Jozua Velle

Layers of Software Security: SAST, DAST, and Penetration Testing

Building a Multi-Layered Defense for Modern Applications like UMAX . × Introduction Ensuring the security of software is more critical than ever in our technology-driven world. At Itineris, a global leader in utility business solutions,  we employ a multi-layered security strategy, combining Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Penetration Testing to protect the UMAX platform, a powerful Customer Information System and ERP solution designed for the unique needs of the utility industry, at every stage of its lifecycle. This article explores these three complementary approaches, how each works, and how together they create a strong defense against evolving cyber threats. Layer 0: Security by Design Guidelines Before diving into technical testing layers, Itineris establishes a foundational “Security by Design” approach through comprehensive guidelines for our technology teams. These guidelines provide clear direction to ensure that security considerations are embedded from the earliest stages of software planning and architecture. By fostering a culture of proactive risk assessment and secure coding practices, we help developers make informed decisions that prioritize the protection of sensitive utility data from the outset. Our guidelines cover topics such as threat modeling, secure software architecture, and data privacy requirements, encouraging teams to identify potential vulnerabilities before any code is written. This strong emphasis on security by design paves the way for effective implementation of our subsequent layers resulting in a resilient UMAX platform built to withstand today’s cyber threats. Layer 1: Static Application Security Testing (SAST) SAST analyzes source code, binaries,… to uncover vulnerabilities before an application is run. As a “white-box” approach, SAST is integrated early in the Software Development Lifecycle (SDLC), providing developers with immediate feedback and enabling them to fix issues before code is deployed. Early Detection: SAST scans code for known vulnerabilities such as SQL injection or buffer overflows during development. CI/CD Integration: Automated SAST runs as part of our build pipelines, ensuring that every code change is thoroughly checked. Comprehensive Code Visibility: By examining the application’s internals, SAST identifies vulnerabilities invisible from the outside. Empowers Developers: Feedback loops help developers adopt secure coding practices as standard procedure. Layer 2: Dynamic Application Security Testing (DAST) DAST evaluates an application in its running state, taking a “black-box” approach by probing the live web interface much as an attacker would. This allows us to detect vulnerabilities that only emerge during runtime. Runtime Analysis: DAST tools test the application’s security in action, replicating potential attack scenarios. Finds Logic Flaws: Issues like authentication errors or business logic vulnerabilities are caught during real-world execution. No Source Code Required: DAST is ideal for applications where code access is unavailable, such as third-party or legacy systems. Continuous Monitoring: Regular DAST scans keep our deployed products resilient as they evolve. Layer 3: Penetration Testing Penetration Testing adds a third, hands-on layer to our security approach. While SAST and DAST rely on automated tools, penetration testing leverages the creativity and expertise of security professionals who simulate real cyberattacks against our applications. Human-Driven Assessment: Penetration testers use advanced techniques and knowledge to identify complex vulnerabilities beyond the reach of automated tools. Exploiting Weaknesses: Testers attempt to exploit weaknesses, revealing how far an attacker might be able to penetrate and what data could be at risk. Holistic Review: Testing covers not just technical flaws, but also misconfigurations, insecure integrations, and business logic errors. Actionable Reports: Each test results in a detailed report that helps prioritize remediation and guides future development efforts. Integrating the layers at Itineris At Itineris, these three layers work together as an integrated defense system: SAST (SonarQube) is embedded early in development, catching vulnerabilities before they reach production. DAST (Acunetix) is used on staging and live environments to discover vulnerabilities exposed during real-world operation. Penetration Testing is scheduled periodically or after major changes, providing a deep-dive, end-to-end review of application security from an attacker’s perspective. Continuous Improvement and Compliance This layered approach helps us maintain compliance with industry standards like ISO 27001 and GDPR, as well as adapt to new threats. Continuous feedback between our development, QA, and security teams ensures that each layer informs and strengthens the others, driving security improvements across the company. Conclusion Combining SAST, DAST, and Penetration Testing gives Itineris a robust, proactive defense against software vulnerabilities. By addressing risks at the code, runtime, and real-world attack levels, we protect our users, data, and reputation—delivering secure, trustworthy solutions in an ever-changing threat landscape.

