Experience

Ivalua is an enterprise source-to-pay and procurement platform serving customers in defense, government and financial services. Its security program is built on NIST SP 800-53 and ISO/IEC 27001, and it holds SOC 1 Type 2 (SSAE 18 / ISAE 3402), SOC 2 Type 2 and ISO 27001, certified in November 2022 and audited by Schellman.

The detail that makes the change-control problem genuinely hard here is the infrastructure. Ivalua does not run on a hyperscaler. It operates its own environment across nine data-centre providers in four geographic regions — Montreal, Washington DC, Chicago, San Francisco, Seattle, Paris and Singapore. Coordinating a change across that estate is not a pipeline concern; it is a scheduling, sequencing and evidence problem across independent facilities.

The SOC 1 is the part most engineers underestimate. It exists because customers' own auditors rely on Ivalua's change controls when forming an opinion on those customers' financial reporting. A weak change record here does not just fail an internal audit — it propagates into somebody else's SOX opinion.

The federal work sits on top of that. I led a FedRAMP Moderate authorization through an Agency ATO on Azure Government (GCC). That covered defining the authorization boundary and its architecture diagrams, implementing controls against NIST SP 800-53, hardening to DISA STIG and CIS Level 1 and Level 2 benchmarks, implementing zero-trust networking, enforcing FIPS-validated (CMVP) cryptography for data at rest and in transit, authoring the SSP and its control narratives, driving POA&M remediation and the exception process, and standing up continuous monitoring along with the operational firefighting rotation that keeps it honest after the ATO letter.

In 2025 I also led ISM readiness and remediation advisory for selling into Australian government, at the OFFICIAL classification level — roughly six months from build through audit to authorization.

TherapyNotes is a behavioral-health EHR and practice-management platform, and a HIPAA business associate processing electronic protected health information. Behavioral-health records sit at the sensitive end of PHI: psychotherapy notes receive special treatment under the HIPAA Privacy Rule, and substance-use-disorder records fall under 42 CFR Part 2. A bad deploy in that environment is not an outage — it is potentially a breach.

This is where the change-advisory work happened. Owning the CAB at a HIPAA business associate, in the years leading up to the company's HITRUST certification, meant redesigning the approval process rather than defending it: classifying changes so routine work stopped being re-litigated weekly, moving normal changes into the development platform where approval and evidence are produced automatically, and reserving the board for genuinely high-blast-radius, cross-team work.

The measurable outcome was a 30% reduction in change-approval time with no major incidents and no unanticipated downtime — the delivery gain and the control environment moving in the same direction rather than trading against each other.

ExpenseWatch was an accounts-payable and expense-management platform — the category whose change controls sit inside its customers' SOX IT general controls scope, because the system feeds their financial reporting.

The tenure spans two ownership changes. Nexonia acquired ExpenseWatch in March 2016; in June 2017 K1 Investment Management invested $125M+ and merged Certify, Nexonia, ExpenseWatch and Tallie into a single 7,500-customer entity, which rebranded as Emburse in 2020. Production Support Lead through the first, Manager of IT through the second.

Merging control environments is where change management actually breaks. Two companies arrive with different approval workflows, different definitions of an emergency change, different evidence trails and two populations of changes that have to reconcile into one. It is the scenario in which auditors reliably find gaps, and it is almost entirely unwritten-about.