“I have three disciplines that I'll call out in every one of our platforms or products. One is automation. Two is insights, monitoring/metering. The third one is release, being able to get whatever it is to production. Those are three disciplines that all teams need to have built in to them. Security, to me, is just another discipline.”
On-Boarding Capabilities into DISA
Brandon Holcomb is worried about scaling IT projects at large enterprises. As head of infrastructure at Equifax, and previously at Home Depot, Holcomb has led large, transformational projects while concentrating on the ability of the new systems to scale. He has discovered that most issues are created by lack of communication between team.
In this “Innovator’s Journey to DevOps”, we talk with Brandon about the interpersonal side of DevOps, his focus on leading with integrity and what he hopes to leave as his legacy.
Mark Miller: You sound like you were raised in Alabama.
Brandon Holcomb: Born and reared in North Alabama, Muscle Shoals. Sheffield is my hometown, but Muscle Shoals, where all the music and everything came out of is where I grew up and went to Auburn and then spent a short time in Atlanta, about 6 years, and then moved back.
Mark Miller: When you say Muscle Shoals that reminds me, you’ve got a music studio up there too.
Brandon Holcomb: Muscle Shoals Sound. It's in my home town of Sheffield. That's right. Apple, I think, is currently restoring it back to it's grandeur, so we'll see how it works out.
Mark Miller: Raised in that type of environment, basically in rural Alabama, how did you get started with technology as a kid?
Brandon Holcomb: My dad bought me a Tandy, I can't even remember the model, and I taught myself basic as a child. He took continuing education courses over at the college in Florence, University of North Alabama, and learned DOS and Ascii.
I first started out just building Ascii things at the command line. He taught me Basic and by the time I was in 7th or 8th grade they had one computer in the school that was a Mac Apple II, I believe. Then I got into high school and we got our first Windows PC in the library and I became kind of the technology guru, or the computer guy.
I'd been around them all along. While everybody else was playing the Nintendo, I was playing games on my computer or doing things to build things on my computer. I've always been a tinkerer in technology and it just fit. I was going to go follow my dad as a physician, didn't do it, and decided to go into technology. I didn't know how much I liked it until I got into it. That's how it all kind of came around.
Mark Miller: Is that what took you to Auburn?
Brandon Holcomb: What took me to Auburn was ... Tradition runs pretty deep in the SEC. It borders religion sometimes. My dad had gone to Auburn. My uncle played football here in the 70s. He was all SEC offensive lineman. My grandfather, my dad's father, had actually gone to Auburn but got into World War 1 before he could graduate, but a long line of Auburn. My brother and my sister both graduated ahead of me from Auburn. It was kind of just that's where you go. My dad said "You can go anywhere you want as long as it's Auburn." That was how it went.
I walked on to football team and was blessed to have 4 years with them, got out in 98, and hit the professional career to Atlanta with Home Depot when I first got out.
Mark Miller: When you say you hit Home Depot, what were you doing for them?
Brandon Holcomb: I was building their store systems. I would say it was the best foundation for my career I could imagine, looking back on it, because they taught things like configuration management and quality, and all of that built-in.
In retail, you can't push code to 2,000 stores without knowing that it's going to work the same way every time. I think they were actually ahead of themselves when it came to provisioning and deployment. Everything had to be automated. From the time it left me, as a developer, all the way through to production, it was my responsibility to make sure it was good. It never touched a human hand again after it left my integration tests. QA was automated, pre-production, and the pilot, and ultimately all of production was done in automated fashion.
Mark Miller: You're saying that was in the late 90s?
Brandon Holcomb: It was developed in Informix 4GL. It's a great packaging system. It might still be in use today. It should be if it isn't. It was fantastic. It just taught us a lot about ownership. It taught you a lot around the integrity of code and then also the impact of a mistake, but you owned it. I started in '98 and I'd say that within 6 weeks I was writing code.
Mark Miller: Most people would not think of Home Depot as a technology company.
Brandon Holcomb: I would say that all retail is technology and all finances are technology companies.
Mark Miller: Yes, but in 1998 businesses were starting to come online. It was a transitional period. You guys must have been really ahead of the curve.
Brandon Holcomb: I've not been around a more talented group of people. I would say Equifax is up there with what Home Depot had. That's why I said I don't think foundationally I could have been put anywhere better.
I was the 400 and something person hired into IT at Home Depot at the time and when I left there were over 2,000 people, just in IT. We had a build shop from the very beginning. Not a buy shop. It was build everything from scratch, own the supply chain up to IT at Home Depot, and those guys did a really good job. There's a guy by the name of Rick Dulin, who built this whole packaging structure that he called his IT toolbox. The software guys were fantastic there. A lot of them are still there actually.