Layers of Software Security: SAST, DAST, and Penetration Testing Read More »

Successfully completed the Digital MBA for Technology Leaders at CTO Academy

This year, my main objective was to complete the Digital MBA for Technology Leaders at CTO Academy. I felt a strong need to deepen my understanding of business operations, how companies function, and ways to effectively engage with non-technical executives. Now that I’ve finished the course and earned my certificate, I can confidently say that it has bridged many of those knowledge gaps. At the halfway mark, I wrote an article summarizing my insights from the first set of modules. In this article, I’ll share my key takeaways from the final five modules of this learning journey. Product Development The Product Development module covers the full lifecycle of product development—from hypothesis formation and stakeholder management to sprint planning, building, and delivery. It emphasizes iterative learning, cross-functional collaboration, and balancing cost, quality, and speed. The module also explores architectural decisions, DevOps practices, and modern testing strategies to ensure high-quality outcomes. Key Insights: Product Hypothesis & MVPs A clear, stakeholder-aligned hypothesis is essential. MVPs should be built to gather actionable feedback early. Innovation vs. Business-as-Usual Innovation thrives on uncertainty and requires different team structures and validation cycles. Stakeholder Engagement Stakeholders vary in influence and interest; mapping and tailored communication are vital. Cross-Functional Teams Success depends on aligned incentives, shared tools, and clear ownership boundaries. Cost-Quality-Speed Triangle KPIs must be realistic and used as learning tools, not punitive measures. Sprint Methodologies Choose between Waterfall, Agile, Kanban, or Scrum based on project clarity and flexibility needs. Monotasking & Observability Focused work improves quality; observability enables proactive system insights. Architecture & APIs Serverless and microservices offer scalability but require strong documentation and versioning. Source Control & DevOps Git strategies, CI/CD pipelines, and automation tools like SonarQube and Snyk enhance reliability and security. Testing & Quality Shift-left testing, feature flags, and blue-green deployments support continuous improvement. Quality is a shared responsibility, not just a QA function. Information Management The Information Management modules explores the lifecycle of information management, emphasizing security, compliance, employee education, and systems governance. It provides a comprehensive framework for managing data responsibly, mitigating risks, and building resilient, secure, and efficient digital operations. Key Insights: Information Lifecycle & Risk Data must be collected, curated, disseminated, archived, and purged responsibly. Risk = Threat × Vulnerability × Asset Value; prioritize mitigation and monitoring. DevOps Security & Compliance Embed security into the development pipeline with practices like dependency scanning, credential checks, and secure containers.Use frameworks like NIST, ISO 27001, and CIS Controls to align with compliance goals. Data Privacy & Deletion Respect purpose and storage limitations.Implement secure deletion methods and ensure third-party due diligence. Business Continuity Distinguish between proactive continuity planning and reactive disaster recovery. Include risk analysis, emergency protocols, and regular testing. Security Foundations Define roles, run breach simulations, and monitor suppliers’ security posture. Use standards like OWASP, NIST, and CREST for guidance. Employee Education Train on phishing, ransomware, BYOD, and reporting protocols. Use phishing simulations and reward correct behavior to build a security