Justin Head

After years of leading security through scaling challenges, I'm sharing the mental models that have worked really well for me! If you're a security leader, you've probably hit this wall: your team can't keep up with security review requests, compliance work is consuming everything, and the traditional playbook to hire more people isn't solving the problem. I've lived this at NASA, at startups that went through acquisitions, and now at GitLab helping secure one of the world's largest DevSecOps platforms. What I I have learned in all these years is that there's no one-size-fits-all security strategy. What works for a cloud-native startup fails spectacularly at an enterprise with decades of legacy systems. So I built something different => the Software Factory Security Framework (SF²) which is a strategic positioning model that helps security leaders figure out what's actually appropriate for their organization, not someone else's. The 60-second version:  - Two-axis model: assess your operational complexity + operational readiness  - Four strategic positions with different playbooks (not everyone needs "enterprise" security)  - Honest timelines (yes, some transformations really take 3-5 years)  - Works alongside frameworks you already use (NIST, OWASP, etc.)  - Focuses on sustainable scaling vs. endless manual work A few things I believe:  - Supply chain security became #1 priority when adversaries evolved to automated discovery at scale  - Context matters more than "best practices"  - Realistic timelines beat wishful thinking every time  - Security scales through strategic investment, not just headcount Why I'm sharing this openly: This is my personal work (not an official GitLab framework), but these mental models do inform how I approach security strategy at GitLab. I'm making it fully open source (CC BY 4.0) because I believe our industry gets stronger when we share strategic thinking, not just tactical checklists.  What I need from you:  - Read it and tell me what I got wrong  - Contribute real-world examples  - Share it with security leaders who might find it useful  - Challenge the frameworks where your experience differs This isn't finished, it's a living framework that gets better with community input. If you've scaled security at organizations from 10 to 10,000 engineers, you have perspective that can make this better. Check it out: 📖 Website: https://sf2framework.com 💻 GitLab Repo: https://lnkd.in/e56ijVTy Whether you agree or disagree with the approach, I'd love to hear from you. Security leadership is hard enough; we should help each other navigate it honestly.

555

29 Comments

Today marks Six months in as SOCPAC CTO, and it somehow feels like both yesterday and six years ago. When I stepped into this role, we were behind the curve. Legacy systems, siloed data, and slow processes held us back. In just half a year, we’ve laid a Foundational Technical Architecture that gave us a modern backbone for data, AI, and autonomy. Since then, we’ve: 1. Unified our digital foundation for secure, scalable operations 2. Embedded AI and LLMs into daily workflows to speed decisions 3. Deployed containerized AI agents across all networks 4. Integrated autonomy at the edge, moving toward true man–machine teaming 5. Shifted our culture from cautious adoption to championing innovation The result? We’re no longer catching up, we’re setting the pace. What once felt like a distant goal is now part of our daily reality. All of this happened in six months, which is why it feels so surreal. It took countless late nights, cross-functional sprints, and the relentless dedication of an amazing team. I'm humbled by the trust the organization placed in me to drive this transformation, and I'm grateful to every person who rolled up their sleeves to make it real. This was truly a team effort, from the junior analysts using our new AI tools to the senior leaders who empowered us to take bold risks. And we’re just getting started. The foundation is in place, but now we get to build on it. In the next chapter, we'll be refining and scaling these capabilities, drilling deeper into AI-enhanced decision-making, and pushing the envelope on autonomous operations. The technology will keep evolving, and so will we. Our goal remains the same: give our operators a decisive edge, making it an extension of the warfighter and keep innovating responsibly. I’m humbled by what the team accomplished in such a short time, and excited for what’s next. The foundation is in place. Now we build on it. Six months down, and the journey is just beginning.

