Viv.

AI has become fundamental to how I engineer software daily. Claude Code is the primary tool at the moment, but this is a fast-moving domain and, like any good engineer, the decisions I’m making today are designed to allow change later.

Twenty-five years of learning how to manage teams (scoping work clearly, breaking down problems, TDD, pairing, code review, iterating in small increments) is proving to be exactly what’s needed to be effective with AI agents. I’m applying the tried and trusted methods of XP and software engineering to a new kind of collaborator.

Beyond the daily practice, there’s deeper thinking to be done. AI reduces the cost of producing code, but that doesn’t automatically mean better outcomes. When code is cheap, quality, security, and fitness for purpose become the real constraint. The benefits are real, but so are the trade-offs, and experienced engineers are perfectly placed to navigate them.

I’ve applied this thinking at broader scale too, leading a comprehensive research programme for a UK government department evaluating AI-powered security tools. Analysing 60+ solutions, developing a structured evaluation framework, and authoring a 50+ page technical report that senior stakeholders called “a magnificent piece of work.”

These are early days, I’m keeping a close eye on which principles will endure.

Long-term contributor to Openfire, the reference XMPP server used by military, healthcare, and defence organisations worldwide, working closely with the project’s lead maintainer. My work has spanned emergency vulnerability response (CVE-2023-32315), foundational improvements (replacing the networking framework with Netty to support TLS 1.3, certificate revocation via OCSP and CRL), and planning for post-quantum cryptography.

Most recently, a systematic overhaul of the cryptographic foundations (eliminating hardcoded IVs, replacing weak key derivation with PBKDF2, migrating from CBC to authenticated GCM mode) all while maintaining backward compatibility with years of production data across the global user base. Introduced Architecture Decision Records to give maintainers of a 20-year codebase a way to understand why things are the way they are.

I served as Technical Authority for Threatvine, the platform at the heart of CiSP, the UK’s cyber security information-sharing capability. CiSP became a model that governments worldwide sought to replicate, and I was the technical lead behind the platform for a decade. That meant owning the technical roadmap, leading engineering projects, and steering the platform’s productisation across its full lifecycle.

Alongside the engineering, the role opened doors across the sector: integrating with academic research teams, exploring partnerships with international threat intelligence companies, supporting a globally significant financial services organisation, and engaging with multiple national governments exploring their own CiSP-like information sharing capabilities.

Throughout my career I’ve built systems that communicate across security domains where each side operates at a different level of trust. From cross-domain messaging and collaboration services, mobile push notifications bridging secure and open networks, through to a nationally significant service processing the most sensitive personal information across security boundaries using a serverless architecture.

Cross-domain engineering means rethinking trust at every layer: data schemas, identity, validation, gateways, and the business processes that wrap around all of them. There are no shortcuts, the quality of the engineering is the security.

I’m as comfortable in the terminal configuring clusters as I am writing the applications that run on them. I’ve transformed manual deployment processes into automated, reproducible infrastructure: air-gapped Kubernetes clusters, deployment pipelines that reduced 40+ manual steps to under 10, and infrastructure defined entirely in code so every environment is a known quantity.

All of this came together when I delivered a resilience overhaul of a nationally significant UK government system. Mapping the single points of failure, replacing the database layer with a distributed YugabyteDB deployment across multiple availability zones, and proving it all with chaos engineering.

Early in my career I worked alongside security assessors and quickly learned that the systems which held up under scrutiny were the ones where security had been baked in from the start. That stuck with me. Since then I’ve built tooling that connected software developers with Security Operations Centre analysts, making security logging something the team designed for rather than bolted on after the fact.

R&D into browser-based end-to-end encryption reinforced the same lesson. Treating encryption as a first-class architectural concern, rather than a layer added later, opens up possibilities that simply aren’t there when it’s an afterthought. The technical side matters, but the real skill is translating risk into decisions that people across the organisation can understand and act on.

I was brought in at the formation of CERT-UK to build the platforms that UK national cyber security coordination ran on. The incident management system, the public-facing website, and CiSP, the government’s platform for sharing threat intelligence across public and private sector organisations. After launch I led CiSP’s first major redesign and steered its evolution over the following years.

When CERT-UK evolved into the NCSC, I managed the transition of CiSP to its new home. That meant rebranding, decommissioning legacy infrastructure, migrating users, and coordinating penetration testing, all while keeping live services running for the people who depended on them.

I’ve been fully remote for over a decade, long before the pandemic made it mainstream. That’s a lot of time to figure out what actually makes distributed teams work. For me it comes down to the small things: checking in on the new starter every day, making sure remote meetings feel human, and noticing when someone’s gone quiet.

Remote work is easy to do badly. It works when people genuinely look out for each other and adapt when something isn’t working. I’ve always tried to be the person who does that, whether it’s adjusting how we communicate or changing working practices when someone is struggling.