culture. Systems & SaaS Management Monitor zombie accounts, automate responsibly, and audit regularly. Use centralized secret stores and observability tools to reduce human error Reporting & Bottlenecks Host status pages externally, conduct root cause analyses, and simulate outages. Regularly audit processes to eliminate inefficiencies and improve throughput Finance & Funding The Finance & Funding module provides a comprehensive guide to financial literacy for tech leaders, covering accounting fundamentals, budgeting, fundraising, equity management, and investor relations. It equips CTOs and other executives with the tools to understand financial statements, navigate funding rounds, manage shareholder dynamics, and align technology strategy with financial goals. Key Insights Financial Fundamentals Understanding P&L, balance sheets, and cash flow is essential for strategic decision-making and board engagement. Capitalization of work (e.g., software development) impacts long-term financial reporting and tax planning. Budgeting & Planning Tech financial planning must balance fixed and variable costs, model staffing and infrastructure needs, and adapt to changing business goals Reforecasting and tracking actuals vs. budget are critical for financial discipline Fundraising Strategies Early-stage funding includes grants, angel investment, and crowdfunding; later rounds (Series A–C) require traction, documentation, and investor alignment. Debt financing offers non-dilutive alternatives to equity, preserving ownership and control Investor Relations & Board Reporting Building trust with the CFO and board requires transparency, strategic alignment, and concise reporting CTOs play a key role in technical due diligence, especially during M&A and funding rounds Equity & Shareholder Management Share option schemes (e.g., RSUs, phantom options) are tools for retention and motivation but require careful legal and tax planning Dilution must be managed strategically across funding rounds to preserve founder and employee equity IPO & PE Expectations IPOs introduce public scrutiny, reporting obligations, and governance changes; CTOs must prepare infrastructure and security for scale Private equity firms seek operational efficiency, strong leadership, and scalable tech—CTOs must demonstrate readiness and strategic value Data, Analytics & Reporting The Data, Analytics & Reporting module explores the full lifecycle of data—from collection and cleaning to modeling, analysis, and reporting. It emphasizes ethical data use, accessibility, and the strategic value of data as a business asset. The module also covers machine learning, data governance, and the financial implications of data quality and ownership. Key Insights: Data Science & Human Judgment Effective data science requires collaboration between data scientists and engineers. Human-in-the-loop systems enhance machine learning by integrating human judgment in complex or ambiguous scenarios Data Ethics & Accessibility Ethical data practices are central to brand trust and compliance (e.g., GDPR). Consent must be clear, user-centric, and easy to manage across platforms Data Cleaning & Infrastructure Clean data is foundational for reliable analytics and decision-making. Data lakes offer scalable storage but require governance to avoid becoming “data swamps” Machine Learning & Modeling ML is used for prediction and classification, with supervised and unsupervised approaches. Data modeling improves performance, scalability, and cost-efficiency across systems Analytics & Reporting Digital marketing analytics must focus on actionable metrics like ROI, LTV:CAC ratio, and attribution modeling. Reporting should be centralized, consistent, and aligned with business strategy Data Governance & Sovereignty Data ownership and duplication issues arise from

