01Security
I treat security as a business risk, not a product feature.
- Threat modeling and risk register your board actually reads
- Identity, access and vendor-risk reviews (M365/Google Workspace, AWS/GCP/Azure)
- PCI, PHI and PII guardrails; penetration-test management and remediation
- Incident response runbooks — who picks up the phone at 2 a.m.
02Architecture
Systems your successors can understand — and price tags you can forecast.
- Current-state architecture review vs. 3-year growth plan
- Build vs. buy decisions: ERP/CRM vs. custom, monolith vs. services
- Integration strategy for multi-SaaS landscapes
- Technical-debt ledger with carrying cost and payback
03AI Strategy
LLM deployments with a payback period, not demos.
- Use-case portfolio ranked by payback and implementation risk
- Build vs. buy vs. wait decision framework per use case
- Model selection, data readiness and guardrail design
- Production scaling of vibe-coded applications
- Cost and governance of agents in production — where the money actually goes
07Compliance
Audit evidence generated by design, not panic.
- SOC 2, HIPAA, PCI-DSS and GDPR readiness assessments
- Control mapping to your actual stack and staffing
- Policy and exception processes auditors accept
- Vendor security questionnaires answered credibly
06Disaster Recovery
The plan you hope you never open — tested, not assumed.
- RPO/RTO targets set with the business, not IT alone
- Backup strategy and restore drills with documented results
- Failover design: what breaks, in what order, who decides
- Continuity plan: paper exercise at 3 a.m. before the real one
09Operations & maintenance
Custom software is only cheap if you design its O&M before the first line of code.
- Run-cost modeling: what each service will cost to operate before you decide to build it
- Designing for the on-call reality: fewer moving parts, boring technology, runbooks as deliverables
- Supportability reviews: logs, metrics and alerts as acceptance criteria, not afterthoughts
- Build vs. buy decisions that keep the total cost of ownership, not just the build cost, low
08Team Building
Hire slow, in a market that pays for evidence.
- Org design and hiring scorecards for roles you can't yet define
- Interview loops that find signal, not polish — remote teams included
- Compensation bands and career ladders for a 15→50-person org
- Onboarding and mentor structures that make first hires stick
04Performance
Speed is revenue: page load is conversion; latency is churn.
- Load-time and latency budgets tied to revenue metrics
- Database, cache and CDN tuning; queue and event-driven patterns
- Cost-per-transaction modeling before scaling spend
- Observability so performance regressions die in staging
05Infrastructure
Cloud as a utility bill you control, not a mystery.
- AWS/GCP/Azure strategy, landing zones and tagging/cost governance
- Infrastructure as code (Terraform) and CI/CD pipelines
- Kubernetes vs. serverless vs. PaaS — honest trade-offs
- Multi-region and multi-cloud when availability justifies it