The work, in detail.

ERP & system migration oversight

Owning a CRM implementation end to end: 70% efficiency gain, 25% inventory reduction

The situation

A global technical-support operation was running on tooling that had stopped fitting the business. Support history lived in scattered systems, and the customer-facing experience still depended on picking up a phone. Inventory and shipping decisions were being made without a reliable operational picture underneath them. Support volume was high enough that a fragmented toolset could absorb it only by burning staff time.

Leadership agreed a new CRM was needed. What did not exist was someone to own the thing from requirements through the point where people actually used it.

What I did

The implementation ran through the complete development lifecycle under single ownership, with no handoff between phases.

Requirements. The requirements came straight from the people doing the work in support, logistics, and inventory. Instead of working from a feature wishlist, the focus was on the specific workflows that cost time and forced decisions to be made blind. Each costly workflow mapped to what the platform had to do to fix it, so configuration answered a documented need rather than a guess.

Build and deployment. Configuration and rollout stayed held against the original requirements as scope pressure appeared. Integration with existing systems was in scope from the start rather than a phase-two problem.

Adoption. The customer-facing self-service portal built on the platform was the piece that determined whether external users experienced the change as an improvement or an obstacle, so it got dedicated ownership and administration through launch.

Administration continued after go-live, which meant the person who understood the original requirements was still present when the first real problems surfaced.

The result

• 70% expansion in operational efficiency through process automation
• 20% reduction in shipping times
• 25% inventory reduction
• A customer-facing self-service portal that shifted routine transactions out of the support queue

Standing up the IT function

From no IT function to 98%+ CSAT: standing up operations at a multi-site manufacturer

The situation

A multi-site manufacturer was operating without an internal IT function. Support ran through an external MSP with no internal ownership, which meant no one inside the company was accountable for whether the arrangement was working, whether the spend was right, or whether the infrastructure could support where the business was going.

There was no ticketing system. Requests arrived by whatever channel the requester preferred. Onboarding and offboarding happened ad hoc, which in a regulated industry is a compliance exposure and not merely an inconvenience.

I was brought in to build the function.

What I did

Security and identity. NIST identity and access management standards were implemented organization-wide using Google Workspace IAM tooling, paired with security awareness training targeted at the behaviors that actually produce incidents.

Infrastructure. The physical foundation came next: network integration across sites, fiber internet with failover connections, and secure backup systems sized against actual business continuity requirements. None of the process work matters if the network drops during production.

Service management. Jira Service Management went in enterprise-wide, not only IT, but HR, Facilities, and Finance. Extending the platform beyond IT is what turned it from a ticket queue into the organization's operational backbone, and it meant process improvements compounded across departments rather than staying siloed.

Governance. The organization had no AI use policy, so I developed one, a framework for responsible adoption across both end-user and business application contexts, set before ad hoc usage set precedent.

Vendor model. The hybrid arrangement of internal team plus external MSP ran through a single point of accountability: procurement contact, contract owner, and the person keeping the model aligned to regulatory and compliance obligations.

Lifecycle. The full onboarding and offboarding process, provisioning, access management, asset tracking, equipment recovery, was built as consistent and auditable procedure across all locations.

The result

• Workflow efficiency improved up to 33% through process automation and ITIL-aligned service design
• 98%+ CSAT sustained across four years, not a launch spike
• 38% reduction in phishing risk exposure following the security awareness program
• Auditable onboarding and offboarding across every site
• A documented, staffed IT function where none had existed

Process automation

A decade of paper and Excel, rebuilt: handling 33% faster, corrections from multiple a day to one every two weeks

The situation

A manufacturer's quality assurance process ran on paper forms and Excel spreadsheets, and had for roughly ten years. Product moved through packing with QA documentation captured by hand, transcribed later, and reconciled when discrepancies surfaced, which was constantly. Corrections were running at multiple per day.

In a regulated manufacturing environment, QA documentation is a regulatory artifact, not internal paperwork. Error rates at that level are a compliance problem before they are an efficiency problem.

The process had persisted because it worked, in the sense that product shipped. Nobody had quantified what it was costing.

What I did

The organization was already running Jira Service Management, which I had deployed enterprise-wide. Rather than procuring a QA-specific tool, I built the workflow into the platform people already used.

Mapped the actual process, not the documented one. I worked through what packing staff genuinely did, including the informal steps that existed because the official process did not cover a real case. Those undocumented steps are where digitization efforts usually break.

Designed for the floor, not for the office. The people entering QA data were working with product in hand. A workflow requiring extended interaction with a screen would have been abandoned or worked around regardless of how well-designed it looked in a demo.

Built in validation at entry. Most of the error rate came from transcription and from mistakes caught downstream rather than at the point of capture. Structured entry with validation eliminated a whole category of correction rather than making corrections faster.

Kept it inside the existing platform. No new tool, no new login, no separate training burden, no additional license. Staff were already working in Jira.

The result

• ~33% reduction in per-case packing time
• Error rate from multiple corrections daily to roughly one every two weeks
• QA documentation became queryable rather than boxed
• No new software spend

Google Workspace & Microsoft 365

NIST-aligned identity and access across a multi-site organization, 38% reduction in phishing risk exposure

The situation

A multi-site organization in a regulated industry, operating Google Workspace with identity and access controls that had accumulated by habit instead of being designed with intention. This is the ordinary condition of most small and mid-sized organizations: administrative privilege spread by convenience, access granted and rarely reviewed, departed staff whose accounts still authenticated.

None of that reflects negligence. It reflects a tenant that grew alongside a business without anyone owning the identity plane as a distinct problem.

The exposure is concentrated: an attacker with valid administrative credentials does not need malware.