We just had a phenomenal group at the time to do a lot of this amazing technology that Home Depot benefited from. They could grow from there. We went from 800 to 2,000 stores in a 4 or 5 year period. Technology enabled that.
Mark Miller: When did you go to Equifax?
Brandon Holcomb: In 2012. I spent eight years doing R&D work for United States Air Force when I left Home Depot and took a side road through there which kind of introduced me to this whole DevOps thing. In 2012 I left that post and did a little bit of work outside of the DOD for a few months before I started with Equifax. It was the same company, just doing it outside the DOD. It was a good transition back into corporate life.
Mark Miller: Do you remember when you first heard of DevOps?
Brandon Holcomb: Yes, actually. I think I lived it.
Looking back on it I saw all those foundational elements and it's one of those things, like when you buy a red car you start seeing a red car everywhere? When somebody put a name with it you started to see these things as they started to emerge and come about.
I gave a talk at an Air Force thing in 2012 trying to explain DevOps to the world, or to the DOD side of the house. If you look back, what we were trying to do, was create organizations that force other organizations to talk to one another. I think Seth Godin calls it The Connector, the personality type that you need in order to make things move and go.
That connector that we built in organizations and teams, is kind of like what DevOps is really about except you were trying to force two teams to come together. When I was at the Air Force, they stood up this thing called the test and development range. Everything's a range in the Air Force or in the DOD, where they test things. They were saying "We’ve got this production system, we’ve got all of these developers, so production runs at DISA and developers all run back here and all those program units. We need to create this place where we create a mesh point between these two organizations so that they communicate and talk to each other effectively."
The whole DevOps thing came about because you don't really want to create another organizational silo that sees the needs of all sides. You want to create that empathy across both sides of it. While the organizational unit works effectively for some time, it is not scalable. It doesn't grow throughout the entire organization and create a culture. Ultimately, it will become a silo in and of itself and forget its identity and where it should be. That's why you have to start with the whole culture thing, as they talk about with camps.
Long story short, I remember back around 2010, I started reading about DevOps and learning about it, and understanding it. It was really the life I was leading , "How do I continue to scale this model where we're the mesh point between two worlds that don't really care about each other's problems? How are we solving it?” We were creating a whole business just around solving people's problems, the lack of ability to get to production. That really wasn't enabling a better product. That was just fueling the growth of an organization.
Mark Miller: One of the things I'm running up against is when we use the term DevOps, it almost isolates security into a silo by itself. Where does security fit into your picture of DevOps?
Brandon Holcomb: Personally, I think it should be a part of every team. I view that security should be built into all products and every team should have a portion of it. Centralized security is needed. This is a discipline problem in my mind. We have these same things in terms of other areas, as well.
I'm an infrastructure guy at Equifax. I'm over our engineering efforts. I have three disciplines that I'll call out in every one of our platforms or products. One is automation. Two is insights, monitoring/metering. The third one is release, being able to get whatever it is to production. Those are 3 disciplines that all teams need to have built in to them. Security, to me, is just another discipline.
While it needs someone to curate and to be the owner and director, and set standards, each team really needs to invest in that discipline in order to build it in. Otherwise, they get to the scale problem again. You just get to a tower that says this is what you shall and shall not do, when you really need someone to verify that what you've done is actually effective and serves what your intent was going to be, and actually accomplishes that with code or with infrastructure componentry, or whatever it might be.
That's the way I look at it. It is the only way we can solve it going forward. I won't say that we're there. Our security partners are great at trying to keep up with it, but just as everyone else is I'm sure, you're really strapped for talent in that space. It is a very hot industry right now. It's hard to keep up, to hire enough people to do the job. To me, I think you've got to start instilling it in every one of the groups as a discipline.
Mark Miller: You mentioned the need for more talent in the industry. What are you looking for in somebody you would want on your team?
Brandon Holcomb: I'm looking for skills obviously, technical skill, as much as you can with relative context. Sitting in Auburn, where we are, we partnered with the University here, so I hire a lot new college graduates.
It varies greatly from someone with 3 to 5 to 7 years work or more experience versus a new college hire. There are few traits you're looking for.
In technology, we say that curiosity is a sign of intelligence. The reality is that we're in a place now where change is happening at a break-neck pace. I look for people's tolerance for ambiguity and try to test that as much as possible. I consider their ability to buy in and become a good team member, which is probably the most obvious key. I ask certain questions about their ability to be a part of a team and understanding that because team-based structure is what we need.
The most interesting metric in the DevOps report, to me, that came out last year was around the number of deploys per day per developer to see how you grow and scale teams. We have to become a learning organization, so in order to do that we have to be able to bring on talent. You have to buy in to those things.
