Pages on Matt Goodrich

The Identity Spine

Tue, 09 Jun 2026 12:10:08 -0700

This is the map for the identity series: one argument about building identity security for the company you actually have, broken into posts you can read in any order. It starts from a single hub and branches into six threads. It is a graph more than a line, because the threads cross. Phishing-resistant MFA leans on single sign-on. Device trust comes back around under BYOD. Continuous access ties the operational layer to the pillars it watches.

Start at the hub and follow whichever thread matches the problem in front of you. The table below lists every post, the path through the graph that reaches it, and the standards and open-source projects it draws on, so you can jump to a specific control or see what a given piece leans on.

The map above is the clean version. In practice the posts reference each other constantly, across threads as much as within them. Here is the same series drawn as its actual web of links, each post colored by its thread.

The Six Threads

Building the ladder is the IAM you stand up first: one front door, automatic lifecycle, roles and attributes, a broker for the dangerous access, break-glass for the bad day, and knowing what each grant can actually reach.
Zero trust, end to end walks the pillars in blast-radius order: prove the user, prove the device, drop the flat network, check authorization at the object, and let access know what the data is.
Workload and machine identity is identity for the things that are not people: workloads that cross cloud boundaries, the service accounts they used to be, the non-human identities that now outnumber humans, and the agents arriving next.
Running it is the operational layer once the ladder is built: ending a session everywhere, evaluating access continuously, reviewing entitlements from telemetry instead of spreadsheets, and detecting the identity attacks that get through.
Product authorization is fine-grained authorization inside the software you ship: why that model is never finished, how the policy, the evaluation, and the data are three separate choices rather than one, and how to carry the caller’s identity deep into a call graph that has forgotten who asked.
Synthesis is what the whole thing adds up to: collapse the surface before you defend it, take out the friction that makes people hoard access, and run a secure enterprise on devices you do not own.

Every Post, and What It Draws On

Post	Path through the graph	Standards and frameworks	Open source
IAM for the company you have	Hub	Gartner IAM maturity model; CISA Zero Trust Maturity Model	-
One front door, one place to revoke	Hub ▸ Building the ladder ▸ SSO	SAML 2.0; OIDC; SCIM (RFC 7644)	Keycloak, Authentik, Zitadel, Authelia, oauth2-proxy, Pomerium
Automate the leaver before the joiner	Hub ▸ Building the ladder ▸ Lifecycle	SCIM (RFC 7644); Shared Signals / CAEP	midPoint, Apache Syncope
Roles don’t scale the way you think	Hub ▸ Building the ladder ▸ Roles	NIST RBAC; NIST SP 800-162 (ABAC)	OPA, Casbin
Authorization broker models	Hub ▸ Building the ladder ▸ Broker	-	Teleport, HashiCorp Boundary, Vault, JumpServer
Break-glass without the backdoor	Hub ▸ Building the ladder ▸ Break-glass	AWS service control policy pattern	-
You can reach more than you were granted	Hub ▸ Building the ladder ▸ Reachable permissions	-	PMapper, Cartography, BloodHound, AzureHound
Zero trust is a sequence	Hub ▸ Zero trust ▸ Sequence	NIST SP 800-207; CISA Zero Trust Maturity Model	-
MFA that survives phishing	Hub ▸ Zero trust ▸ MFA	WebAuthn; FIDO2; NIST 800-63B; CISA AA23-320A	SoloKeys, Nitrokey, Keycloak, Authentik
Trust the user, then the machine	Hub ▸ Zero trust ▸ Device	BeyondCorp; Apple Managed Device Attestation; Play Integrity	step-ca, osquery, Fleet, Wazuh
Per-app access ends the flat network	Hub ▸ Zero trust ▸ Per-app access	NIST SP 800-207; BeyondCorp	OpenZiti, Pomerium, Nebula, Headscale
The gateway can’t see the object	Hub ▸ Zero trust ▸ Object-level authorization	OWASP API BOLA; Google Zanzibar	OPA, OpenFGA, SpiceDB, Cedar
Access should know what the data is	Hub ▸ Zero trust ▸ Data-centric	NIST FIPS 199	Presidio, OpenMetadata, DataHub
When you can use workload identity	Hub ▸ Workload and machine ▸ Workload identity	-	SPIFFE / SPIRE
Workload identity that crosses boundaries	Hub ▸ Workload and machine ▸ SPIFFE	SPIFFE; IETF WIMSE	SPIRE, go-spiffe, SPIFFE Helper
Non-human identities	Hub ▸ Workload and machine ▸ NHI	-	Gitleaks, TruffleHog, External Secrets, SPIFFE / SPIRE
Service accounts that improvise	Hub ▸ Workload and machine ▸ Service accounts	OAuth for AI agents (IETF draft); MCP authorization; OWASP Agentic Top 10	SPIFFE, Vault, Teleport, agentgateway
Agents need capabilities, not roles	Hub ▸ Workload and machine ▸ Agent capabilities	NIST AI 600-1; NIST SP 800-53; OWASP Agentic AI; SLSA; ISO/IEC 42001	-
Logging out is harder than logging in	Hub ▸ Running it ▸ Sessions	OIDC back-channel / front-channel logout; OAuth revocation (RFC 7009); SSF / CAEP; OWASP session management	Keycloak, Authentik, Ory Hydra, caep.dev
Identity is becoming continuous	Hub ▸ Running it ▸ Continuous	Shared Signals Framework / CAEP	caep.dev
Telemetry-driven access reviews	Hub ▸ Running it ▸ Telemetry reviews	-	-
The other half of identity security	Hub ▸ Running it ▸ Detection	-	Falco, Sigma, Wazuh
Your authorization model is never done	Hub ▸ Product authorization	Google Zanzibar	OpenFGA, SpiceDB, Ory Keto, Cedar, Oso, Topaz
Authorization is three decisions, not one	Hub ▸ Product authorization ▸ Three decisions	Google Zanzibar; NIST SP 800-162 (ABAC)	OPA, Cedar, OpenFGA, SpiceDB, Topaz
Whose request is this, three hops in?	Hub ▸ Product authorization ▸ Caller identity across hops	SPIFFE; OAuth Token Exchange (RFC 8693); mTLS (RFC 8705)	Istio, Linkerd, SPIRE, OPA
Collapse the surface, then defend it	Hub ▸ Synthesis ▸ Collapse	-	-
Friction is why people hoard access	Hub ▸ Synthesis ▸ Friction	-	OPA
A secure enterprise on devices you don’t own	Hub ▸ Synthesis ▸ BYOD	BeyondCorp; Android work profile; Apple user enrollment; Play Integrity	-

Podcasts

Sun, 28 Dec 2025 00:00:00 -0800

These are the podcasts I regularly listen to.