What I did

Applied a framework instead of a checklist. NIST identity and access management standards went in organization-wide using Google Workspace IAM tooling. Framework alignment matters because it gives you a defensible answer when a regulator, auditor, or insurance carrier asks why these controls. "Industry best practice" is not an answer.

Reduced and protected privilege. Administrative access was scoped to what roles actually required, rather than left at the level convenience had produced.

Built lifecycle into access. Provisioning and deprovisioning became part of onboarding and offboarding procedure rather than a separate task depending on someone remembering. Auditable across all locations.

Addressed the human layer. Technical controls do not stop credential phishing on their own, so security awareness training targeted the specific behaviors that produce compromise, and it was measured, not assumed.

The result

• 38% reduction in phishing risk exposure
• NIST-aligned IAM standards implemented organization-wide
• Auditable access lifecycle tied to employment status across every site
• Administrative privilege scoped to role requirements

Service management build-outs

Recovering a drifted service platform: 205 stale accounts closed, automation cut 18% while restoring what was broken

The situation

A mid-sized organization was running Jira Service Management as its operational backbone, handling intake, routing, and approvals for several business functions, not just IT. The platform had been built deliberately and documented thoroughly by the internal team.

And then churn happened, and it went through roughly seven months of undocumented changes without an owner.

On and offboarding started in Jira. An intake form opened a ticket, and the workflow carried it through to the Google Workspace account it was meant to create or close. When the platform drifted, that chain was one of the things that broke, which is where the real exposure accumulated.

What happened in that window is the ordinary failure mode of an unowned platform, and it compounds in a specific order. Changes were made to automation rules without documentation. Those changes did not have the intended effect. Rather than reverting them, further rules were added to compensate, rules correcting rules, until ticket routing stopped working reliably and forms no longer attached or populated as designed. The internal documentation that would have explained the original intent was unshared from the user community, so each successive change was made without a map.

The process consequences followed the technical ones. Tickets went undocumented and unclosed. Onboarding ran late enough that new hires arrived before their accounts existed, and equipment distribution slipped alongside it. Offboarding substantially stopped happening.

I was engaged through an IT services partner to assess and stabilize it, with a budget-constrained scope and prior familiarity with how this class of platform is designed when it is designed well.

What I found

The first visible symptom was volume: roughly 100 onboarding and 100 offboarding tickets sitting open. Most had been worked to some degree but never documented or closed, so there was no reliable way to tell which lifecycle actions had actually completed and which had quietly failed. That gap is what prompted a full user audit, and the audit is what surfaced the rest.

205 terminated employees still had working Google Workspace accounts. Roughly 150 of them sat in the default organizational unit, never suspended, never restricted, fully able to authenticate the moment anyone tried. The remainder were split between properly suspended accounts and an OU named "Offboarding," which the organization used in place of suspension for certain departures.

That Offboarding OU was the finding that mattered. It enforced a two-factor authentication requirement, but 2FA had been disabled on the accounts inside it. A control that was documented as a control, believed to be a control, and was in practice an unlocked door. Accounts in the OU could be logged into with a password alone.

The oldest of these had been idle more than six months.

Automation had grown while functioning less. There were roughly 225 rules when the platform was last under active ownership and roughly 240 on assessment. At least 20 were outright broken. Others fired inconsistently, worse than broken, because inconsistent rules get worked around rather than reported, and the workarounds become invisible process.

What I did

Stabilized before improving. Two priorities came ahead of everything else, and the client agreed the order up front: make the platform route tickets correctly again, and close the open door on terminated accounts. Nothing else was worth doing while automation was misfiring and 205 credentials were live.

Restoring routing and notifications meant reconstructing intent from configuration, determining what each rule was supposed to do, which is rarely what a broken rule appears to do. Rules that had been added to compensate for other broken rules had to be traced to their cause and removed rather than repaired, because fixing a compensating rule preserves the compensation.

Closed the access exposure. All 205 accounts were properly archived and offboarded, and the Offboarding OU's 2FA gap was corrected so the control matched its documentation.

Then rebuilt the lifecycle processes that had failed. With the platform stable, the underlying process problems were addressable:

• Rebuilt onboarding end to end, new intake forms originating with HR, new workflow, so account creation precedes the start date rather than trailing it
• Rebuilt offboarding on the same pattern, making departure a triggered process rather than a remembered one
• Built a separate contractor onboarding and offboarding workflow, distinct from the full-time employee path, because treating contractors as employees with exceptions is how exceptions become permanent access
• Identified and retired nine obsolete workflows, seven in operations, two in HR, that were still running without a current purpose

Made identity data authoritative. Job title and manager are now imported from the HRIS and synchronized to Google Workspace, so the directory reflects the org chart automatically rather than through manual updates nobody owns.

Reduced the automation surface. Between repairing rules worth keeping and retiring rules that were obsolete or purely compensatory, the platform went from roughly 240 rules to 197, 18% below where it stood when the drift began, while doing more than it had been doing on assessment. Fewer rules that work beat more rules that mostly do.

The result

• 205 terminated accounts archived and offboarded, closing an exposure that had stood more than six months
• A documented-but-ineffective 2FA control corrected, the offboarding OU now enforces what it claims to enforce
• Automation reduced from ~240 rules to 197 while restoring 20+ broken rules and eliminating inconsistent ones
• Nine obsolete workflows retired across operations and HR
• Onboarding, offboarding, and a distinct contractor lifecycle rebuilt as triggered process rather than institutional memory
• HRIS-to-Workspace synchronization for job title and manager
• Stabilization delivered in roughly 60 hours across five weeks, paced to the client's budget rather than the platform's ideal timeline