Aaron Steele, South Australia
Fifteen years of walking into other people's messes. Mining, energy, policing, federal service delivery, councils. Legislation nobody can apply, migrations nobody can reconcile, systems nobody can explain any more. I find the rules underneath, and then I build the thing.
15 years9 organisationsTOGAF certifiedBaseline cleared
What I bring
The analyst who can run the workshop usually hands over a document. The engineer who can build it usually needs the document. I have spent fifteen years being both, which is the only reason any of the work below exists.
Legislation turned into eligibility logic for the National Redress Scheme, as a rules engine the people accountable for it could actually read. A regulator's ring-fencing guideline turned into operating controls at Essential Energy, separating a regulated electricity network from its contestable arm across four workstreams. If nobody can say how a thing is supposed to work, that is the job, and I like it.
A national charity's donor migration was out by $3.8 million and 3,600 transactions because it had matched people on email address instead of the real identifier. I did not write a report about it. I rebuilt 37,729 records on the right key myself and reconciled them to their control totals.
The two systems further down this page are also mine: written, deployed, public, and running right now.
On a security review I signed in as a different retailer and ended their live broadcast, because reading the code and saying "this looks exploitable" is not the same as proving it. On the same review I rejected a reported flaw that turned out not to be one.
I do the same to my own work. Both of my servers ship a script whose only job is to check them against sources I do not control, and it has caught things my own tests could not.
Fifteen years of workshops with people who disagree with each other, executives who want a different answer, and regulators who want evidence. I have mentored teams of analysts through it and I can talk to a head of sales and a mine site superintendent in the same week, in language each of them would use.
Technical lead on a stalled HubSpot implementation for a national charity, through a solutions partner. Donor and donation data off a legacy platform, integrated with Raisely, Stripe, Square and PayPal, posting through to Xero.
The earlier migration had matched people on email address rather than the source system's durable identifier. Against the client's own reconciliation it was out by roughly $3.8 million. I rebuilt the dataset by hand on the right key.
Client and partner not named, by choice. Hands-on in HubSpot since 2016.
Two security reviews of a live video shopping platform built largely by agents. Six exploits driven by hand against the running application, then re-driven after the fixes. Three shut properly, one still open, one reopened, one re-broken by its own fix.
A one-time-code login had been added, and it guarded one route. The old route still handed an identical session to any email address that asked. I used it to sign in as a retailer with a live show and end their broadcast.
A cascade on a foreign key, while the message on screen told the user their financial records were being kept.
It measured cache behaviour by reading two response headers the site never exposed cross-origin, so every reading came back empty and the score was a structural 100%. The project's own notes had it recorded as verified.
An agent reported a leaking stream key. I traced the path, found the serialiser that redacts it, and said so.
Both are public, MIT licensed, and answering as you read this. The counts below were fetched from them by your own browser a moment ago.
Not "what is the weather". Can we book the Thursday slab pour in Bendigo. Six tools reading live forecast, daylight and public holiday data, answering for a specific trade on a specific day. An ambiguous suburb comes back as a question, never a guess.
Everything a salesperson could learn about a company before they knock, read live off that company's own website and DNS, then scored against your rules and written into HubSpot. The credential travels on the connection header, never as a tool argument, so it never enters the model's context.
Where I have done it
Mostly the same job in different clothes: take something nobody can quite explain, work out the rules it actually runs on, and get them built.