Six services, and what you keep when I leave.

For your platform: golden-path pipelines, deployment governance and a zero-touch path on CloudBees CI and CD/RO or Jenkins. At SWIFT I onboarded 40+ Java apps onto zero-touch release orchestration, and my team delivered 80%+ of the company-level KPI to move 100% of applications to zero-touch. You end with a pipeline teams follow because it is cheaper than bypassing it, with its controls mapped to SLSA and SSDF (NIST SP 800-218).

Evidence an auditor can read without a meeting: SBOM in CycloneDX or SPDX, signing and provenance, policy as code, mapped to DORA and, where they apply, NIS2, the Cyber Resilience Act, the EU AI Act, ISO 27001, SOC 2 and PCI DSS.

For your teams: scoped tasks, review rules and gates that treat agent code as code; the AI DevSecOps Framework sets out the controls. My own coding-agent work at SWIFT runs the same way: agent-first with Claude Code, OpenAI Codex and Devin, with human review and the same security gates as human-written code.

Two weeks, fixed scope, on the open DevSecOps Maturity Model: five levels across eight domains, a scored position per domain and a prioritised roadmap.

Two-day formats for platform and delivery teams, with the exercises from techstream-learn; at SWIFT I coach 5+ squads until the standard holds. The aim is a team that runs the pipeline without me.

Java 21 and Spring on a regulated platform: a 2.5 billion-record migration to Oracle at Swissquote. Vert.x and Kafka at scale: a CQRS backend at Eleven Sports that supported hundreds of thousands of concurrent interactions.