“Building an application security program is about ensuring security is built into the software development lifecycle and how to respond to vulnerabilities." Derek Fisher is the author of “Application Security Program Handbook”. In this episode, Derek shared about building an application security program and how to implement it in our organization. First, we discussed some security fundamental concepts, such as shift-left, CIA triad, and threat modeling. Derek then outlined how to start an application security program and measure the program’s success. Derek also touched on the security program maturity model and gave his tips on how to build and hire application security teams. Towards the end, Derek also gave his insights on how to address zero-day vulnerabilities when it becomes prominent.   Listen out for: Career Journey - [00:03:51] Building Application Security Program - [00:06:56] Shifting Left - [00:11:58] CIA Triad - [00:16:30] Threat Modeling - [00:19:04] Threat Classification - [00:22:49] Starting Application Security Program - [00:27:04] Security Program Maturity Model - [00:32:45] Building Security Teams - [00:35:27] Measuring the Program’s Success - [00:40:19] Zero Day Vulnerabilities - [00:42:48] 3 Tech Lead Wisdom - [00:44:59] _____ Derek Fisher’s BioDerek is an award winning author of a children’s book series in cybersecurity as well as the author of “The Application Security Handbook.” He is a university instructor at Temple University where he teaches software development security to undergraduate and graduate students. He is a speaker on topics in the cybersecurity space and has led teams, large and small, at organizations in the healthcare and financial industries. He has built and matured information security teams as well as implemented organizational information security strategies to reduce the organizations risk. His focus has been to raise the security awareness of the engineering organization while maintaining a practice of secure code development, delivery, and operations. Follow Derek Fisher: LinkedIn – linkedin.com/in/derek-fisher-sec-arch YouTube – @securelybuilt5967 Website – securelybuilt.com _____ Our Sponsors Are you looking for a new cool swag? Tech Lead Journal now offers you some swags that you can purchase online. These swags are printed on-demand based on your preference, and will be delivered safely to you all over the world where shipping is available. Check out all the cool swags available by visiting techleadjournal.dev/shop. And don't forget to brag yourself once you receive any of those swags. Like this episode? Show notes & transcript: techleadjournal.dev/episodes/138 Follow @techleadjournal on LinkedIn, Twitter, and Instagram. Buy me a coffee or become a patron.

“It’s not about the tools or processes. Most important is you understand the target outcomes for your customers and establish the right level of shared situational awareness across the teams." Robert Benefield is the author of “Lean DevOps: A Practical Guide to On Demand Service Delivery”. In this episode, Robert shared insights on how we can apply the Lean DevOps mindset for building successful IT delivery organizations. Robert started by sharing what initiated him writing the book and how it differs from the other available DevOps books. Robert described the concept of on-demand service delivery and important concepts, such as knowing the target outcomes, building situational awareness, and making effective and timely decisions based on the OODA loop. Robert also shared a few practices and techniques he outlined in the book, such as mission command, workflow board, queue master, service engineering lead, value stream mapping, and Einheit.  Listen out for: Career Journey - [00:03:58] Writing a DevOps Book - [00:14:14] On Demand Service Delivery - [00:18:58] Mission Command - [00:21:42] OODA Loop - [00:26:56] Building Situational Awareness - [00:33:16] Workflow Management - [00:39:43] 3 Tech Lead Wisdom - [00:49:41] _____ Robert Benefield’s BioRobert Benefield is an experienced technical leader who has decades of experience delivering robust on-demand services to solve hard problems in demanding ecosystems including banking and securities trading, medical and pharmaceutical, energy, telecom, government, and Internet services. His continual eagerness to learn and work with others to make a difference has taken him from building computers and writing code in the early days of the Internet at Silicon Valley startups to the executive suite in large multinational companies. He shares his unique experience in the hopes that others can continue to build on it without having to collect quite as many scars along the way. Follow Robert: LinkedIn – linkedin.com/in/robert-benefield-25482 Website – leandevops.com Twitter – @leandevops _____ Our Sponsors Are you looking for a new cool swag? Tech Lead Journal now offers you some swags that you can purchase online. These swags are printed on-demand based on your preference, and will be delivered safely to you all over the world where shipping is available. Check out all the cool swags available by visiting techleadjournal.dev/shop. And don't forget to brag yourself once you receive any of those swags. Like this episode? Show notes & transcript: techleadjournal.dev/episodes/137 Follow @techleadjournal on LinkedIn, Twitter, and Instagram. Buy me a coffee or become a patron.