My team always hears me say "How we work is just as important as what we build." I need people who are going to buy in. I look at people who have team experience and who, when they talk about their past, how they talk about themselves and how are they talking about their teammates. How did they bring them up, because a lot of times in the academic setting it's really half the team checks out and the rest of the team does the rest of the work.
The same thing is true in the corporate world, too. How do they try to improve their teams. Maybe they were on a losing team some of the times and they needed to it figure out. What was their attitude? How did they try to combat it? What were their thoughts as they were going through that and what did they learn out of that?
Then there's the obvious, just logic and intelligence. You try to gather as much as you can from that, but really aptitude and attitude will get you a long way. When I'm looking at it, that's what I'm looking for.
From my perspective, obviously, the technical skills, if they have specific needs we're going to test that pretty deep and pretty heavy. I do like differentiated skills. I like the generalists, people who have done a lot of different things. I have fair number of co-developers that now work in infrastructure. I'm being one of them, so I like the fact that you have varied experiences in technology and that you get to see a big picture plan. As you get to the leaders, you really want some people who can really buy into the big picture and understand how important it is for what you're trying to do.
Mark Miller: When you're looking back on what you've accomplished so far in your career, what are you most proud of?
Brandon Holcomb: I'm most proud of that the few areas I've left, the two previous jobs that I've left, that I left well. What I mean by that is, I feel like that either the people I left behind are capable to take it and make it better, or that I've trained them.
I think I'm most proud of the fact that I've left readers in my wake of wherever I've gone or left. I've been able to build people up and either stretch them in terms of technical or whether it's just personal. I feel like that there's more than enough capability to be there. I've made myself dispensable. I know that that may not sound right, but that's what I'm proud of, is that I can leave something where people who used to maybe be below me or reporting to me, could step right into my shoes and fill the gap without really much of an impact. I think that's a sign of you're doing some things right.
Mark Miller: Looking forward then, as you think about moving forward in your career, what would you like to leave as a legacy? Is the ability to teach people to do it themselves, is that your legacy?
Brandon Holcomb: I would say that I did everything at a very high level, in terms of quality. I give everything I have when I'm at work and at home too. I would say that I do it at a very high level and at very high quality, but my legacy really is what I do at home and how I carry myself on and off the field.
I guess you could say it in athletic terms: I'm honest, I'm straightforward with everyone, and I give people the respect that's due from that prospect. I hope my legacy is that I lead with integrity and that I produced operationally excellent results in terms of a technical mindset.
But really leading with integrity would be the thing that I would hope my legacy is.
Mark Miller: When I was talking to James Wickett in Austin, he said his legacy and what he is most proud of is his two kids. It was kind of like what you said. When you go home, that's what your legacy is.
Brandon Holcomb: That's right. I heard a guy say this, a pastor in Atlanta, he said, “Never sacrifice a job that you can uniquely do for a job that someone else will do.” No one else can do my job at home. Someone else will do my job at Equifax one day.
DevOps is such a varied, diverse group of people. It's amazing to be around that community because everyone's leaning toward the same goal. A lot of the stuff we talk about is the same repetitive stuff. We keep talking about, quality, velocity, all the different things from the technical aspect, but I think that the things that Josh Corman had talked about previously around having the safety culture mentality goes to the integrity side of the house.
We need to change the game with being vulnerable but not being weak. The "I don't know" part of this is what's so great about the community. People will say, “I don't think I've arrived at anything here, but I can tell you it's getting much better. Here are the metrics that we're now using to do that.” Whether it's Damon Edwards that I talk to or John Willis, or you, or I talked to the guys at Target, or whoever, who give of their time to say "Hey, we're all in this journey together."
I think that's the thing that I would say out of DevOps. We're all in it to help each other get better and learn from one another. That's something that's pretty special about what this movement is really forming and shaping to be.
Mark Miller: It's interesting you talk like that, because I truly believe that too. A lot of us hear about Damon Edwards and John Willis and Gene Kim and Josh Corman, and over in Europe, Patrick Debois and Kris Buytaert, but a lot of the activity is going on in one-on-one relationships where people are teaching each other, and I think you're on the right track.
Brandon Holcomb: You don't have to be up on a stage to make change, in fact the change really happens off stage. Getting people a place in the corporate environment to be vulnerable is hard, because that's not what we've always rewarded.
Vulnerability is not weakness. That's what people need to understand. We talk about how great things are, but if you pull back the cover a little bit, you'll see something different. That's what I tell everybody about the Phoenix Project when they read it. They're like "Oh, that’s depressing at times."
The good thing about the Phoenix Project is if you can write a book about it and everybody thinks it's accurate, you're not the only one with that problem. You get a chance to meet a bunch of other people who have the same type of issues who get to solve it in their various companies and ways that they can do it.