Security/Cybersecurity

Darknet Diaries
AI Security Podcast
CISO Series Podcast
Defense in Depth
No Such Podcast
Shell Game
The New CISO Podcast with Steve Moore

Aviation

Opposing Bases
There I Was An Aviation Podcast
AOPA Never Again
Ask the A&Ps
Aviation News Talk
Flight Safety Detectives
I Learned About Flying from That
The Finer Points Aviation Podcast

Business/Entrepreneurship

Founders Talk
This Week in Startups
Y Combinator Startup Podcast

Economics/General Interest

Freakonomics Radio
The Economics of Everyday Things
The Freakonomics Radio Book Club
If Books Could Kill

Book Reviews

Sun, 31 Aug 2025 07:53:08 -0700

5 Star

Technical/Engineering

An Elegant Puzzle: Systems of Engineering Management
- Will Larson
- #engineering, #management, #non-fiction, #audiobook
The Phoenix Project: A Novel About IT, DevOps, and Helping Your Business Win
- Gene Kim
- #business, #business-fable, #devops, #audiobook
The Unicorn Project
- Gene Kim
- #business, #business-fable, #security, #audiobook

Leadership/Management

Radical Candor: Be a Kickass Boss Without Losing Your Humanity
- Kim Malone Scott
- #leadership, #management, #culture, #non-fiction, #audiobook
Death by Meeting: A Leadership Fable… about Solving the Most Painful Problem in Business
- Patrick Lencioni
- #business, #business-fable, #audiobook
The Five Dysfunctions of a Team
- Patrick Lencioni
- #business, #business-fable, #audiobook
Getting Naked: A Business Fable about Shedding the Three Fears That Sabotage Client Loyalty
- Patrick Lencioni
- #business, #business-fable, #audiobook
- Book Review: Getting Naked

Business/Entrepreneurship

Freakonomics: A Rogue Economist Explores the Hidden Side of Everything
- Steven D. Levitt
- #non-fiction, #economics, #audiobook

Security/Cybersecurity

The Cuckoo’s Egg: Tracking a Spy Through the Maze of Computer Espionage
- Cliff Stoll
- #security, #cybersecurity, #non-fiction, #audiobook

Aviation

Manifesto: A Revolutionary Approach to General Aviation Maintenance
- Mike Busch
- #aviation, #non-fiction, #audiobook
Mike Busch on Engines: What every aircraft owner needs to know about the design, operation, condition monitoring, maintenance and troubleshooting of piston … Airplane Maintenance and Ownership Book 2)
- Mike Busch
- #aviation, #non-fiction, #audiobook

Personal Development

Kitchen Confidential: Adventures in the Culinary Underbelly
- Anthony Bourdain
- #non-fiction, #audiobook

4 Star

Technical/Engineering

Staff Engineer: Leadership Beyond the Management Track
- Will Larson
- #engineering, #management, #non-fiction, #audiobook
The Manager’s Path: A Guide for Tech Leaders Navigating Growth and Change
- Camille Fournier
- #engineering, #management, #leadership, #audiobook
Managing Humans: Biting and Humorous Tales of a Software Engineering Manager
- Michael Lopp
- #engineering, #management, #non-fiction, #audiobook
Investments Unlimited: A Novel About DevOps, Security, Audit Compliance, and Thriving in the Digital Age
- Helen Beal
- #business-fable, #devops, #security, #audiobook
- Book Review: Investments Unlimited
AI Engineering: Building Applications with Foundation Models
- Chip Huyen
- #engineering, #ai, #technology, #non-fiction
Designing Multi-Agent Systems
- Victor Dibia
- #engineering, #ai, #multi-agent, #technology, #non-fiction

Leadership/Management

The Speed of Trust: The One Thing that Changes Everything
- Stephen M.R. Covey
- #business, #management, #non-fiction, #audiobook
Powerful: Building a Culture of Freedom and Responsibility
- Patty McCord
- #business, #management, #culture, #non-fiction, #audiobook
Extreme Ownership: How U.S. Navy SEALs Lead and Win
- Jocko Willink
- #leadership, #management, #non-fiction, #audiobook
The Dichotomy of Leadership: Balancing the Challenges of Extreme Ownership to Lead and Win
- Jocko Willink
- #leadership, #management, #non-fiction, #audiobook
Turn the Ship Around!: A True Story of Turning Followers into Leaders
- L. David Marquet
- #leadership, #management, #non-fiction, #audiobook
Measure What Matters
- John Doerr
- #business, #management, #non-fiction, #audiobook
No Rules Rules: Netflix and the Culture of Reinvention
- Reed Hastings
- #business, #culture, #management, #non-fiction, #audiobook
Start with Why: How Great Leaders Inspire Everyone to Take Action
- Simon Sinek
- #leadership, #management, #business, #audiobook
Leading From Anywhere: The Essential Guide to Managing Remote Teams
- David Burkus
- #leadership, #management, #remote-work, #non-fiction, #audiobook
The No Asshole Rule: Building a Civilized Workplace and Surviving One That Isn’t
- Robert I. Sutton
- #leadership, #management, #culture, #non-fiction #audiobook
The Coaching Habit: Say Less, Ask More & Change the Way You Lead Forever
- Michael Bungay Stanier
- #leadership, #coaching, #management, #non-fiction, #audiobook
Multipliers: How the Best Leaders Make Everyone Smarter
- Liz Wiseman
- #leadership, #management, #culture, #audiobook