“Privacy is about handling data in a way that builds for both compliance and trust, maturity and transparency." Nishant Bhajaria is cybersecurity and data privacy executive and the author of “Data Privacy: A Runbook for Engineers”. In this episode, we discussed the importance of data privacy and privacy engineering. Nishant described his definition of data privacy and why it is becoming a key concern for users, companies, and regulators. He explained why doing data privacy is hard and how companies can build a privacy-first culture. Nishant also covered other data privacy topics, including data classification, data sharing, data consent, and data privacy applied to machine learning.   Listen out for: Career Journey - [00:03:29] Writing “Data Privacy” Book - [00:05:45] Building a Course - [00:10:04] Data Privacy Definition - [00:13:43] Data Privacy Concerns - [00:16:03] Data Privacy Regulations - [00:22:07] Data Privacy is Hard - [00:26:23] Privacy & Security - [00:31:22] Privacy-First Culture - [00:35:23] Data for Machine Learning - [00:39:23] Data Privacy Tooling - [00:42:45] Data Sharing - [00:45:45] Data Consent - [00:49:27] Data Classification - [00:52:10] 3 Tech Lead Wisdom - [00:55:46] _____ Nishant Bhajaria’s BioNishant Bhajaria is an executive in the cybersecurity and data privacy industry. Having started out as an engineer with a second act as a product manager, he pivoted to data protection before it became a high-visibility topic. Besides building and leading teams at Nike, Netflix, Google and Uber, Nishant has also authored the recently released Data Privacy: A Runbook for Engineers - a deep dive into strategies on effectively identifying, communicating and addressing privacy risks using technical strategies. He also teaches courses on LinkedIn Learning on cybersecurity, career development and building inclusive teams. Follow Nishant: LinkedIn – linkedin.com/in/nishantjb LinkedIn Courses – https://www.linkedin.com/learning/instructors/nishant-bhajaria _____ Our Sponsors Are you looking for a new cool swag? Tech Lead Journal now offers you some swags that you can purchase online. These swags are printed on-demand based on your preference, and will be delivered safely to you all over the world where shipping is available. Check out all the cool swags available by visiting techleadjournal.dev/shop. And don't forget to brag yourself once you receive any of those swags. Like this episode? Show notes & transcript: techleadjournal.dev/episodes/136 Follow @techleadjournal on LinkedIn, Twitter, and Instagram. Buy me a coffee or become a patron.

“Spend some time looking at the system in which you work. Understand how the work is working. Understand how flow is for your organization. And then you can work to optimize that." James Lewis is a Director at ThoughtWorks and a pioneer of microservice architecture. In this episode, we went back memory lane to the time when James first coined and popularized the microservice architecture. James described his definition of a microservice and its important characteristics. He also shared the recent microservice evolution, including the swing between microservice and monolith. In the second half, James shared his insights from complexity science related to different scaling patterns. Particularly, he explained how different hierarchy types can affect an organization’s growth rate. Towards the end, James gave some tips on how organization can detect signs of suboptimal growth and what we can do to maintain organizational agility.   Listen out for: Career Journey - [00:03:48] Coining Microservices - [00:07:25] Definition of Microservices - [00:14:13] Microservices Swing - [00:18:42] Scaling Law and Complexity Science - [00:24:05] Complex and Adaptive System - [00:40:01] Examining Sublinear Growth - [00:43:47] 3 Tech Lead Wisdom - [00:51:19] _____ James Lewis’s BioJames is a Software Architect and Director at Thoughtworks based in the UK. He’s proud to have been a part of Thoughtworks’ journey for fourteen years and it’s ongoing mission of delivering technical excellence for its clients and in amplifying positive social change for an equitable future. As a member of the Thoughtworks Technical Advisory Board, the group that creates the Technology Radar, he contributes to industry adoption of open source and other tools, techniques, platforms and languages. He is an internationally recognised expert on software architecture and design and on its intersection with organisational design and lean product development. After defining what was the newly emerging Microservices architectural style back in 2014, James’ primary consulting focus these days is helping organisations with technology strategy, distributed systems design and adoption of SOA. Follow James Lewis: Twitter – @boicy LinkedIn – linkedin.com/in/james-lewis-microservices/ Email – james.lewis@thoughtworks.com _____ Our Sponsors Are you looking for a new cool swag? Tech Lead Journal now offers you some swags that you can purchase online. These swags are printed on-demand based on your preference, and will be delivered safely to you all over the world where shipping is available. Check out all the cool swags available by visiting techleadjournal.dev/shop. And don't forget to brag yourself once you receive any of those swags. Like this episode? Show notes & transcript: techleadjournal.dev/episodes/135 Follow @techleadjournal on LinkedIn, Twitter, and Instagram. Buy me a coffee or become a patron.

