A software firm was shipping regularly, but the way it shipped had grown up by accident. Deployments depended on steps only one engineer remembered, secrets were handled more casually than anyone was comfortable admitting, and the pipeline had no real checks between a commit and production. Nothing had gone badly wrong yet, which was rather the problem — the team knew it was running on luck, and a couple of larger prospects had started asking questions about exactly this during their reviews.
They needed someone who could tighten how software was built, tested and released without bringing delivery to a halt, and who treated security as part of the pipeline rather than a gate bolted on at the end.
What the gap really was
- Releases relied on undocumented steps held in one person’s head.
- Secrets and access were handled loosely enough to fail a serious review.
- There were few checks between writing code and running it in production.
- Any fix had to make delivery safer without making it slower.
How we approached it
We placed a DevOps engineer with a security background, embedded in the client’s team and working to its engineering lead. Because we run a security and compliance practice ourselves, the engineer was not working alone — the harder questions could be checked against people who deal with them every day. They started with the changes that removed the most risk for the least disruption, rather than rebuilding everything at once.
The work was done in the open with the team so it stuck after the engagement: the deployment steps were written down and automated, access was tidied up, and checks were added to the pipeline that the team understood and could maintain. The aim throughout was to leave the firm able to keep delivery tight on its own.
Where it stands
Releases no longer depend on one person being available, and the firm can answer the questions a security review asks without scrambling. The practices that were put in place are ones the team now follows itself. The work that was the firm’s quiet worry has become part of how it ships.