Business/Entrepreneurship

The Ride of a Lifetime: Lessons Learned from 15 Years as CEO of the Walt Disney Company
- Robert Iger, Joel Lovell
- #leadership, #business, #management, #non-fiction, #audiobook
Zero to One: Notes on Startups, or How to Build the Future
- Peter Thiel
- #entrepreneurship, #business, #startup, #audiobook
The Hard Thing About Hard Things: Building a Business When There Are No Easy Answers
- Ben Horowitz
- #entrepreneurship, #business, #leadership, #non-fiction
The Dip: A Little Book That Teaches You When to Quit
- Seth Godin
- #business, #non-fiction, #audiobook
Never Split the Difference: Negotiating As If Your Life Depended On It
- Chris Voss
- #business, #negotiation, #non-fiction, #audiobook
Made to Stick: Why Some Ideas Survive and Others Die
- Chip Heath
- #business, #communication, #marketing, #non-fiction

Security/Cybersecurity

This Is How They Tell Me the World Ends: The Cyberweapons Arms Race
- Nicole Perlroth
- #security, #non-fiction, #cybersecurity, #audiobook
Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon
- Kim Zetter
- #security, #cybersecurity, #non-fiction, #audiobook
Project Zero Trust: A Story about a Strategy for Aligning Security and the Business
- George Finney
- #business-fable, #security, #cybersecurity, #audiobook

Product Management

Product-Led Growth: How to Build a Product That Sells Itself
- Wes Bush
- #business, #product-management, #non-fiction, #audiobook
- Book Review: Product Led Growth
Escaping the Build Trap: How Effective Product Management Creates Real Value
- Melissa Perri
- #business, #product-management, #non-fiction, #audiobook
- Book Review: Escaping the Build Trap

Personal Development

The Checklist Manifesto: How to Get Things Right
- Atul Gawande
- #productivity, #systems, #process, #non-fiction, #audiobook
- Book Review: The Checklist Manifesto
Quiet: The Power of Introverts in a World That Can’t Stop Talking
- Susan Cain
- #psychology, #non-fiction, #audiobook
Oh Crap! Potty Training: Everything Modern Parents Need to Know to Do It Once and Do It Right
- Jamie Glowacki
- #parenting, #non-fiction, #audiobook

Aviation

Area 51: An Uncensored History of America’s Top Secret Military Base
- Annie Jacobsen
- #history, #military, #non-fiction, #audiobook

Finance/Business Cases

Bad Blood: Secrets and Lies in a Silicon Valley Startup
- John Carreyrou
- #business, #startup, #scandal, #audiobook

3 Star

Technical/Engineering

The Kubernetes Book
- Nigel Poulton
- #non-fiction, #technology, #audiobook

Leadership/Management

Leading through Disruption: A Changemaker’s Guide to Twenty-First Century Leadership
- Andrew Liveris
- #leadership, #business, #strategy, #non-fiction, #audiobook
How to Lead When You’re Not in Charge
- Clay Scroggins
- #non-fiction , #audiobook , #leadership
Team of Teams: New Rules of Engagement for a Complex World
- General Stanley McChrystal
- #leadership, #military, #management, #audiobook

Business/Entrepreneurship

Rework
- Jason Fried
- #business, #entrepreneurship, #non-fiction, #audiobook
Remote, Inc.: How to Thrive at Work . . . Wherever You Are
- Robert C. Pozen
- #business, #remote-work, #non-fiction, #audiobook
Exactly What to Say: The Magic Words for Influence and Impact
- Phil M Jones
- #business, #sales, #communication, #persuasion, #influence, #non-fiction, #audiobook

Personal Development

The Subtle Art of Not Giving a F*ck: A Counterintuitive Approach to Living a Good Life
- Mark Manson
- #non-fiction, #self-help, #philosophy, #audiobook
Relentless: From Good to Great to Unstoppable
- Tim S. Grover
- #self-help, #performance, #non-fiction, #audiobook

Finance/Business Cases

Rich Dad, Poor Dad
- Robert T. Kiyosaki
- #non-fiction, #finance, #investment, #audiobook

Books Up Next

Sun, 31 Aug 2025 07:52:59 -0700

This is my TBR (To Be Read) list. Most of these were recommended to me from people I know, or mentioned in other books I have read.

Technical/Engineering

Team Topologies: Organizing Business and Technology Teams for Fast Flow
- Matthew Skelton
- #engineering, #technology, #management, #non-fiction, #audiobook
The Mythical Man-Month: Essays on Software Engineering
- Frederick P. Brooks Jr.
- #engineering, #technology, #non-fiction, #audiobook
Driving Technical Change: Why People On Your Team Don’t Act On Good Ideas, and How to Convince Them They Should
- Terrence Ryan
- #engineering, #technology, #leadership, #non-fiction, #audiobook
A Seat at the Table: IT Leadership in the Age of Agility
- Mark Schwartz
- #engineering, #technology, #leadership, #non-fiction, #audiobook
The Software Architect Elevator: Redefining the Architect’s Role in the Digital Enterprise
- Gregor Hohpe
- #engineering, #technology, #architecture, #non-fiction, #audiobook
Accelerate: Building and Scaling High Performing Technology Organizations
- Nicole Forsgren
- #engineering, #technology, #devops, #non-fiction, #audiobook
Kill It with Fire: Manage Aging Computer Systems
- Marianne Bellotti
- #engineering, #technology, #non-fiction, #audiobook
The Art Of Business Value
- Mark Schwartz
- #engineering, #business, #technology, #non-fiction, #audiobook
Building Microservices: Designing Fine-Grained Systems
- Sam Newman
- #engineering, #architecture, #technology, #non-fiction, #audiobook
- Technical architecture that bridges engineering and management
Technology Strategy Patterns: Architecture as Strategy
- Eben Hewitt
- #technology, #strategy, #architecture, #engineering, #audiobook
- Technical strategy like your highly-rated technical leadership books
Ahead in the Cloud: Best Practices for Navigating the Future of Enterprise IT
- Stephen Orban
- #technology, #cloud, #enterprise, #non-fiction, #audiobook

