DeveloperWeek 2020

Building or maintaining software systems that are agile while adhering to the principles of Privacy by Design is the engineering challenge faced by every eng team as we move to a fully regulated future.

In this presentation we’ll walk through a clear, concise set of steps from a technical standpoint to insert privacy at the core of any tech stack, whether for existing systems already in wild or building from scratch. This methodological approach to privacy works through the key criteria of privacy design but also regulators requirements in a format and language suited to the needs of engineers.

That is we have distilled the regulations and business requirements of data privacy compliance into technical specifications and a clear workflow of steps and systems that can be implemented to automate and minimize friction for engineering teams relating to obligations like:

Data Mapping
Data Subject Request
Data Minimization
Access Control
Impact Assessments
Privacy Policies as Code Stubs
Interopability of Data Requests

This clear, technical workshop demonstrates for security, engineering, devops and product teams how to simply and concretely implement privacy at the core of their roles with minimum friction, maximum compliance and low ongoing effort.

Agile transformation always comes with it's challenges and very often teams think they are "special" and that certain aspects of agile can't or don't apply to them. Learn how to dispel this myth from over 10 years of real world experience transforming very different teams, ranging from a born-on-the-cloud start-up to a 50 year old on-premises enterprise software product team, and just about everything in between. This talk will cover common organizational pain points, how and what agile practices can really make a difference, and how to get even the most skeptical team members on board with the transformation.

By 2025, it’s predicted there will be 55 billion IoT devices and the amount of data in the world will reach 175 zettabytes. While this explosion of connected devices will benefit businesses with access to more data to derive better insights, it’s also putting immense pressure on IT infrastructure. Moving massive amounts of data from devices and sensors to a data center or the cloud introduces latency, bandwidth, connectivity, and cost constraints.

Businesses are turning to edge computing as a strategy to handle this influx of data and applying analytics at the edge to gain actionable insights in real time. Rather than try to bring data to the cloud faster, a more efficient approach is to bring the analytics to where the data is created. While IoT gateways and other “near-edge” technologies bring analytics closer to the source of streaming data, that architecture can create latency and drive up costs.

In this presentation, Rachel Taylor, CEO, Nubix, will discuss the current state of edge computing, explain how today’s enterprise infrastructure is holding back companies from efficiently capitalizing on the tremendous analytics, machine learning, and AI intelligence that can be unlocked from IoT devices, and in technical detail outline the requirements needed to build a true “edge-native” infrastructure.

In a startup’s journey there will be pivots along the way - a change in product focus or business model or customer base or technology choices. These changes always have effects on the product development team but seldom are you able to start from scratch. During this transition, there are many questions to be answered:

- How do you change the product while using an existing platform?
- How do you manage technical debt?
- Do your development processes and team organization still fit?
- Do you have the right people and skill set on the team?

Garett Madole, Co-Founder & VP Engineering of Yonomi, will share his experiences of transforming a team and tech stack from an early stage D2C Smart Home app to an enterprise IoT B2B(2C) platform.

The race to out-innovate one’s competition has led to high performing organizations chasing increased deployment velocities but often ignoring the quality of parts being used to manufacture their applications. It was 2003 when Bruce Schneier (@schneierblog) penned, "Today there are no real consequences for having bad security, or having low-quality software of any kind. Even worse, the marketplace often rewards low quality. More precisely, it rewards additional features and timely release dates, even if they come at the expense of quality."

As nimble organizations deliver new innovations using DevOps principles, adversaries are also upping their game, something we saw in a series of high profile and devastating cyber attacks last year. Adversaries have the intent and ability to exploit security vulnerabilities in the software supply chain - and in some cases plant the vulnerabilities themselves. They have increased scale through automation and improved breach success through precision targeting. If the IT industry doesn’t fight back by doing the same - automating security directly in the DevOps pipeline, then we’ll never be able to win.

The industry currently lacks meaningful open source controls. The most common way to introduce controls is through the application of open source governance policies across a software supply chain. But, when over 5500 IT professionals were asked if their organisation employed open source governance policies, just 63% responded positively. That percentage degraded further when participants were asked if they followed the policy. For those without a DevOps practice just 25% of said they both had an OSS governance policy and adhered to it. Effectively, 75% of those who don’t deploy a DevOps strategy, either ignore policies or don’t have one at all.
Further evidence of the lack of cybersecurity hygiene was revealed by 67% of survey participants who admitted to not having meaningful controls over what open source components are used in their applications.

