JPMorgan Chase DevSecOps Launch: Setting Direction, Targets and Key Results

You are a product manager at JPMorgan Chase, which is building a new DevSecOps platform. Lay out the platform's strategy, its goals and a set of OKRs. ```hint Start from the problem Decide which teams the platform serves and what problem it removes for them before writing any objective, then make sure each key result could be scored with a number at the end of the quarter. ``` ### Clarifying Questions - Is the platform for JPMorgan Chase's own engineering teams, or a product sold to outside clients? - Does it start with one line of business or the whole firm, and must it work with the CI/CD tools teams already use or replace them? - What triggered it: audit or regulatory findings, security incidents, slow releases, or too many disconnected security tools? - What horizon should the goals and OKRs cover, for example the first quarter and the first year? ### What a Strong Answer Covers - The problem and the users the platform serves (developers, security engineers, risk and audit) before any objective - A strategy that makes explicit choices: where to start, build versus integrate, paved road versus mandate, and what is out of scope - Goals sequenced over time horizons, from a pilot to firm-wide adoption - OKRs whose key results are measurable outcomes with baselines, plus health metrics that protect delivery speed and developer experience - Banking realities: audit evidence, separation of duties, change control and risk-based release gates ### Follow-up Questions - A key result targets faster remediation of critical vulnerabilities, and teams start dismissing findings as false positives to hit it. How would you detect and prevent this? - A business unit with its own mature pipeline refuses to migrate. Do you mandate adoption or earn it, and what would change your mind? - How would you show senior leadership that the platform reduced risk rather than just generating more scan activity?