“The three core dimensions of developer experience are feedback loops, cognitive load, and flow state." Margaret-Anne (Peggy) Storey and Abi Noda are the coauthors of the recently published ACM paper “DevEx: What Actually Drives Productivity”. In this episode, we discussed how we can better measure and improve developer productivity using a developer-centric approach. Peggy and Abi first began by explaining the importance of socio-technical factors in software development. They also shared their view on the well-known SPACE and DORA metrics, and pointed out the danger of misusing and abusing the DORA metrics. Peggy and Abi then explained the three core dimensions of developer experience from their latest paper, which are feedback loops, cognitive load, and flow state. Towards the end, Peggy and Abi shared tips on how we can start measuring developer experience, including how to conduct developer surveys properly.   Listen out for: Career Journey - [00:04:09] First Developer Experience Paper - [00:06:19] Socio-Technical Factors - [00:07:37] SPACE & DORA Metrics - [00:13:35] Misuse and Abuse of DORA Metrics - [00:18:52] New Developer Experience Paper - [00:22:29] Developer Experience - [00:24:55] 3 Core Dimensions - [00:28:11] Optimizing Feedback Loops - [00:32:44] Cognitive Load - [00:37:06] Flow State - [00:40:32] Importance of Culture - [00:46:25] Measuring Developer Experience - [00:50:27] Conducting Survey - [00:54:29] 3 Tech Lead Wisdom - [01:00:10] _____ Margaret-Anne Storey’s BioMargaret-Anne (Peggy) Storey is a professor of computer science at the University of Victoria and holds a Canada Research Chair in human and social aspects of software engineering. Her research focuses on improving processes, tools, communication, and collaboration in software engineering. She serves as chief scientist at DX and consults with Microsoft to improve developer productivity. Abi Noda’s BioAbi Noda is the founder and CEO at DX, where he leads the company’s strategic direction and R&D efforts. His work focuses on developing measurement methods to help organizations improve developer experience and productivity. Before joining DX, Noda held engineering leadership roles at various companies and founded Pull Panda, which was acquired by GitHub in 2019. For more information, visit his website at abinoda.com. Follow Margaret: LinkedIn – linkedin.com/in/margaret-anne-storey-8419462 Twitter – @margaretstorey Follow Abi: LinkedIn – linkedin.com/in/abinoda Twitter – @abinoda Newsletter – newsletter.abinoda.com _____ Our Sponsors Are you looking for a new cool swag? Tech Lead Journal now offers you some swags that you can purchase online. These swags are printed on-demand based on your preference, and will be delivered safely to you all over the world where shipping is available. Check out all the cool swags available by visiting techleadjournal.dev/shop. And don't forget to brag yourself once you receive any of those swags. Like this episode? Show notes & transcript: techleadjournal.dev/episodes/134. Follow @techleadjournal on LinkedIn, Twitter, and Instagram. Buy me a coffee or become a patron.

