graham gilbert
Designing Infrastructure for Bounded Autonomy Introduction A production access request during an incident looks straightforward from far enough away. An identity system can grant a role, a privileged access system can time-limit it, and an audit system can record what happened. The hard part is deciding whether the request should be granted at all. That decision draws on the state of the incident…
I was working on a design doc recently with the help of AI when it generated a sentence that immediately made me stop. It described another team’s system as “legacy infrastructure that should be replaced.” That might sound like a small wording issue, but it was not. The system was not legacy. The team had invested heavily in it, it solved real operational problems, and replacing it was neither…
The more I look at how we actually build systems now, the more it looks like Terraform is dead. Not “declining.” Not “evolving.” Dead. What’s left is just inertia. What Terraform Actually Solved Terraform solved a very specific problem: how do we make infrastructure deterministic, reviewable, and repeatable? The answer was a DSL, a plan step, and a state file. It…
This is the final post in the series expanding on my talk about the path to Staff Engineer and beyond. The series began by challenging management as the only path forward, then moved from problem solving to problem finding. Part 3 covered the value of messy, political work, and Part 4 looked at leading before you’re given the title. This last part is about the space in between being a strong…
This is the fourth post in a series exploring the path from senior engineer to Staff engineer. If you missed the earlier parts, you can find them here: The Path to Staff Engineer, Part 1: Breaking the Glass Ceiling The Path to Staff Engineer, Part 2: From Problem Solver to Problem Finder The Path to Staff Engineer, Part 3: Turning Messy Work Into Staff Level Impact The Path to Staff Engineer, Part…
I was having a drink with a friend last weekend and the topic turned to AI - particularly about why so much AI-generated code is just slop. Does it work? Sure (well, most of the time). But it’s hard to understand, hard to maintain, and often not written in a way that’s easy to test. You take one look at it and know you’re going to be paying for it later.
This is the third post in a series exploring the path from senior engineer to Staff engineer. Check out the rest of this series: The Path to Staff Engineer, Part 1: Breaking the Glass Ceiling The Path to Staff Engineer, Part 2: From Problem Solver to Problem Finder The Path to Staff Engineer, Part 3: Turning Messy Work Into Staff Level Impact The Path to Staff Engineer, Part 4: Learning to Be a…
This is the second part in a series expanding on the conference talks I have given this year about the path to Staff Engineer and beyond. Check out the rest of this series: The Path to Staff Engineer, Part 1: Breaking the Glass Ceiling The Path to Staff Engineer, Part 2: From Problem Solver to Problem Finder The Path to Staff Engineer, Part 3: Turning Messy Work Into Staff Level Impact The Path to…
This post is the first in a series expanding on the conference talks I have given this year about the path to Staff Engineer and beyond. These talks have resonated with a lot of people who feel stuck between senior engineering and management, unsure of what comes next. Over the next few posts, I will break down what Staff means, how to grow into it, and how to lead without giving up the craft.
What is the next step for senior engineers if management isn’t their goal? This extended version of the talk introduces the concept of Staff Engineer as a career path, and discusses how to navigate the transition from senior engineer to staff engineer and beyond.
It’s been nearly two years since I moved from being an Individual Contributor (IC) to a Tech Lead Manager (TLM) - a hybrid role that combines the responsibilities of a manager with those of a senior engineer. When I was offered the role, I reached out to a few friends at companies that had TLMs. Their advice was nearly unanimous: “It’s a trap.” Clearly, that gave me pause. But…
This morning I spoke at MacDevOps:YVR on the topic of Staff Engineering. Than you to everyone who came, and a huge thank you to Mat, JD, and the rest of the MDO team for putting on such an amazing conference. Here are the slides and the resources I shared during the talk. Mac Admins Open Source Movember Influencing without authority
What is the next step for senior engineers if management isn’t their goal? This talk introduces the concept of Staff Engineer as a career path, and discusses how to navigate the transition from senior engineer to staff engineer and beyond.
This afternoon I had the pleasure of presenting at MacAD.UK in Brighton on the topic of Zero Trust for Mac admins. Here are the slides and the resources I shared during the talk. Thank you if you came to see me speak, and a big thank you to the organizers for putting on such a great event. London Apple Admins Mac Admins Open Source MachineInfo Osquery Mac Admins Osquery Extension Managed Device…
It feels like everyone is talking about “Zero Trust” these days – but what does that really mean for Mac Admins? Whether you’re a one-person IT show or part of a global team, as the go-to expert for macOS devices, you’ll play a key role in any Zero Trust deployment. In this talk, we’ll break down what Zero Trust looks like in the real world for Mac Admins.
As Client Engineers, we often find ourselves managing devices for a diverse, global user base. But does our team composition reflect this diversity?
This week, Mac Admins Open Source released a new tool called SOFA. SOFA is a machine readable feed of macOS and iOS update data - including CVEs. Of course, my mind immediately jumped to “this would be a great osquery table”, so the macadmins osquery extension was updated this week to include tables for both the security release information for macOS (sofa_security_release_info) and…
This week, I travelled to beautiful Gothenburg to speak at MacSysAdmin. Thank you to Patrik and the rest of the team for being such great hosts, and to all my friends, new and old, who made it such a fantastic week. My slides are available, and the video has been published on the MacSysAdmin site.
Many vendors will try to tell you that all you need to do is buy their zero trust product - but is it really that simple? (Here’s a hint: that would make this talk very short) Over the past year, Graham has been helping to create Airbnb’s Zero Trust strategy. In this session he will share some of what he has learned along the way, from how teams across InfoSec and IT came together to identify…
This morning I saw a major MDM vendor advertising an upcoming feature that will write scripts to manage your macOS devices for you using generative AI - sounds like the end of our profession, right? Let’s look at an example of a common IT task - keeping Chrome on macOS up to date. I asked ChatGPT to “Write me a script to keep Google Chrome updated on macOS”. It returned the…