A short personal note. The Royal Botanic Garden Edinburgh consulting engagement wrapped up on schedule at the end of January. The deliverables were submitted; the post-engagement review was useful; the cumulative experience was educational.
I am now in a brief interim engagement with Vodafone — specific scope, defined duration, careful handover at the end. The interim is essentially an opportunity to work in a different operational context for a defined period before the next substantive role.
This is a shorter post than my usual operational content because most of what I would write about is bound by client confidentiality. The general patterns can be discussed; the specific work cannot.
What the engagement is
A specific security review across particular Vodafone infrastructure components. The scope is bounded; the deliverables are specific; the timeline is two months.
The engagement is, in some sense, a sample of consulting work in a substantially different operational context than RBGE. RBGE was a research institution with limited but specific risk profile; Vodafone is a major telecommunications operator with substantial and varied risk profile. The cumulative cross-context experience is the value of the interim.
What I am observing
A few general patterns visible in this kind of work.
The operational maturity at large telecommunications operators is substantial. Specific defensive disciplines that I have been writing about for years are operationally implemented at scale. The cumulative investment in security infrastructure is meaningful; the staff are experienced; the procedures are tested.
The operational tempo is sustained. Twenty-four-hour operations, multiple time zones, continuous incident response. The pace is different from previous roles; the discipline is impressive.
The regulatory dimension is non-trivial. Telecommunications operators have specific regulatory obligations — communications data retention, lawful intercept, specific privacy frameworks — that produce structural constraints on operations. The cumulative compliance overhead is substantial.
The threat profile is varied. Specific telecommunications operators face threats from multiple categories — specific commercial-cybercrime, specific nation-state interest, specific organised activity around the customer base. The defensive posture must address the full threat profile.
The cumulative observation: this is mature operational security at substantial scale, in a context where the cost of failure is operationally and reputationally severe. The discipline is impressive.
What I am taking from the experience
Three general observations that will inform my future work.
Scale changes the security problem qualitatively. Specific defensive disciplines that work at smaller scale need to be re-thought at telecommunications-operator scale. The cumulative volume of events, the distribution across geography and time, the integration requirements — all are qualitatively different.
Specific operational maturity is the dominant defensive property. Technical sophistication matters; operational discipline matters more. The cumulative investment in operational maturity produces the security outcomes.
The cross-organisation perspective continues to be valuable. Each operational context teaches things; the cumulative cross-context experience produces structural understanding that single-context experience cannot.
What is next
The next role will be substantive — full-time, longer-term, with explicit security leadership responsibility. Specific details will be in a subsequent post once the role is settled. The transition timing is approximately mid-April.
The cumulative pattern of my career through the past nine years has been varied — DEC, the gaming-operator role, the RBGE consulting, this Vodafone interim. The next role will be the longest-term commitment since DEC; the cumulative experience across the previous roles will inform the work.
What this means for the notebook
The weekly cadence continues unchanged. Specific operational posts during this engagement will be limited by client confidentiality; specific reading and reflective content will continue at the same rate.
For my own continued discipline: the cumulative archive grows. The professional trajectory is more varied than I had planned; the cumulative experience is broader than a single-employer career would have produced.
A small reflection on interim engagements
Interim engagements like this Vodafone work are operationally interesting. Specific defined scope, specific defined duration, specific defined deliverables — the structure produces focused work that sustained employment does not always permit. The constraints are clarifying.
For other operators considering similar interim arrangements: the cumulative cross-organisation experience is professionally valuable. The bounded duration limits the depth of engagement; the cumulative breadth across multiple engagements compensates.
For my own continued professional discipline: more on this kind of work pattern as the trajectory develops. The notebook will document the choices as they are made.
More in time.