Escaping Unicorn Culture

It's a cliche that the biggest blocker to DevSecOps adoption is 'culture', which is shorthand for an impenetrable mass of people-y challenges. But in this talk I'll tackle a very concrete case: unicorn culture.

In moving away from skill-centric and inert silos and towards cloud-native architectures, we often seem to end up dependent on a small cluster of highly skilled super-engineers. These rare, senior, and hugely adaptable individuals can each deliver the same expertise and quality as a 100-strong IT organisation.

But of course, there's not many of them. So we fight over them, overload them, and push them to take on broader and broader responsibilities. Sometimes they are infrastructure architects who are also best in class software engineers; sometimes they are appsec specialists who also know 16 different cloud platforms and eat firewalls for breakfast.

I like to call these people 'unicorns', because they're semi-mythological, implicitly priceless, and attempts to create more of them usually fail. Above all, relying on unicorns to build a DevSecOps capability is a bad idea.

In this talk I'll explore the common problems caused by reliance on different breeds of unicorn in DevSecOps, and present some ways we can escape this common cultural trap.

Curse of the Unicorn

The DevOps jobs market is full of unicorn hunters: companies looking for just one or two superhero engineers that can fix everything. And we engineers often aspire to fit that profile – after all, the work pays well, it’s never dull, and it’s nice to be useful.

But what happens when companies actually find these legendary people? Well, it’s not all sunshine and rainbows. It turns out they face the Curse of the Unicorn.

In this talk, I’ll examine the various ways that achieving a DevOps unicorn dream team leads to disaster. I’ll explain how attracting unicorns leads to short term, isolated success, while silently sabotaging a company’s ability to scale. And on a more cheerful note, I’ll explain what I think you should do instead.

First public audience, though related to another talk on my profile delivered at DevSecOps Days DC 2022. 30 minute slot preferred though flexible.