Modern software supply chains can only operate safely when protected with automated security and quality assessments of these upstream open source components and containers.

This sentiment was echoed in Forrester’s Top Recommendations For Your Security Program (March 2018) where analysts advised, "Automate faster than evil does. If you thought your security team struggled with alert volume — and alert fatigue — then you Manual methods to detect, investigate, and respond to threats will guarantee
failure in the near future."

Key takeaways:

• Real-world examples of how large and small companies are implementing DevSecOps practices in their own delivery pipelines, and increasing developer awareness to risks
• Key insights from the 2019 DevSecOps community report - including the top investments for automated security
• A walkthrough of how security principles have been automated into a CICD pipeline and what standards for implementation are beginning to follow suite
• Why DevSecOps is more than a buzzword, and why it’s vital to protecting your software supply chain
• How automating security of policies makes it harder to ignore

Hiring engineers is a delicate balancing act for any company. On the one hand, you want to maintain the speed and agility that comes from running lean. On the other, you need enough resources to execute against your roadmap and new skills to build your team’s capabilities.

We’ve all felt the strain of not being able to hire fast enough: Developer jobs are still the toughest to fill, with more than 250,000 vacancies projected by 2026, and about two out of three HR professionals say they struggle to fill engineering roles, according to The Society for Human Resource Management. If you’re sourcing talent locally — and particularly if you’re hiring at the senior level — it’s likely you’re competing with the biggest companies on salary, benefits and brand recognition.

You won’t get very far by trying to outcompete these massive companies. Instead, think about changing how you hire. You can scale your team and hire great engineers by expanding your talent pool, rethinking your technical assessments and being intentional about how you match candidates with your team’s culture and needs.

Some of the greatest product innovations began with the question: “You know what would be cool? If we could just...” 
In a disruptive landscape, where change is rapid, and inevitably upends the status quo, product, engineering and R&D teams are always bristling with new ideas. 
Sometimes good ideas are born from sudden flashes of insight or discovery; if they seem particularly promising, developers and engineers are quick to apply lean startup principles to quickly prototype and validate them. 
But what happens next? Do we keep building on them? Do we rework them? Do we discard them so that they join the growing pile of other aborted ideas?        
These are hard questions; and, to answer them, one must consider a slew of factors: Opportunity costs, resource allocation, technical considerations, buy-ins from senior management, among other serious considerations that stand in the way.  
Join Conor Delahunty of Trulioo as he calls upon his own challenges and experiences in building something entirely new while working within the constraints of existing product roadmaps. This talk will cover: 

• Balancing ideas with expectations around delivering actual code and features 
  
• Wanting to do a lot, but being unable to execute on pace 
  
• Sustainable Prototyping: Throw-away vs build-on-top
  
• Ensuring a continuous feedback loop
  
• Acting on new ideas without burdening the rest of your team with extra work
  
• Turning problems and obstacles into new learnings 
  

Conor Delahunty: An R&D Product Manager at Trulioo, Conor enjoys tinkering with technology to build easy solutions to complex problems. At Trulioo, alongside integrating APIs from across the world, he’s also responsible for the development of the Trulioo developer hub and expanding its developer ecosystem.

Creating amazing developer experiences requires more than just providing reliable tools and services - it requires a laser focus on the developer needs and a commitment to improving developer productivity. Embracing DevOps, developers are required to operate in the infinite loop going through the various phases of software development lifecycle. For this, they need first-class tools.

We tell the story of developer tooling starting with application lifecycle "paved road" automation and its evolution to an an extensible tool platform for seamless, consistent, flexible, accessible and intelligent developer support. We discuss pluggable tool architecture that enables federated tool development and distributed ownership and deployment model.

In this talk you will learn how to:
- improve developer experience with automation
- create the "paved road" for highly productive experience for each stack
- create delightful UI and CLI tool experiences
- create a tool platform with an extensible model and clear ownership
- add intelligence to tools for higher productivity
- apply our experiences to your environment

61% of c-suite executives believe that lack of software developer talent is a bigger threat to their business than access to capital. What if this threat can be mitigated with a more predictive interviewing program?

Through analysis of thousands of technical interviews and building interviewing programs that have influenced nearly 60,000 technical interviews, Karat Head of Solutions Engineering Shannon Hogue Brown has uncovered practical approaches to the hiring process that dramatically increase signal and improves onsite to offer rates.

In this presentation, Hogue Brown will share practical steps for:
- Establishing your hiring bar
- Interviewing with consistency across multiple engineering sites
- Developing interview questions capable of accurately predicting onsite performance