About Marcus
Marcus started as a SOC analyst and now reports on how cloud teams scale response. He is skeptical of dashboards that do not lead to action.
Marcus writes for the engineer who has to open the pull request. His pieces tend to end in a runbook rather than a recommendation.
Ten years in platform and infrastructure engineering, including four spent owning Terraform for a regulated fintech and reviewing every emergency change that went with it.
Latest by Marcus Okafor
Why your cloud fixes don't stick: The shift from console to code
Manual console fixes in the cloud are temporary. To reduce a 1,000-finding backlog, security leads must shift from reactive 'clickops' to durable IaC pull requests and centralized policy enforcement.
Asset ownership metadata is the real cloud remediation bottleneck
Cloud security findings sit in backlogs for months because teams cannot identify resource owners. Solving the metadata gap is the only way to scale remediation without adding headcount.
You fixed it twice and it came back: Terraform drift is the reason
Manual security fixes in the cloud console are often overwritten by CI/CD pipelines within hours. Here is how to move remediation upstream to the code.
The 72-hour remediation SLA nobody in your org has ever met
Severity-based timelines often fail because they ignore engineering capacity. Here is how to build cloud remediation targets that actually result in closed tickets.
Stop fixing the same finding: turn remediation into a guardrail once
Stop fixing the same S3 bucket every three weeks by converting one-off tickets into high-durability Policy-as-Code guardrails.
The risk acceptance form your auditor will actually accept
Cloud security teams cannot fix every finding. Moving from tactical alert suppression to formal risk acceptance is the only way to clear the remediation backlog.