Work
Every entry opens on what was actually there and closes on what changed. Grouped by what kind of claim it is: work delivered for a client is the evidence worth weighing, and everything below that is context, separated so the two do not get confused.
Delivered for an Australian financial services licensee, an AFSL and ACL holder. Described by sector because the client is not mine to name. Each entry leads with the state I found rather than the work I did.
A$160
monthly run cost for the full monitored estate
Most small firms already pay for Defender and have never switched it on properly. Retention is the one control you cannot apply retrospectively, which is why this is worth doing before you need it rather than after.
0
stored deployment secrets after the change
If anything in your environment deploys automatically, it authenticates as something. Removing that credential is usually a shorter piece of work than writing the rotation policy you would otherwise need.
A$1,826A$340
monthly Azure run-rate, a reduction of about 81 per cent
The usual reason security work does not happen is that there is no budget line for it. In most small estates a meaningful part of that budget is already being spent on infrastructure delivering nothing.
975
privileged directory role assignments on the primary administrative account
Privileged access sprawls quietly, because every grant had a reason at the time and none of them looks wrong on its own. Counting it is a short job. Reducing it safely is the part that needs care.
3
artefacts delivered: guidelines, usage register, enforced policy
Staff adopt these tools individually, so there is no purchase record and no list. The register is the quick part and it usually surprises people. The enforcement is the part almost nobody delivers.
13
policies added across the IT, cyber and privacy layer
The obvious fix is to write a second manual covering technology. That is the wrong move, and it creates a worse problem than the thin section it replaces.
Delivered as an employee at the New Zealand Ministry of Social Development. Not directly comparable to the work above, and included because it is where the delivery judgement came from rather than as evidence of consulting.
Heritage subject matter lead and Lead Technical BA on a roughly 150-person programme replacing a heavily customised Cúram employment product with a new Salesforce implementation.
Migrated the data and functionality of a legacy recruitment platform into Merative Cúram, with process uplifts delivered alongside rather than a pure lift and shift.
Took the lead technical BA role on an end-of-life payment systems change, adding card balance visibility, PIN change and automated card locking to a gateway untouched since the early 2010s.
Redeployed as a junior analyst onto the national hardship response, delivering self-service benefit application during lockdown and straight-through processing for simple client cohorts.
An external-facing Cúram partner portal where emergency, transitional and social housing providers define the housing they are providing, flowing back into internal case management.
Personal, unqualified, and labelled so on every entry. Here because the disposition is relevant, not because it is experience.
Roughly fifteen years of woodworking by hand and machine, and restoring old tools with a range of machines until they look new again. Personal, unpaid, and no qualification behind any of it.
PCs built from scratch, three operating systems lived in, and Layer 2 and Layer 3 networking learnt in a home lab. Self-directed study, with no certification and no production configuration.