Decision Record
Six decisions with the reasoning preserved — what the situation was, what I chose, what risk I knowingly accepted, and what changed.
A resume tells you what someone produced. It doesn’t tell you what they understood. AI has made that gap worse — polished output is now nearly free, so the artifact proves less than it used to. What it can’t fake is the moment a decision was hard, the alternatives were plausible, and the outcome would have been different without you in the room.
So here’s the record. Each entry follows the same structure: the situation, the decision, the risk I consciously accepted, and what changed. One of them is a failure. It belongs here as much as the others — maybe more.
The standard the industry called un-auditable
Situation
I was a temp hire with a prove-it task: write an audit protocol against NIST 800-53. The incumbent Big 4 firms had told government system owners that a single audit would take longer than the three-year window the audit was meant to cover. The economics of federal security assessment were broken, and everyone with credentials in the room had concluded the standard was the problem.
Decision
I didn’t start from the Big 4’s sampling methodology and try to compress it — that was the obvious path, and it inherits the assumption that made the audits slow in the first place. I sat down and read everything NIST had published: the full standards, the intent, the companion guides, not just the control appendixes. My political science degree turned out to be the unexpected advantage — NIST documents read like legislation. Three months later I had a protocol two qualified engineers could execute in one month.
Risk
A temp betting his credibility that the entire incumbent industry had misread the standard. If DHS validation went badly, I wasn’t an innovator — I was a contractor who cut corners on federal security.
Change
DHS validated the methodology against Inspector General results across five systems: audits completed in 10% of the time, two orders of magnitude more findings. It repriced federal security assessment, helped DHS move its congressional cybersecurity score from a D to a B+ in one year, and the cloud audit protocol I wrote next became a foundation of FedRAMP.
Extending the perimeter into a country that doesn’t enforce IP rights
Situation
The firm was opening an on-shore Mainland China office. At a quant firm, information asymmetry is the business model — the algorithms are the company. Now extend your security perimeter into a jurisdiction where IP protection isn’t enforceable and the threat model includes the host environment itself, while still earning regulatory approval to operate there.
Decision
Independent trust infrastructure. Not the standard playbook — extend the existing perimeter, add stronger controls, paper the gap with contracts — because contracts only work where someone enforces them. I designed the office as architecturally isolated: a trust boundary built on the assumption that the surrounding environment is adversarial, with the protections living in the architecture rather than in agreements.
Risk
Cost and friction. An isolated trust architecture is more expensive to build and slower to operate than an extended perimeter, and I was betting it could coexist with the regulatory approval and market access the business needed. If the friction killed the office’s usefulness, the architecture was the reason.
Change
The office operated. Regulatory approval came. The trading strategies stayed protected. And the design became my reference case for a principle I’ve used since: when the legal layer can’t carry the risk, the architecture has to.
Security Engineering builds the trading system
Situation
Two Sigma Securities was converting its crypto market-making infrastructure from custom FPGA hardware to cloud-native AWS. Crypto has none of the legal and regulatory safety nets that traditional finance provides — no clearinghouse backstop, no recourse when something goes wrong. In traditional markets, part of your risk is absorbed by the system around you. In crypto, the gap is yours.
Decision
I persuaded the CTO that Security Engineering should build the system — not review it, build it. The standard model is that trading technology builds and security audits. I argued that when the safety nets are missing, the gap has to be filled architecturally rather than contractually, and the team that thinks in failure modes should own the construction.
Risk
My organization owning delivery of revenue-critical trading infrastructure, in a domain security organizations aren’t supposed to own. If we shipped late or shipped wrong, there was no ambiguity about whose failure it was — and the precedent of security teams asking for build authority would die with it.
Change
The migration shipped. The architecture carried the risk the legal system couldn’t. And it settled something I’d argued for years: security as a service-delivery organization, not a review gate, is a viable operating model at the highest stakes.
The GenAI call every peer was making the other way
Situation
ChatGPT launched, and the consensus move among security leaders was to block it — especially at firms where the intellectual property is the product and a small leak could move markets. Legal was skeptical. There was no vendor playbook, no industry guidance, no precedent. Blocking was free, defensible, and what everyone else was doing.
Decision
Don’t block. Build. I rejected the wait-for-consensus path because the cost of blocking wasn’t zero — it just wasn’t visible yet. It compounds as the capability gap between your firm and the frontier widens. We designed guardrails from scratch, cleared the legal and IP concerns one by one, and had generative AI in full production workflows by mid-2023.
Risk
I consciously accepted IP-exposure risk bounded only by guardrails I had to invent, at a firm where the IP is everything. If a leak traced back to an AI workflow I’d championed over legal’s skepticism, that’s a career-defining failure with my name on the decision memo.
Change
Production by mid-2023: novel trading strategies, AI-automated data cleaning, and a governance pattern — amplification over automation, human review where judgment lives — that I carried into OCC and that now governs AI inside critical market infrastructure.
Eighteen months of covering for the red
Situation
Peer organizations were falling behind on commitments my program depended on. I had the visibility to see it early. The choice in front of me, week after week: surface the slippage and create conflict, or quietly absorb the gap and keep the joint commitments green.
Decision
I covered. For eighteen months. I told myself it was teamwork — protecting partners, keeping the machine moving. The decision I actually made was to misprice the risk: I treated the danger as the embarrassment of red status, when the real danger was the compounding cost of deferred honesty. Then the house of cards collapsed, the way it always does, at the worst time and all at once.
Risk
This is the entry where I assessed the risk wrong, which is why it’s here. The risk I thought I was managing was reputational friction. The risk I was actually accumulating was a failure too large to absorb when it finally surfaced — with my credibility attached to every green status that should have been red.
Change
An operating principle I’ve enforced in every organization since: embrace the red. Admit what isn’t working, early, while honesty is still cheap. I now build reporting cultures that reward the person who surfaces the problem first — because the cost of honesty only ever goes up.
Stop writing better prompts. Build the substrate.
Situation
I was running autonomous coding agents at scale on a production system. The industry answer to agent reliability was richer prompts, and I was living the result: specifications averaging nearly 9,000 characters per session, regressions still slipping through, and every session starting from a blank page because the specification lived in the prompt and died with it.
Decision
I rejected better-prompting entirely and moved the specification upstream into a versioned substrate — a derivation chain running canon, decisions, requirements, designs, code, tests, where every layer cites the one above it. Prompts stopped carrying the specification and became pointers to it. The agent dereferences at runtime.
Risk
Weeks of building substrate instead of features, on a bet that the bottleneck was structure rather than prose — against the visible momentum of an entire industry investing in the prompt layer. If the bet was wrong, I’d burned the time and still had the regressions.
Change
Prompts collapsed from roughly 9,000 characters to about 1,300 — while completion rates went up, and regressions went to zero across the last 180 builds. The full write-up, with the numbers, is in What We Build for the Index. It’s the only entry on this page whose evidence is still running in production right now.