Leadership/Management

Dare to Lead
- Brene Brown
- #leadership, #management, #non-fiction, #audiobook
The 7 Habits of Highly Effective People: Powerful Lessons in Personal Change
- Stephen R. Covey
- #leadership, #self-help, #non-fiction, #audiobook
1% Leadership: Master the Small, Daily Improvements that Set Great Leaders Apart
- Andy Ellis
- #leadership, #management, #non-fiction, #audiobook
Leadership Strategy and Tactics: Field Manual
- Jocko Willink
- #leadership, #management, #non-fiction, #audiobook
Reality-Based Leadership: Ditch the Drama, Restore Sanity to the Workplace, and Turn Excuses Into Results
- Cy Wakeman
- #leadership, #management, #non-fiction, #audiobook
Crucial Conversations: Tools for Talking When Stakes are High
- Kerry Patterson
- #leadership, #communication, #management, #non-fiction, #audiobook
Wooden on Leadership: How to Create a Winning Organization
- John Wooden
- #leadership, #management, #non-fiction, #audiobook
Leadership: In Turbulent Times
- Doris Kearns Goodwin
- #leadership, #history, #non-fiction, #audiobook
Leaders Eat Last: Why Some Teams Pull Together and Others Don’t
- Simon Sinek
- #leadership, #management, #culture, #audiobook
The Infinite Game
- Simon Sinek
- #leadership, #business, #philosophy, #non-fiction, #audiobook
Armstrong on Reinventing Performance Management: Building a Culture of Continuous Improvement
- Michael Armstrong
- #management, #performance, #culture, #non-fiction
Manager as Negotiator
- David A. Lax
- #management, #negotiation, #leadership, #non-fiction
The Five Temptations of a CEO: A Leadership Fable
- Patrick Lencioni
- #leadership, #business-fable, #management, #audiobook
- Another business fable by your favorite 5-star author
Silos, Politics and Turf Wars: A Leadership Fable About Destroying the Barriers That Turn Colleagues Into Competitors
- Patrick Lencioni
- #leadership, #business-fable, #culture, #audiobook
- Leadership fable format you consistently rate 5-star
The First 90 Days: Proven Strategies for Getting Up to Speed Faster and Smarter
- Michael Watkins
- #leadership, #management, #career, #audiobook
- Leadership transition book, management focus like your 4-star books
The 4 Disciplines of Execution: Achieving Your Wildly Important Goals
- Chris McChesney
- #leadership, #execution, #business, #non-fiction
Action Inquiry: The Secret of Timely and Transforming Leadership
- Bill Torbert
- #leadership, #transformation, #management, #non-fiction
Don’t Hire Anyone Without Me!: A revolutionary approach to interviewing and hiring the best
- Carol Quinn
- #leadership, #hiring, #hr, #non-fiction
Ego Free Leadership: Ending the Unconscious Habits That Hijack Your Business
- Brandon Black
- #leadership, #self-awareness, #management, #non-fiction
Entreleadership: 20 Years of Practical Business Wisdom from the Trenches
- Dave Ramsey
- #leadership, #business, #entrepreneurship, #non-fiction
First, Break All the Rules: What the World’s Greatest Managers Do Differently
- Marcus Buckingham
- #leadership, #management, #hr, #non-fiction
Good Leaders Ask Great Questions: Your Foundation for Successful Leadership
- John C. Maxwell
- #leadership, #questioning, #management, #non-fiction
Leadershift: The 11 Essential Changes Every Leader Must Embrace
- John C. Maxwell
- #leadership, #change, #transformation, #non-fiction
Leadership and Self-Deception: Getting Out of the Box
- The Arbinger Institute
- #leadership, #self-awareness, #psychology, #non-fiction
Leading Change
- John P. Kotter
- #leadership, #change-management, #transformation, #non-fiction
Meetings Suck: Turning One of The Most Loathed Elements of Business into One of the Most Valuable
- Cameron Herold
- #leadership, #meetings, #productivity, #non-fiction
Quiet Leadership: Six Steps to Transforming Performance at Work
- David Rock
- #leadership, #performance, #coaching, #non-fiction
Switch: How to Change Things When Change Is Hard
- Chip Heath
- #leadership, #change, #psychology, #non-fiction
The 21 Irrefutable Laws of Leadership: Follow Them and People Will Follow You
- John C Maxwell
- #leadership, #principles, #management, #non-fiction
The Effective Executive: The Definitive Guide to Getting the Right Things Done
- Peter F. Drucker
- #leadership, #management, #productivity, #non-fiction
The Leadership Moment: Nine True Stories of Triumph and Disaster and Their Lessons for Us All
- Michael Useem
- #leadership, #case-studies, #management, #non-fiction
The Leadership Secrets of Colin Powell
- Oren Harari
- #leadership, #military, #biography, #non-fiction
The Twelve Absolutes of Leadership
- BURNISON
- #leadership, #principles, #management, #non-fiction
The Vision Driven Leader: 10 Questions to Focus Your Efforts, Energize Your Team, and Scale Your Business
- Michael Hyatt
- #leadership, #vision, #strategy, #non-fiction
Theodore Roosevelt on Leadership: Executive Lessons from the Bully Pulpit
- James Strock
- #leadership, #history, #biography, #non-fiction
Total Leadership: Be a Better Leader, Have a Richer Life
- Stewart D. Friedman
- #leadership, #work-life-balance, #management, #non-fiction
Tribes: We Need You to Lead Us
- Seth Godin
- #leadership, #community, #influence, #non-fiction
Virtuous Leadership
- Alexandre Havard
- #leadership, #virtue, #ethics, #non-fiction
We Shall Not Fail: The Inspiring Leadership of Winston Churchill
- Celia Sandys
- #leadership, #biography, #history, #non-fiction
John P. Kotter on What Leaders Really Do
- John P. Kotter
- #leadership, #management, #change, #non-fiction
Why Great Leaders Don’t Take Yes for an Answer: Managing for Conflict and Consensus
- Michael Roberto
- #leadership, #decision-making, #conflict, #non-fiction
Communicating for a Change: Seven Keys to Irresistible Communication
- Andy Stanley
- #leadership, #communication, #speaking, #non-fiction
Conversational Capacity: The Secret to Building Successful Teams That Perform When the Pressure Is On
- Craig Weber
- #leadership, #communication, #teamwork, #non-fiction
Emotional Intelligence 2.0
- Travis Bradberry
- #leadership, #emotional-intelligence, #self-awareness, #non-fiction
How to Work with Jerks: Getting Stuff Done with People You Can’t Stand
- Eric L. Williamson
- #leadership, #communication, #workplace, #non-fiction
Influence Redefined: Be the Leader You Were Meant to Be, Monday to Monday
- Stacey Hanke
- #leadership, #influence, #communication, #non-fiction
The Anatomy of Peace: Resolving the Heart of Conflict
- The Arbinger Institute
- #leadership, #conflict-resolution, #psychology, #non-fiction
The Culture Code: The Secrets of Highly Successful Groups
- Daniel Coyle
- #leadership, #culture, #teamwork, #non-fiction