170

19 Comments

Today I am excited to announce Digger’s BIGGEST update ever Project OpenTaco - The Open Standard for Terraform automation. With OpenTofu, where Digger is a founding member, the community already has a credible open-source CLI alternative to BSL-licensed Terraform. But as we all kno that only solves half the problem. The CLI helps teams avoid lock-in, but it doesn’t address governance or collaboration challenges at scale. Project OpenTaco builds on this foundation, without taking an opinion on which IaC language is used, giving teams a path to adopt more Infrastructure-as-Code with a TACOs that is open, self-hostable, and free from licensing traps or per-resource pricing. We believe that it this is “Terraform’s backstage moment”. Backstage became the open standard for Internal Developer Portals, we believe Project OpenTaco will do the same for IaC automation, setting the standard, driving adoption, and making closed platforms unnecessary. The future of IaC is open, and we’re building it brick by brick. Check out our roadmap and sign up for updates, we’d love any and all feedback! Link in the first comment ->

93

11 Comments

Uptime isn’t a goal. It’s a side effect of doing everything else right. If your leadership only cares about uptime after an outage, you don’t have an SRE function, you have scapegoats. Reliability and quality should be at the beginning of every product development conversation. Relying on post-incident heroics is one of the least efficient ways to effectively achieve reliability, especially at scale. Every outage costs more to resolve than it would have cost to prevent. But that should be obvious and a statement that goes without saying. It drains time, energy, and focus that could have been spent improving systems and building better product instead of repairing them. Everyone needs to be part of the reliability conversation before incidents happen, when initial investment and prevention can make the biggest impact. If executives and people only show up after the fact, the temptation is to find someone to blame rather than address the systemic gaps that caused the problem in the first place. Strategic investment in resilience upfront is not just good engineering, it’s sound business. If your reliability work begins when the incident starts, you’re not building for the future. You’re just cleaning up the past.

49

1 Comment

So which models produce HTML that has the least accessibility errors, and at what cost? Mapped it out here (bottom left is the best). This is helpful for understanding which models are most compliant for those with disabilities and do it efficiently. Qwen and Gemini 2.5 Flash lead the pack. Hat tip to Ben Ogilvie for pointing me to this: aimac.ai

48

2 Comments

Scaling your engineering team from 1 to 50 (and beyond) is one of the biggest tests for any founder. Too many leaders wait until problems force change instead of making proactive decisions that set their teams up to grow. In this micro memo, Bessemer Operating Advisor and long-time CTO Jessica Popp shares lessons from decades leading engineering orgs through every stage of scale. If you’re growing fast, this is your playbook for avoiding decisions you can’t easily undo and building a team that grows with you. 📖 Read the full guide: https://lnkd.in/gfFSgz8b #startups #engineering #techleadership #engineeringmanagement #scalingstartups

37

2 Comments

The EnFi, Inc team just launched another major customer! I’m still amazed seeing in action what production-level Agentic Architecture unlocks for both customers and platforms. What it means in practice: No more months of ETL. Connect, understand, act, day one. Immediate value: Immediate ~30%+ time and efficiency compression through automation across the process. Step-function jump: Application processing from 1–2 days ➜ ~7–10 minutes. In software terms, that’s wild. Flexes to new use cases. We’re no longer stuck in the rinse-and-repeat of onboarding ➜ product ➜ engineering to ship value. Feedback is built-in. Agents and users surface issues in flow; improvements feed straight into the pipeline. Fixes in days or weeks, not months or release cycles. That’s PLG, the way it should be. Super excited for what’s next, and incredibly grateful to our earliest customers for seeing (and shaping) what’s possible. We are live, this is real, and we are scaling a digital workforce for credit. And it makes me realize, Agentic is the new paradigm for software and product led growth. #AI #Agentic #Fintech #Lending #PLG #Automation #TimeToValue

76

3 Comments

Our first server crashed twice a week. Now we have 99.999% uptime. Eight years ago, we were a handful of folks with free AWS credits, praying it wouldn't go down during demos. Spoiler alert: It did. Constantly. Today, we serve thousands of users across six continents with infrastructure that just works. The difference? We learned that reliability isn't a feature; it's the foundation everything else is built on. Every crash taught us something. Every outage made us stronger. Every frustrated customer email forced us to get better. The companies that survive aren't the ones that never fail. They're the ones that fail fast, learn faster, and build systems that prevent the same failure twice. What's the most important lesson a system failure taught your business?

38

1 Comment