Recent content on Davy Hua | Security & Cloud Infrastructure Operations
I’ve been quiet online. 
 Not because I ran out of opinions. 
 Mostly because I’ve been doing the work: building infrastructure, hardening systems, and cleaning up the kind of problems that only show up at 3am. 
 What I’ve Been Doing 
 The past few years have been spent in the trenches. Running platform teams, navigating SOC 2 audits, and figuring out how to make…
I build and lead security and cloud infrastructure organizations. Not the “add a firewall and call it done” kind. The kind where secure delivery is the default, compliance is an engineering problem, and the platform doesn’t page you at 3 AM. 
 There’s a pattern in my career: I walk in, build the thing, and end up running it. DevOps Manager to Director to VP of…
Security isn’t a later problem. If you treat it like one, it will show up later, during an incident, when you’re tired, under pressure, and improvising in production. 
 DevSecOps isn’t magic. It’s just the boring discipline of building security into the work you already do. 
 Below are six myths that keep teams stuck. 
 Myth #1: DevSecOps is just adding security…
DevOps is getting commoditized (and it’s our fault) 
 DevOps didn’t become hard to hire. It became easy to fake. 
 When everyone can paste the same tooling list into a résumé, DevOps turns into a commodity role: interchangeable, keyword-driven, and detached from the actual job, running systems without drama. 
 Here’s the fix, from both sides of the table. 
 The…
DevSecOps isn’t a slogan. It’s guardrails. 
 If your security strategy is run a scanner and hope, you don’t have DevSecOps. 
 You have a pipeline that produces findings. 
 DevSecOps is simpler (and harder) than the conference talk version: 
 
 security is part of how you ship 
 teams share ownership 
 guardrails make the safe path the easy path 
…
Security doesn’t fail because your scanner missed something. 
 Security fails because: 
 
 someone ignored the alert 
 someone didn’t know what it meant 
 someone didn’t feel responsible 
 or nobody had time to fix it 
 
 Tools matter. 
 But tools don’t own risk. People do. 
 In DevOps environments, automation helps you move faster.…
DevOps is overwhelming because the internet won’t shut up. 
 As a beginner DevOps engineer, you’ll feel like you’re behind. 
 Because every week there’s: 
 
 a new tool 
 a new “platform” 
 a new best practice 
 and a new influencer telling you you’re doing it wrong 
 
 Here’s the reality: 
 You don’t need to know everything. You need a foundation that…

 DevOps has an identity problem. 
 Somewhere along the way, “DevOps” got interpreted as: 
 
 “Developers doing infra work.” 
 
 That’s not DevOps. That’s just… developers doing ops tasks badly, until someone gets paged. 
 DevOps only works when Operations is strong. 
 Not glorified. Not “respected” in a company values…

 Enough with the highlight reels. 
 DevOps is hard. 
 Not because you don’t know Terraform. Not because you can’t write YAML. Not because you forgot some Kubernetes flag. 
 It’s hard because DevOps is a contact sport. 
 You’re not just shipping code. You’re navigating: 
 
 company politics 
 unclear ownership 
 fragile systems with…
Cloud-native security: where things actually go wrong 
 Cloud-native didnt make security harder. 
 It made it faster to fail. 
 Microservices, Kubernetes, CI/CD, managed services, all great. 
 But they amplify the same old problems: 
 
 unclear ownership 
 bad access discipline 
 no visibility when it matters 
 compliance as paperwork 
 
 Here are the…
Cloud compliance: stop treating audits like a seasonal panic 
 Most compliance pain isn’t caused by auditors. 
 It’s caused by teams trying to reconstruct reality six months later. 
 Cloud compliance gets easier when you accept one rule: 
 
 Audits are evidence problems. 
 
 Not policy problems. 
 Not tool problems. 
 Evidence problems. 
 What…
Shift Left Isn’t a Slogan—It’s a Cost Reduction Strategy 
 Security at the end of your pipeline is security theater. Compliance as a last gate is expensive rework. Here’s what happens when you integrate both from the start. 
 The Actual Benefits 
 1. Find It Early, Fix It Cheap 
 A vulnerability found in design: hours to fix. In code: days. In production: weeks,…
Data Protection: The Five Controls That Actually Work 
 Encryption isn’t a feature. It’s a baseline. If you’re treating data protection as a checkbox, you’re already behind. 
 Here are the five controls that separate professionals from pretenders. 
 1. Encryption (At Rest, In Transit, In Use) 
 At rest: Disk encryption, database encryption, bucket…

 Cloud Security Isn’t Optional Infrastructure 
 You moved to the cloud for speed and cost. But you inherited a new attack surface that’s invisible to traditional security models. Here’s why that matters. 
 The Five Areas That Actually Matter 
 
 Data Protection 
 
 Your data sits on someone else’s computers. Encryption isn’t a…

 Job descriptions are written by people who’ve never done the job. Remember that. 
 Most JDs are copy-pasted wish lists, not requirements. When you see “10 years of Kubernetes experience” (Kubernetes has only existed since 2014), you’re looking at HR theater, not actual hiring criteria. 
 What Actually Matters 
 
 The 70% Rule 
 
 If you can do…

 The Phantom Obstacles 
 Everyone wants to talk about the tools. Kubernetes this, Terraform that. Nobody wants to talk about the psychological traps that derail actual DevOps careers. Here are four that trip up smart people. 
 
 “DevOps Is Only for Developers” 
 Wrong. 
 Coding helps, but it’s not the gate. Some of the best DevOps engineers I know came…
Media Mentions 
 
 Issues Around Scaling DevOps :
“Some of the most common scaling issues related to personnel and culture. Personnel is one of the biggest challenges due to the current employment market conditions. It is extremely difficult to recruit, hire, and retain talented DevOps practitioners. The other issue is culture. Since effectively scaling anything involves changes,…

 Last Updated: February 2026 — Nine years later, the core thesis holds: DevOps isn’t a title, it’s a convergence of skills. But the landscape has shifted. Below the original post, I’ve added a 2026 update on Platform Engineering, AI Operations, and where DevOps is heading. 
 
 



 
 
 

 Enough Already! 
 Too many non-DevOps…

 Last Updated: February 2026 - The Bruce Lee principles still apply, but the context has shifted. Added: AI pragmatism, platform engineering mindset, and why “no way as way” matters more than ever. 
 
 
 For my inaugural post, I’d like to lead off with my philosophies and approaches in DevOps ( What is DevOps? ). Like many of my childhood friends, I idolized…