Business/Entrepreneurship

The Culture Map: Breaking Through the Invisible Boundaries of Global Business
- Erin Meyer
- #business, #culture, #communication, #non-fiction, #audiobook
The Lean Startup
- Eric Ries
- #entrepreneurship, #business, #startup, #audiobook
The Innovator’s Dilemma: The Revolutionary Book that Will Change the Way You Do Business
- Clayton M. Christensen
- #business, #innovation, #entrepreneurship, #non-fiction, #audiobook
Influence: The Psychology of Persuasion
- Robert B. Cialdini
- #psychology, #persuasion, #business, #non-fiction, #audiobook
The Mom Test: How to talk to customers & learn if your business is a good idea when everyone is lying to you
- Rob Fitzpatrick
- #business, #entrepreneurship, #customer-development, #non-fiction, #audiobook
The Personal MBA: Master the Art of Business
- Josh Kaufman
- #business, #entrepreneurship, #education, #non-fiction, #audiobook
The 4-Hour Workweek
- Timothy Ferriss
- #business, #productivity, #entrepreneurship, #non-fiction, #audiobook
Good to Great: Why Some Companies Make the Leap… and Others Don’t
- Jim Collins
- #business, #management, #strategy, #audiobook
Good Strategy Bad Strategy: The Difference and Why It Matters
- Richard P. Rumelt
- #business, #strategy, #management, #non-fiction
The Tipping Point: How Little Things Can Make a Big Difference
- Malcolm Gladwell
- #business, #psychology, #sociology, #non-fiction, #audiobook
How To Win Friends and Influence People
- Dale Carnegie
- #business, #communication, #relationships, #audiobook
Berkshire Hathaway Letters to Shareholders, 2023
- Warren Buffett
- #finance, #investment, #business, #non-fiction
Brief: Make a Bigger Impact by Saying Less
- Joseph McCormack
- #business, #communication, #leadership, #non-fiction
Who Not How: The Formula to Achieve Bigger Goals Through Accelerating Teamwork
- Dan Sullivan
- #business, #productivity, #leadership, #non-fiction
Brave New Work: Are You Ready to Reinvent Your Organization?
- Aaron Dignan
- #business, #organizational-change, #innovation, #non-fiction
Business Made Simple: 60 Days to Master Leadership, Sales, Marketing, Execution, Management, Personal Productivity and More (Made Simple Series)
- Donald Miller
- #business, #entrepreneurship, #productivity, #non-fiction
Know What You’re FOR: A Growth Strategy for Work, An Even Better Strategy for Life
- Jeff Henderson
- #business, #strategy, #purpose, #non-fiction
Predictable Success: Getting Your Organization on the Growth Track-And Keeping It There
- Les McKeown
- #business, #growth, #organizational-development, #non-fiction
Profit First: Transform Your Business from a Cash-Eating Monster to a Money-Making Machine (Entrepreneurship Simplified)
- Mike Michalowicz
- #business, #finance, #entrepreneurship, #non-fiction
That Will Never Work: The Birth of Netflix and the Amazing Life of an Idea
- Marc Randolph
- #business, #entrepreneurship, #startup, #biography
The Advantage: Why Organizational Health Trumps Everything Else In Business
- Patrick M. Lencioni
- #business, #organizational-health, #leadership, #non-fiction
Blink: The Power of Thinking Without Thinking
- Malcolm Gladwell
- #business, #psychology, #decision-making, #non-fiction
Never Eat Alone: And Other Secrets to Success, One Relationship at a Time
- Keith Ferrazzi
- #business, #networking, #relationships, #non-fiction
Nudge: Improving Decisions About Health, Wealth, and Happiness
- Richard H. Thaler
- #business, #behavioral-economics, #decision-making, #non-fiction
Talking to Strangers: What We Should Know About the People We Don’t Know
- Malcolm Gladwell
- #business, #psychology, #communication, #non-fiction
Building a StoryBrand 2.0: Clarify Your Message So Customers Will Listen
- Donald Miller
- #business, #marketing, #communication, #non-fiction
Crucial Accountability: Tools for Resolving Violated Expectations, Broken Commitments, and Bad Behavior
- PATTERSON
- #business, #accountability, #communication, #non-fiction
The Challenger Sale: Taking Control of the Customer Conversation
- Matthew Dixon
- #business, #sales, #customer-development, #non-fiction
Great Demo!: How to Create and Execute Stunning Software Demonstrations
- Peter Cohan
- #business, #sales, #software, #non-fiction
Doing Discovery: The Single Most Important Element of Software Sales and Buyer Enablement Processes
- Peter Cohan
- #business, #sales, #customer-development, #non-fiction
The Trusted Advisor
- David H. Maister
- #business, #consulting, #relationships, #non-fiction
The Trusted Advisor Sales Engineer
- John Care
- #business, #sales, #technical-sales, #non-fiction
Mastering Technical Sales: The Sales Engineer’s Handbook
- John Care
- #business, #sales, #technical-sales, #non-fiction
The Six Habits of Highly Effective Sales Engineers
- Chris White
- #business, #sales, #technical-sales, #non-fiction

Aviation

Skunk Works: A Personal Memoir of My Years at Lockheed
- Ben R. Rich
- #aviation, #military, #engineering, #audiobook
Freight Dog: The Dark Side of Aviation
- Kimber C. Turner
- #aviation, #non-fiction
The Vanishing of Flight MH370: The True Story of the Hunt for the Missing Malaysian Plane
- Richard Quest
- #aviation, #mystery, #non-fiction
Ferry Pilot: Nine Lives Over the North Atlantic.
- Kerry McCauley
- #aviation, #adventure, #non-fiction
Dangerous Flights: What Could Possibly Go Wrong?
- Kerry McCauley
- #aviation, #adventure, #non-fiction
Mike Busch on Airplane Ownership (Volume 1): What every aircraft owner needs to know about selecting, purchasing, insuring, maintaining, troubleshooting, modifying, and flying light airplanes
- Mike Busch
- #aviation, #maintenance, #ownership, #non-fiction
Mike Busch on Airplane Ownership
- Mike Busch
- #aviation, #maintenance, #ownership, #non-fiction
The Crash Detectives: Investigating the World’s Most Mysterious Air Disasters
- Christine Negroni
- #aviation, #investigation, #safety, #audiobook