Successfully completed the Digital MBA for Technology Leaders at CTO Academy Read More »

The Test Automation Journey at Itineris: Importance, Best Practices, and Success Factors with Leapwork

D365 FastTrack TechTalk I published this article after co-presenting a Microsoft Tech Talk about “Evolving Regression Testing”. Check out the recording of the TechTalk if you are interested. × In today’s ever-accelerating software landscape, the ability to deliver robust, reliable products quickly is both an expectation and a necessity. For Itineris —a global technology and services company specializing in software solutions for the utilities sector— the adoption of test automation has become a cornerstone of our commitment to quality, agility, and customer satisfaction. This article explores the test automation journey at Itineris, why it is vitally important, and how best practices and success factors, particularly with Leapwork, have improved the effectiveness of our regression testing strategy. The Genesis of Test Automation at Itineris For many software organizations, manual testing once stood as the default approach to ensure product stability. At Itineris this approach grew increasingly unsustainable. The expanding complexity of the UMAX software platform, coupled with frequent releases and customizations for global utility clients, exposed the limitations of manual regression testing: it was time-consuming, prone to human error, and struggled to keep pace with rapid development cycles. Recognizing these challenges, Itineris embarked on a test automation journey already years ago. But this is a continuous process as technology and our product is evolving and expanding. Why Test Automation is So Important at Itineris Speed and Efficiency: Automated tests dramatically reduce the time required for regression testing. What once took days or weeks can now be accomplished in hours, allowing for more frequent and reliable releases. Consistency and Reliability: Automation eliminates the variability and oversight inherent in manual testing. Scripts execute the same steps every time, ensuring that results are replicable. Scalability: As UMAX evolves, so too does the complexity of its features and integrations. Automated regression testing scales easily with growing test suites, ensuring that new functionality does not break existing features. Resource Optimization: By automating repetitive and time-consuming tests, Itineris’ QA professionals are freed to focus on higher-value activities like exploratory testing, test design, and quality analysis. Risk Mitigation: Automated regression tests catch defects early, reducing the chance that bugs slip through to production and impact clients or end-users. Supporting Continuous Integration/Continuous Deployment (CI/CD): Automation is essential for embedding quality into every stage of the software delivery pipeline, enabling true CI/CD workflows. The Selection of Leapwork for Regression Test Automation Choosing the right automation tool is critical for sustained success. Due to technology and product changes we recently had to reconsider our test automated strategy and tooling. After a thorough investigation Itineris selected Leapwork —a no-code automation platform—based on several strategic criteria: No-Code Interface: Leapwork’s visual, flowchart-based approach allows both testers and business analysts to design automated tests without deep programming knowledge, democratizing automation across teams. Integrations: Leapwork fits seamlessly into existing CI/CD pipelines and supports integration with a wide array of test management and defect tracking tools. Versatility: The platform supports web, desktop, and API testing, covering the full spectrum of Itineris’ applications and workflows. Maintainability: Leapwork’s reusable components and modular subflows make it easier to update tests in response to changing requirements or system updates. Best Practices for Test Automation with Leapwork Leveraging Leapwork to its fullest potential requires adherence to sound automation principles and continuous improvement. Here are some best practices Itineris has embraced on its automation journey. Start with a Clear Strategy Automation is most successful when guided by a well-defined strategy. At Itineris, this means identifying priority areas for automation, aligning automation goals with business objectives, and establishing clear criteria for evaluating progress. Define the scope of automation—start with stable, high-impact regression tests. Monitor improvements such as reduction in manual testing effort, greater test coverage, or fewer defects escaping into production. Build Modular and Reusable Flows Leapwork enables users to create reusable components or sub-flows, which are building blocks (we often refer to Lego blocks) that can be used across multiple test cases. We emphasize the importance of: Designing flows that are modular and maintainable. Abstracting common actions (e.g., logging in, navigating menus) into reusable components. Adhering to naming conventions and documentation standards for easy collaboration and future updates. Prioritize Test Data Management Reliable regression tests depend on consistent, predictable data. Best practices include: Using dynamic test data generation when possible to avoid hardcoding values. Cleaning up or resetting test environments to a known state before execution. Integrate Automation into CI/CD Pipelines For maximum value, automated regression tests should run as part of the software delivery pipeline. We ensure: Automated tests are triggered after important code check-ins, merges, or scheduled runs. Results are fed back into dashboards or test management tools for rapid feedback. Foster Cross-Functional Collaboration Leapwork’s no-code interface bridges the gap between QA, development, and business teams. At Itineris, collaboration is encouraged by: Involving stakeholders from different disciplines in test design and review. Sharing knowledge and automation assets across teams to promote best practices. Continuously Refine and Optimize Tests Test automation is not a one-off project but a continuous journey. We regularly: Reviews test results and flakiness. Refactors or retires obsolete tests. Updates flows to keep pace with application changes. Success Factors for Regression Test Automation at Itineris While tools and practices are critical, several overarching success factors have driven our automation journey at Itineris: Executive Sponsorship: Strong leadership support has ensured sustainable investment in infrastructure, training, and process improvement. Culture of Quality: Quality is everyone’s responsibility, and automation is embedded in the mindset across all teams. Continuous Skills Development: Ongoing training in Leapwork and automation best practices keeps the team’s skills sharp and up to date. Metrics-Driven Improvement: Regular measurement and review of automation KPIs drive incremental improvements and alignment with business goals. User Feedback Loop: Feedback from both internal testers and external users ensures automation remains relevant and effective. Conclusion: Charting the Path Forward By uniting the right tools, processes, and a culture of quality, We transformed our approach to test automation. Leveraging Leapwork, the team has accelerated release cycles and boosted product quality, delivering greater value for utility

The Test Automation Journey at Itineris: Importance, Best Practices, and Success Factors with Leapwork Read More »

Architecting for Resilience: How Enterprise Technology Services Scales with Strategic Growth

