Assessed
Security and compliance readiness
Completed cybersecurity, PCI DSS gap, and ISO 27001 gap assessments without representing that work as certification or a formal audit outcome.
Independent consulting engagement · July–November 2022
When the bottleneck wasn’t the code.
SecureClose’s software changes took months. A rewrite looked like the obvious answer—until a real request showed that most of the delay occurred outside development.
Brandon assessed the system responsible for delivering change, implemented a more coherent work-management model, and redirected modernization toward the constraint the organization could actually observe.
- Client
- SecureClose
- Role
- Technology Strategy Consultant
- Period
- July–November 2022
The situation
The visible problem pointed at the application.
SecureClose provides contract-signing and financing workflow software intended to give automotive dealerships a defensible record of customer assent. Change requests commonly took months to reach delivery.
The surrounding operating system was fragmented. Three salespeople were split between SugarCRM and Salesforce based primarily on personal preference. Defects could enter through FogBugz, GitHub, or an Azure-hosted source-control system, and requests often moved through informal email chains before reaching a tracking system.
Customer information, ownership, status, and delivery history were distributed across overlapping tools. That made a major application rewrite feel reasonable—but there was not yet evidence that application architecture was controlling delivery speed.
The investigation
Follow one real change through the system.
Brandon submitted a representative request for social-media login for dealerships and monitored its path from intake to delivery.
The request acted as a tracer: instead of relying only on interviews or process documentation, it exposed where work waited, moved between people, returned for correction, and finally entered active development.
- 7 weeks
- Total elapsed time from submission to delivery
- 3 days
- Time consisting of actual development work
- 3 times
- Request rejected for missing or incorrect information
What the measurement changed
Seven weeks was not seven weeks of engineering. The observed development occupied three days; most elapsed time accumulated in intake, handoffs, clarification, rejection, rework, and waiting.
The finding
The delivery system was the dominant constraint.
The application may have carried technical debt, but its architecture was not causing most of the observed lead time.
Replacing the software would not correct incomplete requests, email-based handoffs, fragmented ownership, duplicate business tools, or long queues between stages. A new application could have inherited the same constraints.
Through the Theory of Constraints lens, improving a component that is not limiting total throughput consumes time and capital without necessarily improving the system. The higher-leverage intervention was to improve how work was requested, described, owned, tracked, reviewed, and delivered.
Good technology strategy includes recognizing when building something new would optimize the wrong constraint.
The intervention
Make the flow of work authoritative and traceable.
Brandon configured an Atlassian environment from the ground up and migrated SecureClose’s core work-management and delivery processes into it. Jira, Bitbucket, Statuspage, and Atlassian customer-support tooling provided a shared path for ownership, status, requirements, rejection, revision, and delivery history.
The change was more than a project-management tool replacement. Bug reporting, customer support, internal project management, and CI pipelines moved into the Atlassian environment. Change requests entered Jira through a managed email intake instead of circulating between individuals, preserving a familiar entry point while making the work authoritative and traceable.
Implemented
Actionable remediation work
Converted assessment findings into a substantial Jira remediation backlog—remembered as at least 30 items—with ownership, priority, corrective action, status, and retained activity history.
Consolidated
Core delivery processes
Built specialized compliance-remediation, operational-incident, and cybersecurity incident workflows alongside the organization’s delivery and internal-project regimes.
Recommended
A coherent CRM direction
Recommended Microsoft Dynamics CRM as an authoritative customer platform connected to Azure and Microsoft’s broader low-code and no-code automation ecosystem. The aim was to let salespeople compose campaigns from actionable business information without adding more disconnected applications.
Observed after implementation
Within 2 days
In post-change spot checks, selected small changes reached release within two days after their implementation was complete.
This was not a formal before-and-after DORA study. No objective baseline had existed; the earlier “months” characterization came from shared executive experience, while the seven-week tracer supplied a directly observed example. The later observations show a materially shorter path without pretending to establish an organization-wide percentile.
Scope boundary
Operational implementation, not a product rewrite.
This was an independent technology-strategy engagement, separate from Brandon’s AZ Crown portfolio role. The engagement began through a referral from an executive familiar with his earlier work.
Brandon did not write SecureClose product features, re-architect its principal application, migrate that application to the cloud, or perform the proposed CRM migration. He implemented the Atlassian delivery system, completed gap assessments, created remediation work, and recommended Dynamics CRM; whether that recommendation was later adopted is not established.
The PCI DSS and ISO 27001 work described here was gap assessment and remediation planning, not certification. Confidential control findings and unsupported audit outcomes are intentionally excluded.
Discuss a delivery constraint