Security/Cybersecurity

CISO Desk Reference Guide Volume 2: A Practical Guide for CISOs
- Bill Bonney, Gary Hayslip, Matt Stamper
- #cybersecurity, #security, #leadership, #non-fiction
CISO Desk Reference Guide: A Practical Guide for CISOs
- Bill Bonney, Gary Hayslip, Matt Stamper
- #cybersecurity, #security, #leadership, #non-fiction
CISO Impact and Influence: How Cybersecurity Executives Can Take the Lead and Nudge the World
- Chris Brown
- #cybersecurity, #security, #leadership, #non-fiction
Why CISOs Fail: The Missing Link in Security Management–and How to Fix It
- Barak Engel
- #cybersecurity, #security, #leadership, #non-fiction
The Cyber Leadership Imperative: Powerful Strategies to Unlock Your Potential and Become an Exceptional Cybersecurity Executive
- Phillimon Zongo, Darren Argyle, Jan Schreuder
- #cybersecurity, #security, #leadership, #non-fiction

Product Management

Empowered: Ordinary People, Extraordinary Products
- Marty Cagan
- #product-management, #business, #leadership, #non-fiction
Product Roadmaps Relaunched: How to Set Direction while Embracing Uncertainty
- C. Todd Lombardo
- #product-management, #business, #strategy, #non-fiction
Product Leadership: How Top Product Managers Launch Awesome Products and Build Successful Teams
- Richard Banfield
- #product-management, #leadership, #business, #non-fiction
Inspired: How to Create Tech Products Customers Love
- Marty Cagan
- #product-management, #business, #technology, #non-fiction
Project to Product: How to Survive and Thrive in the Age of Digital Disruption with the Flow Framework
- Mik Kersten
- #product-management, #business, #transformation, #non-fiction
Sooner Safer Happier: Antipatterns and Patterns for Business Agility
- Jonathan Smart
- #product-management, #agile, #business, #non-fiction

Personal Development

Atomic Habits: An Easy & Proven Way to Build Good Habits & Break Bad Ones
- James Clear
- #self-help, #productivity, #habits, #audiobook
Think Again: The Power of Knowing What You Don’t Know
- Adam M. Grant
- #psychology, #self-help, #learning, #non-fiction, #audiobook
Getting Things Done: The Art of Stress-Free Productivity
- David Allen
- #productivity, #self-help, #organization, #audiobook
Thinking, Fast and Slow
- Daniel Kahneman
- #psychology, #decision-making, #behavioral-economics, #audiobook
Thinking In Systems: A Primer
- Donella H. Meadows
- #systems-thinking, #complexity, #problem-solving, #non-fiction
The Goal: A Process of Ongoing Improvement
- Eliyahu M. Goldratt
- #process-improvement, #systems, #business, #non-fiction
Deviate: The Science of Seeing Differently
- Beau Lotto
- #psychology, #perception, #creativity, #non-fiction
Finish: Give Yourself the Gift of Done
- Jon Acuff
- #productivity, #goal-setting, #self-help, #non-fiction
Living Forward: A Proven Plan to Stop Drifting and Get the Life You Want
- Michael Hyatt
- #personal-development, #goal-setting, #life-planning, #non-fiction
Free to Focus: A Total Productivity System to Achieve More by Doing Less
- Michael Hyatt
- #productivity, #personal-development, #focus, #non-fiction
Building a Second Brain: A Proven Method to Organize Your Digital Life and Unlock Your Creative Potential
- Tiago Forte
- #productivity, #knowledge-management, #organization, #non-fiction
The Elements of Style
- William Strunk Jr.
- #writing, #communication, #reference, #classic
On Writing Well
- William Zinsser
- #writing, #communication, #craft, #non-fiction
Resonate: Present Visual Stories that Transform Audiences
- Nancy Duarte
- #communication, #presentation, #storytelling, #non-fiction
slide:ology: The Art and Science of Creating Great Presentations
- Nancy Duarte
- #communication, #presentation, #design, #non-fiction
Talk Like TED
- Carmine Gallo
- #communication, #presentation, #speaking, #non-fiction
The Presentation Secrets of Steve Jobs: How to Be Insanely Great in Front of Any Audience
- Carmine Gallo
- #communication, #presentation, #speaking, #biography

Finance/Business Cases

Too Big to Fail: The Inside Story of How Wall Street and Washington Fought to Save the Financial System from Crisis – and Themselves
- Andrew Ross Sorkin
- #finance, #crisis, #economics, #non-fiction, #audiobook
The Big Short: Inside the Doomsday Machine
- Michael Lewis
- #finance, #economics, #crisis, #audiobook
The Smartest Guys in the Room: The Amazing Rise and Scandalous Fall of Enron
- Bethany McLean
- #business, #finance, #scandal, #non-fiction, #audiobook
Cable Cowboy: John Malone and the Rise of the Modern Cable Business
- Mark Robichaux
- #business, #biography, #telecommunications, #non-fiction, #audiobook

About

Sun, 31 Aug 2025 07:20:31 -0700

Personal Summary

When I’m not tackling security challenges, you’ll find me embracing life’s adventures as a husband and father to two young kids. My biggest passion is aviation—there’s nothing quite like firing up our Beechcraft Bonanza for a cross-country adventure or a quick hop to Friday Harbor for ice cream with the family, or down to Oregon when we’re craving some In-N-Out Burger.

As Treasurer for the Bremerton Pilots Association, I’m committed to inspiring the next generation of aviators and helping talented young people pursue their dreams through our scholarship program. When I’m grounded, I enjoy tinkering with my home lab and diving into networking projects—because apparently I can’t escape technology even in my spare time.

Whether I’m at 8,000 feet or knee-deep in router configurations, I’m always looking for the next challenge and opportunity to learn something new.

