Work

Selected case notes

Short, anonymised notes from security architecture work in regulated organisations. Organisations are described by sector only, and each note covers the problem, the approach and the outcome.

4IR engagements

Work delivered by 4IR since it was established in 2022, each engagement led by Jack Reason.

Banking

Governing AI coding agents in the developer toolchain

Problem: Engineering teams used an AI coding agent inside their editors. The organisation wanted to extend it to the command line and to unattended CI use, which changes how much the agent can do on its own and what it can reach.
Approach: We assessed the incremental risk of that extension: non-interactive execution in pipelines, autonomy and auto-approval modes, inherited shell credentials, and MCP tool integrations. AI-assisted tooling supported the assessment itself, and every finding was reviewed by Jack before it was reported.
Outcome: A delta security assessment setting out the controls required before the extension could proceed.

Banking and telecommunications

Control assessments of CI/CD pipelines and container platforms

Problem: The platforms that build and run software are part of the attack surface. Three large organisations needed security assurance of their CI/CD pipelines, Git platforms and runners, dependency scanning and container orchestration.
Approach: We ran control assessments of each platform: cloud build services, hosted Git and pipeline runners, dependency scanning, and a microservices architecture on Kubernetes. For one bank, every infrastructure-as-code change to the landing-zone architecture was reviewed and approved as part of the engagement.
Outcome: Control assessments of the CI/CD, software supply chain and Kubernetes platforms across all three organisations.

Government

A secure-by-design engagement model for a state government agency

Problem: Delivery teams engaged cyber security in an ad hoc way, a key application modernisation initiative needed ISM-aligned security requirements, and the agency wanted a view of its primary Azure hosting environment against IRAP expectations.
Approach: We wrote a single secure-by-design advisory process that told delivery teams what security needed and when, embedded shift-left security with delivery leads and business analysts, and provided security governance on the identity and access management program.
Outcome: The new process replaced ad hoc engagement. The engagement also delivered ISM-aligned requirements for the modernisation initiative and an IRAP readiness pre-assessment of the Azure hosting environment.

Banking

Extending secrets management to multi-cloud

Problem: A bank’s on-premises secrets management capability was being extended to AWS, Azure and GCP. Under the bank’s security governance framework, the change needed design governance, a risk assessment and formal compliance sign-off.
Approach: Working with the solution architects, engineers and delivery managers, we ran threat modelling and risk identification and set controls proportionate to the bank’s risk appetite. We oversaw the integration, encryption and key lifecycle design, and validated the design artefacts against the bank’s security standards.
Outcome: Design governance, a completed risk assessment and the compliance sign-off for the multi-cloud extension.

Health and medical devices

Security for a cloud contact centre and customer identity uplift

Problem: A global medical device company was moving its contact centre to the cloud, uplifting its customer identity platform and expanding its DevOps pipelines, all in a regulated, privacy-sensitive business.
Approach: We led the security stream across the three initiatives, defining controls against HIPAA, ISO 27001 and NIST and governing them through the company’s architecture review board.
Outcome: Security requirements and assurance for the cloud contact centre, the customer identity uplift and the DevOps platform, balancing privacy with enablement.

Prior experience

Before founding 4IR in 2022, Jack worked as a security and cloud architect in regulated organisations. These notes are from that work.

Banking

Securing a bank-wide AI program

Problem: A major bank ran an AI-driven program that analysed collaboration data across the organisation for productivity insights. The dataset was highly sensitive and organisation-wide, so the program needed security and privacy assurance under the bank’s secure-by-design model.
Approach: As the security architect for the division, Jack assured the program against the bank’s secure-by-design framework, focusing on where the data flowed, who could access it and under what controls.
Outcome: The privacy and data-flow review, the access control design and the security sign-off for the program.

Retail

Cloud security capability uplift

Problem: During a period of accelerated cloud transformation, a national retailer’s security team needed to uplift its cloud security posture and modernise capability across platforms, processes and people.
Approach: Jack acted as the central point for cloud security across delivery programs and architecture governance forums. He defined security requirements and reviewed implementation for core Azure services (AKS, Azure Policy, Microsoft Sentinel and Key Vault), and built SIEM integration, conditional access, privileged identity management and secrets management into program delivery.
Outcome: A cloud security capability uplift roadmap, along with reusable security patterns and risk assessment frameworks for Azure PaaS adoption.

Telecommunications

Secure foundations for an IoT asset-tracking platform

Problem: A national telco was building an asset-tracking platform from Bluetooth and Wi-Fi tag telemetry captured through its devices, mobile apps and network infrastructure. Device authenticity, data ingestion and privacy all needed to be addressed in the design.
Approach: Jack led the security architecture, covering device identity and authenticity, secure telemetry ingestion, network segmentation and privacy-safe architecture patterns, including SIEM integration, SSO patterns and role-based access controls.
Outcome: The platform’s secure foundation, with security built into the design artefacts, infrastructure-as-code baselines and architectural decision records.

Working on something similar?

Get in touch