3 ms·

I was an ops manager at $big_company like the one described; your response gets it pretty right. There were many many groups that all wanted a slice of our team

by chomp 5y ago

I was an ops manager at $big_company like the one described; your response gets it pretty right. There were many many groups that all wanted a slice of our team's time, and it added up to probably a 6 month lead time on all requests. Bringing in skip levels was almost necessary as we sometimes had to have upper management fight over who wants their subordinates' tasks done first. We didn't care who's tasks got done first, we just needed to know what the enterprise's priorities were. It wasn't uncommon for these tasks to have to snake through multiple groups for a couple weeks so that they can each give their input on what should be prioritized before it even hit our backlog. If their parent company is publicly traded, giving access to the codebase is a huge SOX no-no. All of these gripes are just big company issues. I suspect OP is a better fit for smaller, non-public companies.

Cederfjard 5y ago
> If their parent company is publicly traded, giving access to the codebase is a huge SOX no-no. Could you please elaborate on this?
- chomp 5y ago
  Sure. So while Sarbanes Oxley doesn’t contain anything like “thou shalt not commit to a repo”, it’s pretty clear about separation of duties. This means that the person who commits code cannot be the same as the person who deploys (or has access to deploy) the code. There’s many ways to implement separation of duties that are all valid, but the compliance industry has settled on the concept of least privilege as a framework to enforce this requirement. So if a person external to a dev team wants to write to their code base, the hard rule of least privilege keeps the regulatory train on the rails, so to speak. Keeping that wall between external teams reduces risk in the company, at the cost of increased friction and reduced agility. Consider it a part of the price to pay for investor money. If you have any other questions I’d be happy to answer!
  - Cederfjard 5y ago
    Very interesting, thank you. I’m not based in the US, so was unaware of these regulatory requirements. I can certainly see how it increases friction, as you say.
  - deleted 5y ago
    [deleted]

by chomp 5y ago

Cederfjard 5y ago

> If their parent company is publicly traded, giving access to the codebase is a huge SOX no-no. Could you please elaborate on this?

chomp 5y ago
Sure. So while Sarbanes Oxley doesn’t contain anything like “thou shalt not commit to a repo”, it’s pretty clear about separation of duties. This means that the person who commits code cannot be the same as the person who deploys (or has access to deploy) the code. There’s many ways to implement separation of duties that are all valid, but the compliance industry has settled on the concept of least privilege as a framework to enforce this requirement. So if a person external to a dev team wants to write to their code base, the hard rule of least privilege keeps the regulatory train on the rails, so to speak. Keeping that wall between external teams reduces risk in the company, at the cost of increased friction and reduced agility. Consider it a part of the price to pay for investor money. If you have any other questions I’d be happy to answer!
- Cederfjard 5y ago
  Very interesting, thank you. I’m not based in the US, so was unaware of these regulatory requirements. I can certainly see how it increases friction, as you say.
- deleted 5y ago
  [deleted]