“The goal of requirements development is clear and effective communication. Thus, it has to be done in an incremental and iterative fashion." Karl Wiegers is the coauthor of “Software Requirements Essentials” and has previously appeared in our episode #103. In this episode, we discussed 6 essential practices for software requirements out of the 20 core practices specified in his book. Karl also explained the importance of having a clear and effective communication in developing software requirements, his view on doing software requirements for Agile teams, and the importance of having good software requirements for becoming an effective software development team and for avoiding unnecessary rework.   Listen out for: What Karl is Up To Lately - [00:04:08] Writing “Software Requirements Essentials” - [00:05:20] Software Requirements - [00:10:19] Clear & Effective Communication - [00:13:20] Importance of Requirement Details - [00:16:19] Practice #1 - Understand the Problem Before Converging on a Solution - [00:22:05] Practice #3 - Define the Solution’s Boundaries - [00:26:26] Requirements Elicitation vs Requirements Gathering - [00:30:47] Practice #6 - Understand What Users Need to Do With the Solution - [00:33:01] Software Requirements in Agile - [00:37:06] Requirements & Effective Software Development - [00:40:59] Rework - [00:44:39] Practice #19 - Establish and Manage Requirement Baselines - [00:46:20] Practice #13 - Prioritize the Requirements - [00:49:17] Practice #20 - Manage Changes to Requirements Effectively - [00:52:22] 3 Tech Lead Wisdom - [00:55:54] _____ Karl Wiegers’s BioKarl Wiegers is Principal Consultant with Process Impact. He has a PhD in organic chemistry. Karl is the author of 14 books, including Software Requirements Essentials (with Candase Hokanson), Software Requirements (with Joy Beatty), Software Development Pearls, The Thoughtless Design of Everyday Things, Successful Business Analysis Consulting, and a forensic mystery novel titled The Reconstruction. Karl has delivered more than 650 training courses, webinars, and conference presentations worldwide. You can reach him at ProcessImpact.com or KarlWiegers.com, where you can also hear more than 50 songs he has recorded just for fun, including 18 originals that he wrote. Follow Karl: LinkedIn – linkedin.com/in/karlwiegers Website – karlwiegers.com Software Requirements Essentials – softwarereqs.com Process Impact – processimpact.com Medium – karlwiegers.medium.com _____ Our Sponsors Are you looking for a new cool swag? Tech Lead Journal now offers you some swags that you can purchase online. These swags are printed on-demand based on your preference, and will be delivered safely to you all over the world where shipping is available. Check out all the cool swags available by visiting techleadjournal.dev/shop. And don't forget to brag yourself once you receive any of those swags. Like this episode? Show notes & transcript: techleadjournal.dev/episodes/133. Follow @techleadjournal on LinkedIn, Twitter, and Instagram. Buy me a coffee or become a patron.

“Speak about topics you are passionate about, because if you are passionate about something, you can easily find the story and the motivation that will lead you to success." Oscar Santolalla is the author of “Rock the Tech Stage” and the host of the “Time to Shine” podcast. In this episode, we discussed techniques on how to deliver a successful tech presentation and demo. Oscar broke down the elements of a successful tech presentation, in particular, explaining in-depth the three essential elements of passion, storytelling, and interaction. Oscar also shared some practical tips on how to deliver a killer product demo, some presentation slides hacks, and insights on how we can use our voice more effectively when delivering talks.   Listen out for: Career Journey - [00:03:47] Writing Public Demo and Public Speaking Books - [00:08:40] Elements of a Successful Public Speaking - [00:12:52] Passion - [00:23:10] Storytelling - [00:25:20] Delivering Product Demos - [00:28:55] Presentation Slides - [00:34:56] Importance of Voice - [00:38:31] 3 Tech Lead Wisdom - [00:42:09] _____ Oscar Santolalla’s BioAfter a decade and a half in the technology arena, Oscar embarked on a mission to help people in technology companies present better, inspire others, and sell more. He is author of “Rock the Tech Stage” (Apress, 2020) and “Create and Deliver a Killer Product Demo” (Apress, 2018). Oscar helps professionals in the technology industry rediscover the power of sharing their best ideas onstage. Since 2014, Oscar hosts Time to Shine, the pioneer podcast show in public speaking. He works as a Senior Sales Engineer at Ubisecure, in which he hosts the podcast “Let’s Talk About Digital Identity” and leads the company’s product training program. He has also contributed as speaking coach in several TEDx events. Oscar lives in Helsinki, Finland. Follow Oscar: LinkedIn – linkedin.com/in/oscarsantolalla Twitter – @osantolalla Website – rockthetechstage.com Rock the Tech Stage On Demand – rockthetechstage.com/ondemand (25% off with code: techleadjournal) _____ Our Sponsors Are you looking for a new cool swag? Tech Lead Journal now offers you some swags that you can purchase online. These swags are printed on-demand based on your preference, and will be delivered safely to you all over the world where shipping is available. Check out all the cool swags available by visiting techleadjournal.dev/shop. And don't forget to brag yourself once you receive any of those swags. Like this episode? Show notes & transcript: techleadjournal.dev/episodes/132 Follow @techleadjournal on LinkedIn, Twitter, and Instagram. Buy me a coffee or become a patron.