In today’s digital-first utility landscape, resilience is not just about uptime—it’s about building secure, scalable, and standardized foundations that can evolve with the business. At Itineris, the Center of Excellence (CoE) plays a pivotal role in this transformation, anchoring our enterprise technology strategy in robust architecture, security governance, and community-driven innovation. Security by Design: Embedding Trust into Every Layer Our approach to information security is grounded in a comprehensive Information Security Management System (ISMS), aligned with ISO 27001 and SOC 1 Type II standards. This ensures that our practices are not only compliant but also proactive in mitigating risk. Together with the Lead technical architects in our business units, the CoE leads the charge in defining and maintaining secure architecture blueprints for Azure-hosted UMAX deployments, ensuring that every component—from infrastructure to application—is designed with security in mind. This includes: Role-based access control and managed identities to eliminate credential sprawl. Continuous monitoring via Microsoft Defender for Cloud and integrated with the customers SIEM tooling if applicable. Secure API management with OAuth 2.0 and Web Application Firewalls. Regular penetration testing and vulnerability scanning using OWASP-aligned tools. Reference Architecture: The Backbone of Scalable Innovation Standardization is key to scaling securely. In Itineris we developed a unified reference architecture for UMAX that is now the default for all customer deployments. This architecture is enforced through Infrastructure as Code (IaC), enabling consistent, version-controlled, and auditable environments across projects. By embedding this architecture into our Application Lifecycle Management (ALM) processes, we ensure that: New environments are provisioned with minimal manual intervention. Regression testing environments mirror production setups. Security baselines are maintained across the board. This standardization not only reduces operational overhead but also accelerates onboarding and improves the quality of service delivery. Governance in Action: The Security Architecture Review Board To ensure architectural integrity, the CoE established the Security Architecture Review Board (SARB)—a governance body composed of internal security experts and enterprise architects. The SARB reviews and validates all project architecture designs, ensuring alignment with our security standards, strategic goals, and regulatory obligations. SARB’s scope includes: Authentication and authorization models. API exposure and protection strategies. Data encryption, access logging, and audit trails. Infrastructure segmentation and network isolation. This board acts as a gatekeeper, ensuring that no solution goes live without rigorous scrutiny and alignment with our reference architecture blueprint. Add Your Heading Text Here Resilience is not just technical—it’s cultural. That’s why we foster Communities of Practice (CoPs) across architecture, security, DevOps, and cloud engineering. These CoPs serve as collaborative forums where practitioners share patterns, lessons learned, and innovations. They help us: Democratize architectural knowledge. Surface edge-case scenarios early. Align cross-functional teams on best practices. By embedding CoPs into our operating model, we ensure that our standards are not just top-down mandates but community-owned and continuously improved. Conclusion As Itineris continues to scale its global footprint, the CoE’s work in secure architecture, infrastructure automation, and governance ensures that growth doesn’t come at the cost of control. Through SARB and CoPs, we’ve built a model where resilience is not reactive—it’s designed in.

Architecting for Resilience: How Enterprise Technology Services Scales with Strategic Growth Read More »

Leveraging Success by Design & Dynamics 365 FastTrask

Introduction In today’s fast-paced digital landscape, ensuring smooth and successful implementations of software solutions is crucial for businesses. At Itineris, we leverage Success by Design and Dynamics 365 FastTrack (portfolio for partners) to enhance our implementation methodology and ensure seamless UMAX go-lives for our customers. UMAX is an innovative utility platform built on Dynamics 365 and Azure, offering scalability, reliability, and flexibility to help customers manage utility operations efficiently. It reflects our dedication to leveraging advanced technology for operational excellence and impactful business transformation. This blog post will explore the benefits of the FastTrack program and how it contributes to our success. Benefits of FastTrack for Dynamics 365 The FastTrack program, powered by Microsoft’s engineering team, is designed to accelerate Dynamics 365 implementations and help organizations go live with confidence. At Itineris, we have established a Center of Excellence (CoE) dedicated to managing our portfolio of projects, whether led by us or FastTrack. This initiative ensures the seamless integration of FastTrack and Success by Design practices. Our collaboration with Microsoft enables us to: Enhance Collaboration: Frequent meetings and deep dive sessions with Microsoft’s engineering team help us stay aligned and informed about the latest developments Improve Efficiency: The structured approach of FastTrack streamlines our processes and via our Center of Excellence we make sure the processes are used for all our implementations around the globe Access to Expertise: Our partnership with Microsoft provides access to product experts and user communities, supporting our success and enabling us to deliver high-quality solutions Mitigate Risks: Proactive guidance and early detection of potential issues help us mitigate risks and overcome deployment blockers during the implementation for a new customer Achieve Operational Excellence: The program’s focus on best practices and proven approaches enables us to deliver solutions that enhance efficiency and transparency for our customers. Don’t forget—the people make all the difference! While the prescriptive guidance is invaluable, success ultimately depends on the people behind the process. Take the time to connect with the FastTrack team you collaborate with and make them an integral part of your journey: Recognize their efforts: Appreciate the hard work and dedication they bring to supporting your goals. Provide them with the resources they need: Share the necessary input to enable them to excel in their roles to support you Advocate for them within your organization: Champion their contributions just as they advocate for you within Microsoft. Conclusion The FastTrack portfolio for partners is an invaluable resource for Itineris, enabling us to deliver successful implementations and smooth go-lives for our UMAX customers. By leveraging the program’s prescriptive guidance, proactive support, and structured approach, we can ensure that our customers achieve their desired business transformation goals with confidence.

