Mark Turner

Today marks Six months in as SOCPAC CTO, and it somehow feels like both yesterday and six years ago. When I stepped into this role, we were behind the curve. Legacy systems, siloed data, and slow processes held us back. In just half a year, we’ve laid a Foundational Technical Architecture that gave us a modern backbone for data, AI, and autonomy. Since then, we’ve: 1. Unified our digital foundation for secure, scalable operations 2. Embedded AI and LLMs into daily workflows to speed decisions 3. Deployed containerized AI agents across all networks 4. Integrated autonomy at the edge, moving toward true man–machine teaming 5. Shifted our culture from cautious adoption to championing innovation The result? We’re no longer catching up, we’re setting the pace. What once felt like a distant goal is now part of our daily reality. All of this happened in six months, which is why it feels so surreal. It took countless late nights, cross-functional sprints, and the relentless dedication of an amazing team. I'm humbled by the trust the organization placed in me to drive this transformation, and I'm grateful to every person who rolled up their sleeves to make it real. This was truly a team effort, from the junior analysts using our new AI tools to the senior leaders who empowered us to take bold risks. And we’re just getting started. The foundation is in place, but now we get to build on it. In the next chapter, we'll be refining and scaling these capabilities, drilling deeper into AI-enhanced decision-making, and pushing the envelope on autonomous operations. The technology will keep evolving, and so will we. Our goal remains the same: give our operators a decisive edge, making it an extension of the warfighter and keep innovating responsibly. I’m humbled by what the team accomplished in such a short time, and excited for what’s next. The foundation is in place. Now we build on it. Six months down, and the journey is just beginning.

170

19 Comments

AI at Spotnana isn’t a side project or flashy add-on. It’s at the heart of how we build. Over the past year, we’ve made a key shift across our PODs: instead of asking “How would I solve this?”, we now ask “How would AI solve this faster, safer, and with the customer at the center?” That change has transformed how we work. We’re seeing 5x the impact with less effort, because AI isn’t just sprinkled in, it’s baked into our roadmaps, reviews, and metrics. Our stack reflects this mindset: Claude Code (Anthropic) drives backend and agentic workflows, while Cursor powers frontend changes and smart refactors. And with AI Monday demos, teams share wins, live demos, and playbooks turning individual breakthroughs into company-wide momentum. The results are huge. Integrations that once took months now go live in days. Engineers spend less time on grunt work and more time solving hard problems. Things we thought were impossible in the legacy travel stack are now shipping in weeks. What we’re learning: - AI is a multiplier when paired with strong engineering judgment. - It has to live in your product roadmap, not a lab on the side. - The real wins come from habits and workflows, not shiny models (they help big time though). - Travel tech is being rewritten, and AI-first engineering is the catalyst. A big thank you to all Spotters worldwide who’ve embraced this change. The progress we’ve made together is incredible. If you're an engineer or product leader fired up about rewiring critical infra with AI, hit me up. The travel stack's getting a full rewrite, and we're leading the charge. #AIInnovation #TravelTech #Spotnana

128

2 Comments

Today I am excited to announce Digger’s BIGGEST update ever Project OpenTaco - The Open Standard for Terraform automation. With OpenTofu, where Digger is a founding member, the community already has a credible open-source CLI alternative to BSL-licensed Terraform. But as we all kno that only solves half the problem. The CLI helps teams avoid lock-in, but it doesn’t address governance or collaboration challenges at scale. Project OpenTaco builds on this foundation, without taking an opinion on which IaC language is used, giving teams a path to adopt more Infrastructure-as-Code with a TACOs that is open, self-hostable, and free from licensing traps or per-resource pricing. We believe that it this is “Terraform’s backstage moment”. Backstage became the open standard for Internal Developer Portals, we believe Project OpenTaco will do the same for IaC automation, setting the standard, driving adoption, and making closed platforms unnecessary. The future of IaC is open, and we’re building it brick by brick. Check out our roadmap and sign up for updates, we’d love any and all feedback! Link in the first comment ->

