have.",{"type":29,"tag":38,"props":1428,"children":1429},{},[1430],{"type":35,"value":1431},"I stayed visible. Weekly travel, bi-weekly at minimum. I set up a communication channel and used it multiple times a day, a running stream rather than scheduled updates, so the team never had to wonder what I knew that they didn't. And it ran the other way too: every piece of positive feedback or recognition I picked up about the team got shared straight back through. Team meetings changed shape in parallel. They became discussions rather than broadcasts, with room for people to bring their own stories when they wanted to. No push, just an opportunity. The room was also for venting, as long as the frustration landed on a cause and a way forward rather than burning the team down from within.",{"type":29,"tag":38,"props":1433,"children":1434},{},[1435],{"type":35,"value":1436},"I created functional roles inside the team with real responsibilities: ownership of topics, not just task lists. And I set near-term working-group goals: implementation work, standards, innovation work. Useful outputs on their own, but the point was simpler than the outputs: a scattered team needed reasons to be in the same room.",{"type":29,"tag":38,"props":1438,"children":1439},{},[1440],{"type":35,"value":1441},"I used technical credibility deliberately. I had enough background to answer questions the team had, and sometimes I knew things they didn't. But the role was not to be the expert. The point was to narrow the power distance, not to dominate it. That one choice is what let the team come to me immediately when they had conflict with other parts of the organization, and when they did, I could step in before the conflict ossified.",{"type":29,"tag":38,"props":1443,"children":1444},{},[1445],{"type":35,"value":1446},"The enterprise rails were running alongside all of this. OKRs, personal goals, quarterly reviews were the formal part. Formality matters for structural discipline, but in the rebuild year it wasn't the driver. The direction was cohesion. Career paths, promotions, training, conferences were something else. Not formality, but real incentives. The team felt them.",{"type":29,"tag":38,"props":1448,"children":1449},{},[1450],{"type":35,"value":1451},"Two less-visible choices shaped the first year as much as any of that. I restructured the budget so that raising salaries came before hiring more people, stronger first and larger second. And I fought for more budget on three fronts: internal management, renegotiation with the operating companies we served as customers, and proposals for service extensions. The function was funded through contracts, and the headroom had to come from there. The service extensions and budget wins did double duty. They showed the team that the function was growing, that the rebuild was turning into real expansion. The tempo was ambitious and sometimes ran ahead of what the team felt ready to absorb, but the visible growth meant more to them than the absorption pressure did. Alongside all of that, I worked down operational bottlenecks where I could, especially on the operations side. A team coming back to life needs friction taken out of its days.",{"type":29,"tag":38,"props":1453,"children":1454},{},[1455],{"type":35,"value":1456},"By the end of the first year there was a team again. The CVs stopped circulating. None of this had been strategy. There hadn't been time for strategy yet.",{"type":29,"tag":38,"props":1458,"children":1459},{},[1460],{"type":35,"value":1461},"My own habits shifted with the turn. Through the salvage phase I had been running 1:1s with everyone on the team, direct access, no layer in between. Once the team was standing, I stopped doing the ones with people who now reported through a lead. Continuing would have cut across the authority I'd handed to those leads. The formal relationship moved up a layer. The personal one stayed where it was.",{"type":29,"tag":38,"props":1463,"children":1464},{},[1465],{"type":35,"value":1466},"The second phase was the machine that works without me. A real strategy, with goals, tactical steps, organization design, technology direction. Less salvage, more build. That work bridged into what became the separation programme, and the team that had been rebuilt was the team that carried it through.",{"type":29,"tag":30,"props":1468,"children":1469},{"id":621},[1470],{"type":35,"value":624},{"type":29,"tag":311,"props":1472,"children":1473},{},[1474,1479,1484,1489,1494,1499],{"type":29,"tag":315,"props":1475,"children":1476},{},[1477],{"type":35,"value":1478},"A cohesive regional security team with low attrition, working with the rest of the business instead of at arm's length from it.",{"type":29,"tag":315,"props":1480,"children":1481},{},[1482],{"type":35,"value":1483},"A functional role structure inside the team, with clear topic ownership and accountability.",{"type":29,"tag":315,"props":1485,"children":1486},{},[1487],{"type":35,"value":1488},"A present local lead at the second site, appointed fast and chosen on fit.",{"type":29,"tag":315,"props":1490,"children":1491},{},[1492],{"type":35,"value":1493},"A communication rhythm the team could rely on when I wasn't in the room.",{"type":29,"tag":315,"props":1495,"children":1496},{},[1497],{"type":35,"value":1498},"Working-group outputs: implementation contributions, standards, innovation work.",{"type":29,"tag":315,"props":1500,"children":1501},{},[1502],{"type":35,"value":1503},"A foundation