Open to senior program, technical program & incident response roles
ManfredJohanning
Senior Program Manager · Incident Response & Program Operations
I build the operating systems behind resilient teams: incident response and business continuity, cross-functional programs, and AI that knows when a human needs to take over.
I joined Amazon in San José, Costa Rica, in October 2010 as a Seller Support Associate, after two years in technical support at Hewlett Packard Enterprise. Over fifteen years I moved from answering sellers to answering for the systems behind them: incident response, the Command Center I built from zero, then risk and program management in Arlington, Virginia. From 2018 I also ran my team's project work, and from 2020 to 2024 its worldwide portfolio, from intake and project office to the move to Asana in Scrum sprints. Since June 2026 I have been building AI tools for small businesses and a community association.
Hiring manager for the Command Center's major incident manager roles
Named single point of contact for Amazon's readiness assessment, Peak 2022 and Prime Day 2024
The shared-service business case, carried to director-level sign-off
Idea Champion for a seller-facing service health dashboard proposal, across three planning cycles
Start here2 min · with captions
What I do, in two minutes
A short animated walkthrough of my career, from the Command Center to programs to AI operations. Narrated in my own voice, captioned throughout. All 14 films ↗
MAJOR-EVENT DOWNTIME −68% YoYSEV2 ACK <5:00 vs 30:00 GUIDELINECHANGE-RELATED MISSES −35%INCIDENT MANAGERS LED 9BC ACTIVITIES 40+ ACROSS 5 SITESPORTFOLIO 100+ PROJECTSVISIBILITY & TEAM RESPONSE +25% AFTER ASANA MOVEREPORTING TIME −22% VIA AI AGENTWW ESCALATION VOLUME CARRIED ~65%TICKET REDUCTION −15% YoYSERVICE LEVEL 75% → 97% IN 5 WEEKSSHARED DESK 4 ORGS · 13,700+ EMPLOYEESALERT VOLUME ABSORBED 4× IN ONE MONTH
At a glanceSeven chapters
The work behind the outcomes.
Explore the command center, the programs built to last, and the software that puts those same operating principles into practice. Each chapter includes the context behind the results.
The thread through my work
Make the complex legible. Give the work an owner. Build the mechanism that lasts.
The operating principle / 01
Turn urgency into ownership.
The Command Center brought four organizations onto one intake path, one severity taxonomy, and one escalation workflow.
SEV2 acknowledgment against Amazon's 30-minute guideline
ILLUSTRATIVE WORKFLOW · EXISTING PORTFOLIO CASE STUDIES
Business continuity2021–2024 · drills and mock exercises
The plan gets used before the day it matters.
Incident response handles the bad day. Business continuity makes sure everyone has practiced it first. At Amazon's Command Center I led the drills: with the Global Risk Framework team and site operations, we rehearsed weather, geopolitical and major technical events worldwide, so the people on shift knew their part before a real event.
Outer ring: one tick per drill. Inner ring: one per site preparedness event. Five dots: the five sites.
Drills and mock events, worldwide
40+
Sites taking part
5
Site preparedness events
24
Improvement in critical-event communication response
15%
2021
I ran tabletop exercises as disaster recovery plan audits. Each opened with an imagined incident at a site (an earthquake for a site in Costa Rica; the February 2021 Texas winter storm, hurricanes and tornadoes for a North America virtual site), walked the stakeholders through a readiness checklist from where the plan is stored to backup sites and restoration, and ended with action items that had an owner and a date. That October I started building the Command Center, with continuity in its remit.
2022
Named single point of contact for the 41-question readiness assessment Amazon runs before its largest sales events, for the holiday peak across 20 countries: capacity, hiring, operations, readiness, resilience and risk, down to stress tests, mock drills and pager verification.
2023
The first mock drill ran on 1 March and was recorded, so shifts that missed it could still use it. After it, and once the full program was in place, faster response and resolution times held. The drill program reached 40+ drills across five sites and 24 site preparedness events. Each site's plan started from a business impact analysis and a risk assessment, which fed the tabletop exercises.
2024
The numbered drills continued: in January, drills 4 to 6 practiced the advisories and flash reports for events such as earthquakes and a fire near a site, each assessed for its distance to our sites and remote employees. Single point of contact again for the readiness assessment ahead of Prime Day 2024.
