Hello. I’m Oliver.
I am the IT, Security and Governance Manager at The Independent Pharmacy. My role covers IT infrastructure, cybersecurity, governance and data protection compliance.
It is a broad mix. On any given day, I could be reviewing a security issue, working on infrastructure, assessing a supplier, updating a policy or answering a question about data protection. There is always something which needs investigating, improving or explaining.
I did not follow a straight path into the role.
How I got here
My interest in technology started when I was younger. I built computers, experimented with a Raspberry Pi and began learning Python. Much of it involved following guides, breaking things and trying to work out which step I had misunderstood.
I went on to study History at university. During my final year, I attended a humanities in technology seminar which pulled me back towards computing. I started learning Java and brushed up on Python.
History and cybersecurity might appear unrelated, but the degree taught me how to research a subject, assess sources and build an argument from incomplete information. Those skills have been surprisingly useful when reviewing an incident, understanding a control or explaining why a risk matters.
My professional move into security came through an opportunity at work. The company needed someone to develop its IT and security strategy and improve its overall posture. I put myself forward and began taking on more responsibility.
There was no single point where I suddenly felt qualified. I learned by working through real problems, asking questions and taking each opportunity as it came. Since then, I have continued experimenting with technology at work and in my home lab.
The people who helped me
I have had a lot of help along the way.
Scott McGready from Damn Good Security and Dave McKenzie, now at Cyber Increment, both helped propel my career forward. Their advice, knowledge and willingness to share their experience made a real difference.
Scott has also mentored me throughout my development. He has challenged my thinking, helped me recognise where I could improve and given me honest guidance when I needed it. I owe him a particular thank you.
Scott and Dave have also played a big part in bringing Hack Glasgow together, alongside the rest of its organising team. I attended the first conference last year and returned for its second iteration this year. Both have been great fun.
The conference has given me the chance to hear talks from people such as James Bore and Ken Munro, along with many others who have been generous enough to share their knowledge and experience.
It has also helped me become part of the Scottish cybersecurity community. I have made a lot of friends through the events and met people I might never have encountered through work alone. That community has become an important part of my career, and I hope Hack Glasgow continues for many years to come.
Kirsty Squires has had a huge influence on my understanding of data protection. She is an excellent Data Protection Officer and has taught me a great deal about applying data protection properly within an organisation.
I am also grateful to Scott McDougall and Andy Boysan, the co-founders of The Independent Pharmacy, for giving me the opportunity to grow into the role. They trusted me to take on more responsibility and supported me while I developed the company’s approach to IT, security and governance.
Careers are often presented as personal achievements. Mine has depended on people being generous with their time, knowledge and trust. It is important to acknowledge that.
Why I built this site
A lot of my work cannot be discussed publicly. That comes with working in cybersecurity, governance and data protection. Company, employee and patient information does not belong in a blog post.
There is still plenty I can talk about.
I can write about the way I approach a problem, the tools I build, what I am learning and the public projects I work on. I can also share lessons from my career without publishing anything confidential.
Until now, most of that information has lived in scattered notes, unfinished drafts and project folders. This site gives it a proper home.
Writing about a project forces me to understand it well enough to explain it. It also encourages me to finish things. A half-built tool sitting in a private repository is easy to forget about. Publishing it creates a useful deadline.
What I will write about
The subjects will probably reflect the range of my work and interests.
There will be posts about cybersecurity, automation, APIs and infrastructure. I plan to write about projects from my home lab, including the parts which did not work first time.
Governance and data protection will appear too. Both are sometimes reduced to policies and paperwork, despite having a direct effect on how organisations make decisions and manage risk. I want to write about the practical side of that work.
I will also document parts of my career development. That could include skills I am working on, lessons from moving into a management role or areas where my understanding has changed.
Where a project can be shared publicly, I will include the code and enough detail for someone else to understand how it works. Anything involving my employer will stay within the boundaries of confidentiality and good judgement.
Learning in public
Publishing technical work can feel uncomfortable.
There is always someone who knows more. There is also a reasonable chance that a solution I am pleased with today will look clumsy after another year of experience.
I am fine with that.
The purpose of this site is to create a record of what I knew, what I built and how I approached the problem at the time. If I find a better way later, that gives me something else to write about.
I want the posts to include the useful mistakes. The wrong assumption, the failed test and the small detail which took far too long to notice are often the parts another person needs.
I will check what I publish and correct anything I get wrong. I do not expect every post to be the final word on its subject.
A place to stay accountable
This site gives me somewhere to publish my public projects and talk about the work I can share. It also gives me a reason to keep developing outside the immediate demands of my role.
I want to become a better technical practitioner, manager and communicator. Writing helps with each of those areas. It exposes gaps in my understanding and makes vague ideas harder to hide behind.
The site is also part of developing my personal brand, although I find that phrase slightly uncomfortable. In practical terms, I want there to be a public record of my interests, projects and experience which is more useful than a list of job titles.
I am not setting an ambitious publishing schedule or promising a new article every Tuesday at exactly 9am. The objective is to write regularly, finish more of the things I start and make the useful parts available to other people.
This is the first entry.
Let’s see where it goes.