Leveraging Success by Design & Dynamics 365 FastTrask Read More »

Collaborating with distributed remote Teams

Insights on overcoming the challenges of working with distributed (x-shored) remote teams Remote collaboration and x-shoring has become an integral part of global business practices. While the benefits—such as access to diverse talent pools and possible cost reductions—are undeniable, working effectively with remote teams also presents unique challenges. In this article I’m sharing my ideas, strategies and lessons learned for cultivating successful distributed remote collaboration. Challenges in Remote Collaboration Remote collaboration introduces complexities that demand structural changes in traditional workflows. Some of the most common challenges include: Time Zones & Working Hours Time zone differences can create scheduling difficulties and delay communication. To address this: Shift working hours where possible to overlap key collaboration times. Organize shared schedules to ensure critical meetings are accessible to all team members. Cultural Differences Though cultural differences are often small, they can still affect team dynamics. Strategies to navigate them include: Understanding, accepting, and celebrating cultural diversity. Incorporating cross-cultural training to enhance mutual understanding and empathy. Language Differences Language barriers can impede clear communication. To mitigate this: Make English a mandatory working language for internal documentation, emails, and meetings. Organize language courses for team members where necessary. Recruit team members with strong English proficiency. Encourage team members to learn some basic vocabulary of the other languages used in your team. Communication Effective communication is essential for remote teams. The following practices can help: Focus on building trust and relationships within the team. Increase written documentation to ensure clarity, including summaries and action points. Encourage team members to verify understanding by asking questions and seeking clarification. What Worked in Previous Experiences Based on practical insights after working +15 years with nearshore distributed teams and +5 years with also offshore distributed teams, here are some strategies that have proven effective: Tools for Collaboration Investing in communication and project management tools is vital for remote teams. Examples include: Video conferencing platforms (e.g., MS Teams). Application lifecycle management (ALM) tools such as Azure DevOps. Virtual meeting rooms to foster real-time discussions. Organizing for Early Feedback Early and frequent feedback enhances the quality of deliverables and bridges gaps in understanding. Methods include: Organizing review meetings during iterations. Conducting demos with stakeholders to ensure alignment. Leveraging continuous integration and deployment processes to streamline workflows. Facilitate constructive, blameless discussions for lessons learned and root cause analysis meetings. Communicating Explicitly Clear communication avoids misunderstandings. Use explicit statements like “I read your message” or “I am starting to work on it now” and keep everyone informed about task progress. Understanding the Real Question Remote collaboration often requires deeper inquiry to understand what is truly being asked. Active listening and asking clarifying questions help achieve this. Key Recommendations for Distributed Remote Teams Whether your teams are distributed nearshore or offshore, the following principles can set them up for success: Accept the added complexity and overhead of remote collaboration and focus on making it work. Structure teams to be cross-functional, co-located where possible, and self-organizing. Avoid fostering an “us versus them” atmosphere by valuing the contributions of every team member equally. Instill a sense of purpose within the team, ensuring that everyone understands who and what they are working for. Spend time at each work location to demonstrate commitment and take everyone seriously. Utilize the team to gather feedback, review past performance, and communicate future plans. Closing Thoughts Working with distributed remote teams offers immense opportunities, but it also demands thoughtful strategies to overcome challenges. By embracing cultural and language diversity, leveraging the right tools, and organizing structurally, we can achieve outstanding results through x-shoring collaboration. Remember, success lies not only in the processes but also in cultivating trust and purpose within remote teams. Embrace the diversity and use it as a strength while putting in the effort to make it work!

