Role
DevSecOps Eng. Manager
I'm James Elliott. I started out writing code, found my way into the seams where security meets everything else, and these days I lead a DevSecOps team. This is where I think out loud — about operations, strategy, and the messy human side of shipping software well.
I started my career as a developer, shipping product code before the term DevSecOps had really caught on. Over time I gravitated toward the seams — where security, platform, and product collide — and ended up running engineering teams whose job is to keep those seams from tearing.
Good security feels like lane-assist, not a handbrake. It should keep you in the lane while you focus on the road ahead.
These days I lead a DevSecOps engineering function. I still think like the developer I was — which means I have little patience for security that exists on a slide but never in production. The work I'm proudest of looks the same from the outside: a team that stopped firefighting, started shipping, and quietly raised its security posture without anyone calling it a "transformation".
When I'm not doing that, I'm writing about it — engineering operations, strategy, and the human side of building software. That's mostly what this site is for.
"No" is rarely the answer. The job is finding the route that ships the work and keeps you safe — even if it means a detour.
A 70% control your team actually runs beats a 100% control they route around. I optimise for what gets used in production on a Tuesday.
Good security should sit in the background and gently nudge — not jolt the wheel out of your hands. If a control feels like a handbrake, it's the wrong control.
The goal is a team that doesn't need me. Good work makes itself unnecessary — I'd rather hand back something self-sufficient than build a dependency.
The day job keeps me busy, but I take on the occasional engagement when it's a good fit and genuinely useful. No retainers, no theatre — just a focused pair of hands and a second opinion you can trust. A few ways that tends to look:
I like meeting people who care about this stuff. Want to talk through a thorny security problem, compare notes on running teams, or just disagree with something I wrote? My inbox is open — and yes, if you'd like a hand with your security programme, I'm happy to chat about that too.
Drop me a line →