“The notion of transaction, consistency, and ACID compliance are many times tech imposed. It should be the business that makes the decision. We as technologists should not make that decision." Pramod Sadalage is a Director at ThoughtWorks and the co-author of the Jolt Award winning “Refactoring Databases”. In this episode, we discussed data essentials in software architecture. Pramod started by explaining why dealing with data is hard in software architecture and some data related concerns we should think about when making architecture decisions. He then shared the thought process of how we can choose the right database for our purpose and shared insights on data modeling differences between SQL and NoSQL. Pramod also touched on the important considerations in managing transactions and the trade-offs between ACID and eventual consistency. Towards the end, Pramod shared practical advice on the step-by-step how we can split a monolithic database through database refactoring.   Listen out for: Career Journey - [00:04:23] Data is Hard - [00:15:57] Data Related Architecture Concerns - [00:18:36] Choosing the Right Database - [00:24:19] Data Modeling in SQL vs NoSQL - [00:30:28] Managing Transactions - [00:37:31] Tradeoff Between ACID & Eventual Consistency - [00:44:06] Refactoring Database - [00:46:58] 3 Tech Lead Wisdom - [00:54:58] _____ Pramod Sadalage’s BioPramod Sadalage is Director at ThoughtWorks where he enjoys the rare role of bridging the divide between database professionals and application developers. In the early 00’s he developed techniques to allow relational databases to be designed in an evolutionary manner based on version-controlled schema migrations. He is co-author of Software Architecture: The Hard Parts: Modern Trade-Off Analyses for Distributed Architectures, co-author for Building Evolutionary Architectures - Automated Software Governance, co-author of Refactoring Databases: Evolutionary Database Design, co-author of NoSQL Distilled: A Brief Guide to the Emerging World of Polyglot Persistence, author of Recipes for Continuous Database Integration and continues to speak and write about the insights he and his clients learn. Follow Pramod Sadalage: Twitter – @pramodsadalage LinkedIn – linkedin.com/in/pramodsadalage Website – sadalage.com Database Refactoring – databaserefactoring.com DevOps for DBA – devopsfordba.com Agile Data – agiledata.org _____ Our Sponsors Are you looking for a new cool swag? Tech Lead Journal now offers you some swags that you can purchase online. These swags are printed on-demand based on your preference, and will be delivered safely to you all over the world where shipping is available. Check out all the cool swags available by visiting techleadjournal.dev/shop. And don't forget to brag yourself once you receive any of those swags. Like this episode? Show notes & transcript: techleadjournal.dev/episodes/131 Follow @techleadjournal on LinkedIn, Twitter, and Instagram. Buy me a coffee or become a patron.