the regional security function could build its first real strategy on, and the team that then carried it through the separation.",{"type":29,"tag":30,"props":1505,"children":1506},{"id":342},[1507],{"type":35,"value":345},{"type":29,"tag":38,"props":1509,"children":1510},{},[1511],{"type":35,"value":1512},"The state I walked into was worse than I had been told. I arrived with management experience and still, the first few weeks of reading the room shifted my plan fast. Fragmented functions are one thing. A team already halfway out the door is another. Starting with strategy would have been building on sand.",{"type":29,"tag":38,"props":1514,"children":1515},{},[1516],{"type":35,"value":1517},"The layoff call was delicate. It had to be right, and it had to be seen to be right. Getting both to line up without being cruel about it is the hardest kind of management call, and I did not shortcut it.",{"type":29,"tag":38,"props":1519,"children":1520},{},[1521],{"type":35,"value":1522},"Leading a team split across two sites, and serving customers in four markets from those two sites, meant presence had to be manufactured. Trust that builds naturally when you're in the same office had to be engineered: through travel, through a communication channel used daily, and through a local lead who could carry the presence I couldn't. The structure had to compensate for the geography, every day.",{"type":29,"tag":38,"props":1524,"children":1525},{},[1526],{"type":35,"value":1527},"The pressure from above did not ease up. PPF had arrived under its own pressure from the acquisition, and the urgency flowed down. Every week the expectation was more output, more coverage, more reporting. The team needed oxygen to come back to life. The stakeholders needed deliverables. Both were legitimate, and they pulled against each other.",{"type":29,"tag":38,"props":1529,"children":1530},{},[1531],{"type":35,"value":1532},"And the pivot from salvage to build had its own tension. The moment the team was breathing again, the expectation was that strategy would appear, fully formed. Strategy on top of a team still learning to be a team is fragile. Getting that pacing right, building while the team was still catching its breath, was the hardest stretch of the two years.",{"type":29,"tag":30,"props":1534,"children":1535},{"id":368},[1536],{"type":35,"value":371},{"type":29,"tag":38,"props":1538,"children":1539},{},[1540],{"type":35,"value":376},{"type":29,"tag":38,"props":1542,"children":1543},{},[1544],{"type":35,"value":1545},"One: cohesion is a precondition, not an outcome. You cannot strategize a broken team into coherence. I tried, for about three days, to start with a plan. Then I stopped and started with people. Every strategy track I have run since starts the same way.",{"type":29,"tag":38,"props":1547,"children":1548},{},[1549],{"type":35,"value":1550},"Two: the highest-leverage decision in a rebuild is not the strategy. It is the one appointment that signals what the organization now values. Picking someone early in their career, on substance rather than on seniority, told the rest of the team that this was not the same regime. That one call said more than any all-hands speech would have.",{"type":29,"tag":38,"props":1552,"children":1553},{},[1554],{"type":35,"value":1555},"Three: technical credibility used to narrow power distance is one of the most underrated management levers I know. It is not expertise for its own sake. It is the ability to meet a specialist on their ground, so that when you are not the expert in the room, nobody wonders whether you could have been.",{"type":29,"tag":38,"props":1557,"children":1558},{},[1559],{"type":35,"value":1560},"And the residue. I came out of those two years knowing what a team in real trouble looks like, and knowing that reading the room beats having a plan, at least at the start. A lot of how I build and lead teams now traces back to that.",{"type":29,"tag":398,"props":1562,"children":1563},{},[],{"type":29,"tag":38,"props":1565,"children":1566},{},[1567],{"type":29,"tag":86,"props":1568,"children":1569},{},[1570],{"type":35,"value":1571},"Sources (public record on the transaction and the resulting group):",{"type":29,"tag":311,"props":1573,"children":1574},{},[1575,1586,1597],{"type":29,"tag":315,"props":1576,"children":1577},{},[1578],{"type":29,"tag":86,"props":1579,"children":1580},{},[1581],{"type":29,"tag":174,"props":1582,"children":1584},{"href":1286,"rel":1583},[422],[1585],{"type":35,"value":1290},{"type":29,"tag":315,"props":1587,"children":1588},{},[1589],{"type":29,"tag":86,"props":1590,"children":1591},{},[1592],{"type":29,"tag":174,"props":1593,"children":1595},{"href":1299,"rel":1594},[422],[1596],{"type":35,"value":1303},{"type":29,"tag":315,"props":1598,"children":1599},{},[1600],{"type":29,"tag":86,"props":1601,"children":1602},{},[1603],{"type":29,"tag":174,"props":1604,"children":1606},{"href":1001,"rel":1605},[422],[1607],{"type":35,"value":1005},{"title":8,"searchDepth":462,"depth":462,"links":1609},[1610,1611,1612,1613,1614,1615,1616],{"id":32,"depth":465,"text":36},{"id":60,"depth":465,"text":63},{"id":71,"depth":465,"text":74},{"id":95,"depth":465,"text":98},{"id":621,"depth":465,"text":624},{"id":342,"depth":465,"text":345},{"id":368,"depth":465,"text":371},"content:references:management-regional-organization.md","references\u002Fmanagement-regional-organization.md","references\u002Fmanagement-regional-organization",{"loc":1351},1777227384261]