Collaborating with distributed remote Teams Read More »

The Importance of Reading

Reading always has been something I truly enjoy. It’s a pleasant escape and a deep source of continuous learning, allowing me to apply new insights in both my personal and professional life. In this article, I want to share a list of five books that have greatly shaped me into the person and leader I am today. Why Reading Books Is Still Important In an era where information is often consumed in bite-sized chunks through social media and quick articles, the value of reading full-length books remains unparalleled. Books offer a deep dive into subjects, allowing for a comprehensive understanding that short pieces simply cannot provide. They foster critical thinking, enhance vocabulary, and allow for a more profound connection with the material. Reading books also forces me to focus and not jump from one piece of information to another. My personal Top 5 Agile estimating and planning – Mike Cohn A guide to effective project management in agile environments, this book covers techniques for estimating and planning that are adaptable and iterative, ensuring flexibility and accuracy. How did it impact me? This book really opened my eyes to the importance of implementing software products in an iterative manner with Scrum teams, continuously improving and adapting to change. By applying these insights within my team and spreading this knowledge to other teams, I began my journey from a developer position to a software delivery manager in Centric’s retail division. Agile Estimating and Planning Book by Mike Cohn – Mountain Goat Software The Phoenix Project – Gene Kim This book demonstrates how DevOps principles can revolutionize IT operations and drive business success. Written as a novel, it captures readers’ attention while imparting valuable lessons on team collaboration, efficiency, and the critical role of IT in today’s competitive environment through its practical insights and engaging story. How did it impact me?   This book made me realize that our product increment wasn’t truly a releasable product increment. Over time, we integrated more automation tools like Octopus Deploy and Nagios XI, ensuring that we could release the increment with the push of a button and easily monitor and maintain the release in production. The Phoenix Project: A novel about IT, DevOps and helping your business win by Gene Kim The 5th discipline by Peter M. Senge The 5th Discipline by Peter Senge introduces the concept of a learning organization, where businesses and individuals continuously expand their capacity to create desired results. It outlines five key disciplines: personal mastery, mental models, shared vision, team learning, and systems thinking, emphasizing the importance of a holistic approach to problem-solving and innovation. How did it impact me? This book opened my eyes to two crucial concepts: the advantages and pitfalls of mental models and the world of systems thinking. These ideas have helped me embrace a holistic approach to learning, decision-making, and problem-solving. The fifth discipline: The art & practice of the learning organization by Peter M. Senge Management 3.0 by Jurgen Appelo Management 3.0 by Jurgen Appelo is an innovative approach to leadership and management in the modern workplace. It challenges traditional hierarchical structures and promotes a more dynamic, inclusive, and collaborative environment. The book provides practical insights and tools aimed at empowering employees, fostering creativity, and driving organizational success through continuous improvement. It emphasizes the importance of nurturing a culture of trust, learning, and adaptability, making it a valuable resource for leaders seeking to enhance their management practices and build resilient teams. How did it impact me? Reading this book transformed my approach to leadership by highlighting the importance of effectively managing upward. I learned that “managing up” is essential for aligning your work and that of your team with your manager’s and the company’s objectives. Instead of asking, “What can my manager do for me?” I shifted to thinking, “What can I do for my manager?” This change in mindset has helped build stronger professional relationships, foster clearer communication, and drive collective success. Management 3.0: Leading Agile Developers, Develop Agile Leaders by Jurgen Appelo The Seven Habits of Highly Effective People by Stephen R. Covey The Seven Habits of Highly Effective People by Stephen Covey is a renowned self-help book that presents a principle-centered approach to achieving personal and professional effectiveness. These seven habits are designed to help individuals lead more productive, fulfilling lives by fostering a mindset of growth, collaboration, and self-improvement. How did it impact me? All Seven Habits of Highly Effective People are relevant, but three habits are particularly notable for their impact on my personal and professional growth: Begin with the End in Mind: Define clear goals and visions for your future. Synergize: Collaborate effectively to achieve results that could not be realized individually. Sharpen the Saw: Continuously renew and improve yourself in physical, mental, emotional, and spiritual dimensions. The seven habits of highly effective people by Stephen R. Covey Five more reading tips Start With Why: How Great Leaders Inspire Everyone To Take Action by Simon Sinek The Startup Way: How Entrepreneurial Management Transforms Culture and Drives Growth by Eric Ries The Five Dysfunctions of a Team: A Leadership Fable by Patrick Lencioni Lean Enterprise: How High Performance Organizations Innovate at Scale by Jez Humble, Joanne Moleksy and Barry O’Reilly Debugging Teams: Better Productivity Through Collaboration by Brian W. Fitzpatrick and Ben Collins-Sussman

The Importance of Reading Read More »

