In July 2011 I took what felt like a big chance and a detour to lead a large and complex security upgrade for a large company. The project included replacing firewalls, re-ip’ing  hundreds of servers, implementing updates to hardening standards, updating application logging, and a lot more. A ‘lot more’ doesn’t really begin to describe the scope – it touched every facet of IT. My knowledge of technology came in handy, but I didn’t do any of the work. Nor did I manage the project in the sense of being a project manager (I had four of those to help with that part). My role was to deliver the final product on time – making sure goals were clear, resources found, and that the work was done. It was work that came to me because of my network, someone I had worked with in the past that knew I was good at sweating the details and pushing things to completion.

It was an intense effort for the first nine months of the planned twelve month engagement. I learned a lot about security, a lot about large companies, a lot about everything. It was the ‘industrial strength’ challenge I had been craving, the one that would integrate and extend skills I had been acquiring over the previous few years. The original plan was to spend a couple months wrapping up the minor left over items,but there was more than expected,and I ended up staying longer – this week is my final week on the effort, 22 months after the start.

It was longer than I planned. Looking back the ‘extra’ time was almost as valuable as the first nine months. It was a chance to see things run at a normal pace, to explore and understand what large companies were good and not good at, and to learn some more lessons about the power of relationships and how hard it can be to build them (making them all the more valuable).

It reminds me of how I’ve changed and continue to change. It wasn’t just work for me, it was a chance to learn – it’s interesting how much (or how little) you can learn if you’re trying to learn. It’s learning by observing and thinking, not as easy as classroom learning, but far more diverse in the results.

Cataloging lessons learned and mistakes would make for a good sized list, too lengthy (and too client centric) to list here. I’ll write down just a few that I think matter the most:

• Fully understand “Done”. That doesn’t mean you have to understand or document it all on day 1, but you have to keep driving out the gray until you can clearly define done.
• Relationships matter. Build them or perish.
• Decide early if you’re going to adapt to the culture or change it. Both are valid strategies, pick the wrong one and you’ll suffer!
• Transparency (translucency) is armor, but distinguish between what needs to be done publicly vs privately (and back channel)
• Be willing to compromise to win – you don’t get style points, all they will remember is if you won or not
• Fight for every day. Lose hours, not days, not weeks.

It has been a great experience, but it’s it time to move on. Over the past two months as I’ve worked towards wrapping up and doing a hand off to the person who will own this going forward I’ve been planning to take the month of May off. I haven’t taken two full weeks off in almost four years and the idea of a full month off followed by a week trip to Philadelphia and DC is…enticing, intoxicating, something – it sounds good!

Tomorrow I’ll post some notes about what I think I might do next.