Professional Summary

I’ve spent my career at the intersection of engineering, product, and security, often working all three functions at the same company. That shapes how I approach the work: I know why engineering teams deprioritize security, because I was one of them, and why product teams resist slowing down for reviews, because I ran one.

My conviction is that security is an engineering discipline, not a compliance function. In practice that means writing Python to automate evidence collection, building unified control frameworks that satisfy multiple compliance standards at once, and designing AI governance that extends existing security controls instead of standing up a parallel bureaucracy.

Today I serve as Chief Security Architect at Alteryx, the only individual contributor on the CISO’s direct staff: no direct reports, full strategic scope. My job is making sure security moves at the speed of the business, not the other way around. I write about security leadership, product security, GRC engineering, and AI governance here, and I’ve appeared on the CISO Series podcast.

Core Competencies

Security Leadership: Product Security, Application Security, Cloud Security, DevSecOps
GRC Engineering: Compliance automation, unified control frameworks, evidence collection as code
AI Governance: Agentic AI security, non-human identity, AI risk frameworks (ISO 42001, NIST AI RMF, OWASP Agentic AI)
Identity & Access Management: SAML, OAuth, OpenID Connect
Cloud Platforms: AWS Security Specialty, Multi-cloud Architecture, Container Security
Compliance & Governance: SOC 2, ISO 27001, PCI DSS, HIPAA, NIST Frameworks
Programming & Architecture: C#, Java, Python, System Architecture, REST APIs
Leadership & Mentoring: Team Building, Cross-functional Collaboration, Executive Communication

Professional Experience

Alteryx - Chief Security Architect

January 2020 - Present

Current Role: Chief Security Architect, the only individual contributor on the CISO’s direct staff. No direct reports, full strategic scope, focused on making security move at the speed of the business.
Program Building & Leadership: Joined as one of the first product security hires embedded in engineering and grew the function to full SSDLC coverage, OWASP ASVS adoption across the product portfolio, a production PSIRT, and threat modeling standards. Previously led teams of 15+ across multiple continents spanning Product Security, DevSecOps, Security Architecture & Engineering, and Vulnerability Management.
Product Security Innovation:
- Built a custom remediation tracking tool that improved security issue closure rates by more than 60%
- Developed comprehensive security design patterns for eliminating hard-coded encryption keys and secure credential handling
- Performed extensive threat modeling and security consultation across all Alteryx products
- Built automated test frameworks for OWASP ASVS L1 requirements
- Created golden container images and automatic update processes for Go, NodeJS, Java, nginx, and Python
Compliance & Standards:
- Led product and engineering efforts to achieve SOC 2 Type II, ISO 27001, and PCI compliance
- Developed and implemented Secure Software Development Lifecycle (SSDLC) aligned with OWASP ASVS
- Established Application Security and Logging Standards
Customer & Business Impact:
- Partnered with Fortune 500 customers to address security requirements
- Developed security use cases within Alteryx products for vulnerability management and firewall rule review
- Streamlined sales processes by delivering precise security responses and minimizing obstacles
Incident Response & Risk Management:
- Shaped Product Security Incident Response (PSIRT) process
- Led incident response for critical vulnerabilities including Log4Shell
- Managed security aspects of M&A activities

Slalom Consulting - Solution Architect (Cloud, DevOps, and Security)

February 2018 - January 2020

Practice Development: Established Security and Risk Services sub-practice in Denver market, serving as model for global Slalom offices
Client Engagement: Led engagements across telecommunications, software, consulting, higher education, government, and food & beverage verticals
AWS Security Expertise:
- Built PCI-compliant AWS Fargate environments
- Designed new AWS PCI environment for credit card manufacturer
- Developed home surveillance streaming integration for major telecommunications company
Framework Implementation: Leveraged NIST 800-53, HITRUST CSF, and ISO 27000 series to align organizations with secure practices
Knowledge Sharing: Presented security talks at BSides, Denver Modern Web, and OWASP chapter meetings
Training Development: Created internal training on Defense in Depth, AWS Security Automation, Container Security, IAM, OSINT, and password security

ProofID (Ping Identity & SailPoint Professional Services) - Principal Security Architect

November 2015 - February 2018

Technical Leadership: Lead technical consultant specializing in Identity and Access Management architecture and implementation
Enterprise Solutions: Engaged with 5-10 Fortune 2000 clients weekly providing end-to-end IAM services
Product Innovation: Developed Password Recovery Module Plugin for PingFederate, later acquired by Ping Identity and integrated into core product
Standards Expertise: Deep specialization in SAML, OAuth, OpenID Connect, and SCIM protocols
Comprehensive IAM Knowledge: Expert across full technology stack including PKI, DNS, firewalls, load balancing, disaster recovery, and SIEM integration
Risk Management: Owned risk assessment activities including source code scanning, vulnerability scanning, and penetration testing

K2 - Software Engineering Manager

September 2014 - November 2015

Engineering Leadership: Led high-performing software engineering team as engineering manager, product manager, and scrum master
Process Optimization: Developed and enhanced processes to optimize delivery of high-quality software with increased efficiency
Product Lifecycle Management: Oversaw complete product lifecycle from roadmap creation to release management
Global Collaboration: Worked closely with local and global product, business, and engineering units

AIM Consulting Group - Senior Software Engineering Consultant

June 2014 - September 2014

Application Modernization: Led redesign, maintenance, and optimization of core business applications for hardware integration company
DevOps Implementation: Spearheaded DevOps initiatives including TFS upgrades, gated check-ins, and continuous build/deployment for Windows services and web applications
Architecture Design: Executed comprehensive redesign using n-tier approach with REST services and dependency injection
Quality Assurance: Ensured code quality through documentation, unit tests, and integration tests

HOSTING.com - Technical Lead, Engineering

October 2012 - June 2014

Architecture & Performance: Led database design and product architecture with performance-centric approach using dependency inversion and fault tolerance principles
Technology Stack: Proficient in product development using Kendo, C#, jQuery, and Microsoft Entity Framework ORM
Security Projects: Created Windows PCI Compliance scripts for server operating systems
Infrastructure Innovation: Orchestrated transition from pull-based to push-based architecture and explored ElasticSearch implementation