98

11 Comments

After years of leading security through scaling challenges, I'm sharing the mental models that have worked really well for me! If you're a security leader, you've probably hit this wall: your team can't keep up with security review requests, compliance work is consuming everything, and the traditional playbook to hire more people isn't solving the problem. I've lived this at NASA, at startups that went through acquisitions, and now at GitLab helping secure one of the world's largest DevSecOps platforms. What I I have learned in all these years is that there's no one-size-fits-all security strategy. What works for a cloud-native startup fails spectacularly at an enterprise with decades of legacy systems. So I built something different => the Software Factory Security Framework (SF²) which is a strategic positioning model that helps security leaders figure out what's actually appropriate for their organization, not someone else's. The 60-second version:  - Two-axis model: assess your operational complexity + operational readiness  - Four strategic positions with different playbooks (not everyone needs "enterprise" security)  - Honest timelines (yes, some transformations really take 3-5 years)  - Works alongside frameworks you already use (NIST, OWASP, etc.)  - Focuses on sustainable scaling vs. endless manual work A few things I believe:  - Supply chain security became #1 priority when adversaries evolved to automated discovery at scale  - Context matters more than "best practices"  - Realistic timelines beat wishful thinking every time  - Security scales through strategic investment, not just headcount Why I'm sharing this openly: This is my personal work (not an official GitLab framework), but these mental models do inform how I approach security strategy at GitLab. I'm making it fully open source (CC BY 4.0) because I believe our industry gets stronger when we share strategic thinking, not just tactical checklists.  What I need from you:  - Read it and tell me what I got wrong  - Contribute real-world examples  - Share it with security leaders who might find it useful  - Challenge the frameworks where your experience differs This isn't finished, it's a living framework that gets better with community input. If you've scaled security at organizations from 10 to 10,000 engineers, you have perspective that can make this better. Check it out: 📖 Website: https://sf2framework.com 💻 GitLab Repo: https://lnkd.in/e56ijVTy Whether you agree or disagree with the approach, I'd love to hear from you. Security leadership is hard enough; we should help each other navigate it honestly.

653

38 Comments

Have you been a victim of workslop 🪣? A recent HBR report on bad AI content at work really hit home for me. I've seen it everywhere and I know you have too. Workslop is that super polished-sounding content that looks impressive but says so little and lacks specifics in your work context that it offers no real value and even wastes time (HBR says AI slop is wasting $186 per employee per month). LLMs are incredibly impressive and are starting to make a dent on actual work (see OpenAI's latest research). But if companies rush to deploy any AI solution and don't think about training, metrics, or grounding it in their own work context, it's going to lead to wasted time and workslop. Why the rush? I've heard it firsthand in customer meetings: "We need AI or competitors will eat us alive." One report found 77% of CEOs feel competitive pressure to adopt it. So here are some my tips to get more out of AI deployments and reduce that workslop. 1. 📊 Your work context matters! Don't rely on a vanilla LLM or generic "enterprise chatbot."  It must be tuned to your work content, metrics, and data. Many chatbots only connect superficially to 3rd party content, or pull in personal files but not shared ones. So they aren't very effective. (Check out Dropbox Dash, we do this really, really well). 2. 🎯 Define your success criteria Know what you're solving. If you want fewer errors or faster delivery, measure that. Don’t just declare success because "AI is deployed." For software development, many companies see success when all devs are using an AI coding copilot. Or "generating code with AI". But for what purpose? Faster deployments, fewer bugs, improved feature velocity? That's what you need to measure. 3. 🛠️ Training and culture That blinking chatbot cursor is intimidating. In one survey, 49% of workers felt pressure to adopt AI, but 55% didn’t know how. The best deployments invest in training, shared playbooks, demos, and mentors. And don’t just do it once and think you are done. Ongoing measurement, monitoring, and training is needed. Also, look for AI tools that aren't just a chatbot. Products that blend seamlessly in the background. Not everything needs to be solved with a language model. 4. 🚀 High performers are going to highly perform and vice versa Ignore AI for a second. Top performers always seem to "figure it out" in the workplace. They learn the new tool and incorporate it into their workday. And so AI deployments are just new tools. It’s critical to watch and observe their output and use them as mentors (above). But others may simply take AI output and present it as their own. Workslop! And unless you guard against that (via reviews, performance management, feedback, and coaching), you're going to get more workslop. And that annoys and slows down everyone else. AI is nothing new here. Don't assume AI is some magic bullet and everyone's performance will rise. Don't just deploy it and forget it!

40

1 Comment