“Understand the stage of your company and the kind of risks you face at that stage, make decisions that are appropriate, and remind other people about that all the time." Sarah Milstein is the VP of Engineering at Daily and has run remote teams for 25 years. In this episode, Sarah started by sharing some remote work insights we may not have heard before, such as why remote distributed teams often have higher propensity of trust, how remote work could help make difficult conversations easier, and how leaders can establish swift trust by having more intentional communications. In the second half of our conversation, Sarah shared about her experience of leading engineers as someone from a non-tech background. She explained why a lack of technical expertise can sometimes be useful and pointed out some leadership qualities an engineering leader should have to balance out the need for technical acumen. Sarah also shared her few tips on how to upskill herself in technical stuffs and her perspective on whether a company should consider having non-tech engineering leaders.   Listen out for: Career Journey - [00:03:49] Remote Work Insights - [00:08:04] Propensity of Trust - [00:12:26] Working Back in Office - [00:15:39] Other Remote Work Insights - [00:17:36] Ingroup Bias - [00:20:47] Swift Trust & Intentional Communication - [00:23:21] Accountability - [00:28:28] Being an Engineering Leader from a Non-Tech Background - [00:30:50] Leadership Qualities - [00:33:31] Benefits of Non-Tech Background - [00:35:15] Self-Learning Technical Stuffs - [00:39:23] Company Accepting Non-Tech Engineering Leaders - [00:41:51] 3 Tech Lead Wisdom - [00:45:14] _____ Sarah Milstein’s BioSarah Milstein is VP of Engineering at Daily, which lets developers add real-time video and audio to any app or website. Before Daily, Sarah held executive roles at ConvertKit, Mailchimp,18F.gov, and indie.vc. She was also CEO and co-founder of Lean Startup Productions and co-author of The Twitter Book. Earlier, she was a freelance journalist writing regularly for The New York Times. She holds an MBA from UC Berkeley and has run remote teams for 25 years. Follow Sarah: Website – sarahmilstein.com LinkedIn – linkedin.com/in/sarahmilstein _____ Our Sponsors Are you looking for a new cool swag? Tech Lead Journal now offers you some swags that you can purchase online. These swags are printed on-demand based on your preference, and will be delivered safely to you all over the world where shipping is available. Check out all the cool swags available by visiting techleadjournal.dev/shop. And don't forget to brag yourself once you receive any of those swags. Like this episode? Show notes & transcript: techleadjournal.dev/episodes/130 Follow @techleadjournal on LinkedIn, Twitter, and Instagram. Buy me a coffee or become a patron.

“The difference of why some companies are so much more successful at producing high value, high-impact products than others comes to 4 areas of GIST (Goals, Ideas, Steps, Tasks)." Itamar Gilad is a coach and author with over 20 years of experience in product management, strategy, and growth, and was previously a product manager at Google and the head of Gmail’s growth team. In this episode, we discussed all things about product management and how to build high-value products. Itamar first shared his journey at Google growing Gmail to 1 billion MAUs and some of his lessons learnt on managing large-scale product changes, getting users feedback, and dogfooding. Itamar then explained in-depth his GIST framework as an alternative to the product roadmap, a collection of methods and best practices for producing high-value and impactful products. He shared some challenges working with product roadmap and how teams can create better alignment instead. He also shared how we can do product prioritization better by using the ICE technique and his Confidence Meter. Towards the end, Itamar shared the different ways of how companies can conduct product experimentation and how to use the GIST board to improve the way we execute product development.   Listen out for: Career Journey - [00:04:17] Growing Gmail - [00:06:06] Managing Large Scale Product Changes - [00:07:26] Getting Feedback from a Major Product Change - [00:10:48] Dogfooding - [00:15:21] GIST - [00:19:10] Problem with Product Roadmap - [00:27:17] Creating Alignment - [00:34:22] Prioritization and ICE - [00:38:02] Doing Product Experimentation - [00:43:59] Project & Task Management - [00:48:43] 3 Tech Lead Wisdom - [00:54:39] _____ Itamar Gilad’s BioItamar is a coach, author and speaker specializing in product management, strategy, and growth. For over two decades, he held senior product management and engineering roles at Google, Microsoft and a number of startups. At Google, Itamar led parts of Gmail and was the head of Gmail’s growth team (resulting in 1Bn MAUs). Itamar publishes a popular product management newsletter and is the creator of a number of product management methodologies including GIST Framework and The Confidence Meter. Itamar is based in Barcelona, Spain. Follow Itamar: LinkedIn – linkedin.com/in/itamargilad/ Twitter – @ItamarGilad Website – itamargilad.com PM resources – itamargilad.com/resources Newsletter – itamargilad.com/newsletter _____ Our Sponsors Are you looking for a new cool swag? Tech Lead Journal now offers you some swags that you can purchase online. These swags are printed on-demand based on your preference, and will be delivered safely to you all over the world where shipping is available. Check out all the cool swags available by visiting techleadjournal.dev/shop. And don't forget to brag yourself once you receive any of those swags. Like this episode? Show notes & transcript: techleadjournal.dev/episodes/129 Follow @techleadjournal on LinkedIn, Twitter, and Instagram. Buy me a coffee or become a patron.