Seros - Security Engineer

June 2011 - October 2012

IAM Specialization: Security engineer specializing in Single Sign-On implementations, Federated Identity Management, and Password Management
Customer Engagement: Dedicated consultant with weekly travel to customer sites across the United States
Product Extension: Extended PingFederate to meet specific customer requirements and designed SSO integrations
Comprehensive Security: Expertise across network architecture, systems hardening, penetration testing, business continuity, and regulatory compliance (HIPAA, PCI DSS)

Colorado State University - Web Application Developer

November 2006 - May 2011

Career Progression: Advanced from IT help desk intern to primary web application developer for central IT department
Leadership Experience: Managed sub-domain within Active Directory forest and supervised 25+ employees operating university computer labs
Technical Development: Specialized in C# ASP.NET web application development
Mentorship: Both received mentorship from university professionals and provided mentoring to others

Certifications & Professional Development

Cloud & Security Certifications

AWS: Security Specialty, DevOps Engineer Professional, Solution Architect Professional, SysOps Administrator Associate, Solutions Architect Associate, Developer Associate
Ping Identity: PingDirectory Instructor, PingAccess Instructor, PingFederate Instructor, PingFederate Administrator
Security: Certificate of Cloud Security Knowledge (CCSK)
Data & Analytics: Alteryx Core Certification, Trifacta Data Deputy, Trifacta Data Wrangler
Product Management: Pragmatic Institute PMC Level I

Leadership Development

Center for Creative Leadership - Maximize Your Leadership Potential
Alteryx Emerging Leaders Program (Mentor)
Information Security Department Shadowing Program

Notable Achievements & Recognition

Awards & Competitions

1st Place - Front Range OWASP Conference Secure Coding Competition
3rd Place - LocoMocoSec Conference Secure Coding Competition
Nominated - Alteryx Xcellence Award

Key Accomplishments

Team Leadership: Managed teams of 15+ across multiple continents with direct reports in Product Security, DevSecOps, and Security Architecture
Hiring & Development: Interviewed 60+ candidates, hired 7 direct reports, facilitated 3 promotions within organization
Process Innovation: Transitioned team to Kanban methodology improving work tracking and reducing dropped items
Industry Engagement: Delivered presentations at internal and external forums on security aspects of product suites
Customer Impact: Successfully addressed security requirements for Fortune 500 customers including major financial institutions and healthcare organizations
Compliance Achievement: Successfully led organizations through SOC 2 Type II, ISO 27001, and PCI compliance audits
Mentorship: Active mentor in multiple programs providing guidance to early-career employees

Professional Feedback Highlights

“You lead by prolific example and aren’t afraid to get your hands dirty.” - Ole Craig

“Matt works to advance all of our team missions. He builds high quality relationships with staff, peers and executives. Matt is highly trusted throughout the organization which is why he is very effective.” - Matt Wilson

“Thank you for maintaining an open door policy for all things product security… The outcome is faster, safer changes being made to the platform.” - Trevor Harris

Technical Expertise

Security Domains

Application Security (SAST, DAST, SCA)
Cloud Security Architecture
Container & Kubernetes Security
Vulnerability Management
Incident Response & PSIRT
Threat Modeling
Security Awareness Training

Development & Architecture

Languages: C#, Java, Python, JavaScript
Frameworks: .NET Framework, ASP.NET, Entity Framework, Spring
Architecture Patterns: Microservices, REST APIs, Service-Oriented Architecture
DevOps: CI/CD, Docker, Kubernetes, Helm, Infrastructure as Code

Compliance & Standards

Frameworks: OWASP ASVS, NIST 800-53, HITRUST CSF, ISO 27000 series
Regulations: SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR
Methodologies: Secure SDLC, Risk Assessment, Audit Management

Education & Continuous Learning

Formal Education

Colorado State University (2006-2011)

Professional Memberships & Associations

OWASP Foundation - Lifetime Member
Information Systems Security Association (ISSA)
OpenID Foundation - Professional Member
Aircraft Owners and Pilots Association (AOPA)
American Bonanza Society - Aviation Professional
Bremerton Pilots Association

Community Involvement & Volunteer Work

Junior Achievement - JA in a Day Teacher
Junior Achievement - STEM Career Mentor

Continuous Professional Development

Regular participation in security conferences and industry events
Active contributor to internal training programs and knowledge sharing
Ongoing professional certification maintenance and advancement
Mentorship and leadership development programs

Search

Wed, 01 Jan 2025 00:00:00 +0000

Pages on Matt Goodrich

The Identity Spine

The Six Threads

Every Post, and What It Draws On

Podcasts

Security/Cybersecurity

Aviation

Business/Entrepreneurship

Economics/General Interest

Book Reviews

5 Star

Technical/Engineering

Leadership/Management

Business/Entrepreneurship

Security/Cybersecurity

Aviation

Personal Development

4 Star

Technical/Engineering

Leadership/Management

Business/Entrepreneurship

Security/Cybersecurity

Product Management

Personal Development

Aviation

Finance/Business Cases

3 Star

Technical/Engineering

Leadership/Management

Business/Entrepreneurship

Personal Development

Finance/Business Cases

Books Up Next

Technical/Engineering

Leadership/Management

Business/Entrepreneurship

Aviation

Security/Cybersecurity

Product Management

Personal Development

Finance/Business Cases

About

Personal Summary

Professional Summary

Core Competencies

Professional Experience

Alteryx - Chief Security Architect

Slalom Consulting - Solution Architect (Cloud, DevOps, and Security)

ProofID (Ping Identity & SailPoint Professional Services) - Principal Security Architect

K2 - Software Engineering Manager

AIM Consulting Group - Senior Software Engineering Consultant

HOSTING.com - Technical Lead, Engineering

Seros - Security Engineer

Colorado State University - Web Application Developer

Certifications & Professional Development

Cloud & Security Certifications

Leadership Development

Notable Achievements & Recognition

Awards & Competitions

Key Accomplishments

Professional Feedback Highlights

Technical Expertise

Security Domains

Development & Architecture

Compliance & Standards

Education & Continuous Learning

Formal Education

Professional Memberships & Associations

Community Involvement & Volunteer Work

Continuous Professional Development

Archives

Search