Enhancing Continuous Learning with Dojo’s and Deliberate Practice

Fostering Growth through Learning Continuous learning is vital in today’s fast-paced world, especially within the dynamic realm of technology. At Itineris, I introduced Dojo’s and the principles of deliberate practice to provide a structured and effective approach to mastering new skills. Yes, Dojo’s—not just Coding Dojo’s—because we aim to apply this concept to a wide array of topics, from Power Platform to Systems Thinking. A Dojo is a gathering of enthusiastic volunteers who come together to tackle a challenge. These meetings are designed to be enjoyable while engaging in deliberate practice to enhance skills. Deliberate practice differs from routine job experience; it’s about seeking experiences that stretch your abilities just enough and offer feedback that promotes learning. The focus is on the learning outcome, not merely the delivered “code.” Structure A Dojo typically lasts between 60 and 120 minutes, following this structure: A brief introduction covering essential theory A guided exercise where participants take the lead with Dojo hosts as co-pilots A group exercise in break-out rooms, where participants take turns driving and guiding each other Conclusion Dojo’s are a lightweight, fun way to learn new things while interacting with colleagues from various teams across the company, even those working in different time zones. They foster a collaborative environment where learning is a shared endeavor. Looking forward to hear your thoughts and ideas for new Dojo topics.  Download Dojo examples Power Automate Systems thinking

Enhancing Continuous Learning with Dojo’s and Deliberate Practice Read More »

Halfway my Digital MBA for Technology Leaders learning journey

At the end of last year, I embarked on the Digital MBA for Technology Leaders at CTO Academy. My primary learning goal for this year is to complete the program and earn the certificate. A big thank you to Itineris for supporting me on this incredible learning journey. Today, I reached the 50% completion mark, making it a perfect time to reflect on what I’ve learned so far. Firstly, the format of micro lectures combined with additional reading materials makes this course manageable even with a busy schedule. It allows me to start experimenting with the new knowledge in my daily life and work right away. So far, I’ve completed the following modules and gained key insights from each. Leadership & Team This module covers various aspects of leadership and team management, including strategic thinking, team building, effective communication, self-leadership, decision-making, empathy, crisis management, and change management.  Key Insights Leadership is not just about technical skills but also about strategic vision, interpersonal skills, and understanding perceptions. Effective communication and empathy are crucial for building trust and motivating teams. Self-leadership is essential for personal growth and encouraging others to take ownership. Decision-making should balance intuition, data-driven analysis, and collaboration. Psychological safety and a diverse, inclusive environment are vital for team success and innovation. The Business This module covers various aspects of business strategy, including commercial strategy, CEO and investor interests, growth importance, top-down drivers, innovation, business continuity and disaster recovery Key Insights Competitive Analysis: Understanding Porter’s five forces and SWOT analysis is crucial for assessing market competition and identifying strengths, weaknesses, opportunities, and threats Valuation Methods: Different methods like times-revenue and earnings multiplier are used to determine a company’s value, with EBITDA being a common metric Organizational Culture: Building a strong internal brand culture fosters better relationships, attracts and retains talent, and ensures employees share the company’s vision Compliance: Adhering to rules, regulations, and ethical practices is essential for maintaining business continuity, reputation, and safeguarding employees Tech Strategy and Business Goals This module outlines the alignment of technology strategy with business goals. It emphasizes the importance of having a clear vision, mission, value network, and strategy to guide the company’s actions and decisions Key Insights Vision answers why the company does what it does in a resilient, inclusive, inspiring, concise, and service-oriented way Mission answers what the company does (goals) Strategy answers how the company will achieve its goals (roadmap) Common mistakes include not giving enough time to understand the strategy, not adapting to its morphological nature, setting unrealistic goals, and overly detailed plans that inflict confusion Personal Development This module emphasizes the importance of continuous personal development and growth for successful people and effective leaders. Key Insights Tiny Gains and continuous improvement: Making small changes (the 1% rule) and improvements every day with the expectation that those small improvements will add up to something significant Self-Reflection: Reflecting on personal development priorities and impactful areas that need focus Overcoming Barriers: Identifying and overcoming common reasons that hold individuals back from making changes, such as self-doubt, fear of failure, and imposter syndrome Five more modules to go! #letsdothis Note: Feel free to message me if you’re interested in experiencing the same journey. I can provide you with a referral link that offers a 10% discount.

Halfway my Digital MBA for Technology Leaders learning journey Read More »