Vigil leads: the live uptime dashboard I built and launched in a day. Then the
two-minute version of my career, a short on waterfall vs agile projects, a film on the practices that keep projects delivering, an explainer on the four AI building blocks I work with, four stories from the Command Center, and demos
of apps I built for small businesses: a hospitality team, an independent notary and
a condo association. Every narrated film is captioned, and two of the demos come in
English and Spanish. Pick one. When it ends, the next one is ready.
Up next
What I do, in two minutesCH 02 · Career story · 1:59
You've watched all fourteen
Thanks for watching.
If this is the kind of work your team needs, I'd like to hear about it.
A live uptime and incident dashboard watching three real sites: whether each one is up, how fast it answers, and how many days its certificate has left. You can safely trigger a test incident, and every outage gets a plain-language digest.
1 dayfrom written brief to tested build and launch
In this film
Recorded from the live site on 24 Sep 2026. The private client site stays unnamed.
The short version, the long version, a short about growth, waterfall vs agile projects, the practices that keep projects delivering, and the four AI building blocks I work with.
Best measured week97% first response / 100% resolution inside service level, wk 5 2023
Four Amazon organizations were each absorbing major incidents on their own:
Account Health Services, Payment Risk Operations, policy enforcement and
Brand Protection. Together they form the seller-trust side of the
marketplace: account integrity, payment risk, policy enforcement and brand
protection. When one of them goes down, the checks that protect buyers and
sellers go down with it.
Each had smart people who knew what to do. What they lacked was anything
shared: no common intake, no common severity language, no single escalation
path between them. When something broke across two of them at once, the
first twenty minutes went into working out who owned it.
I was asked to build the function that would carry all four. There was no
team, no budget line, and no playbook. The job was to create all three.
The constraint that shaped everything: I couldn't take authority away
from four organizations that were each already accountable for their own
uptime. So the Command Center wasn't designed as a body that takes over an
incident. It decides how bad this is, finds who owns it, and gets them
talking: fast, and the same way every time.
A year in, the question changed. It was no longer whether four organizations
could share one desk, but whether their operations teams would take it on as a
shared service. In December 2022 the desk opened as a shared service across all
four organizations: 13,700+ employees across 40 in-house
sites plus virtual sites across the Americas, EMEA, India and Southeast and
East Asia, watching 50+ critical systems and the external events that take them down: weather, geopolitical, outage. It ran as a six-month
pilot at no cost to the teams that joined, so the only thing holding them was
whether the numbers moved.
In the first full week of measurement, three-quarters of externally triggered
alerts were answered inside the service level. Five weeks later it was 97%,
and every alert that week was resolved inside its target. That happened
while monthly volume went from 71 alerts to 283, roughly four times the work in a month. The sub-five-minute acknowledgement carried over to the new service: across the
weeks after launch it averaged 2.23 minutes on event alerts against a
five-minute goal, and six minutes to resolve against a thirty-minute goal.
One of the three regions opened at 36% attainment in December 2022: barely one alert in three inside the service level. It recovered to 68% in January on
three times the alerts, and its weekly first-response attainment reached 100%
in week 5 of 2023. The coverage and training work ran on through that quarter
rather than ahead of it: ten in-person leadership sessions across two sites in
February, with leadership from five stakeholder teams, and escalation training
delivered region by region over the weeks that followed.
01
Stand up the organization
Hiring plan, budget and cost planning, role definition, and the coaching
structure underneath it. Recruited and developed the team that would run
a follow-the-sun desk.
9 incident managersBudget owned
02
Define the shared mechanism
One intake path, one severity taxonomy, one escalation workflow, agreed
across all four organizations. This was the hardest part of the build and
almost none of it was technical.
4 orgs aligned−35% change-related misses
03
Automate the response path
Replaced a hand-worked escalation chain with an automated on-call pager
and a three-deep escalation ladder that opens a bridge on acknowledgment.
<5 min SEV2 ackvs 30-min SEV2 guideline
04
Build the measurement layer
Defined the KPIs and partnered with BI to build the executive dashboards
in Amazon QuickSight and Tableau, so the function's value was visible to
the leaders funding it rather than argued for.
Exec dashboards95% goal, 90% floorReported weekly, by region
05
See the failure sooner
Partnered with engineering to map 50+ critical service alarm graphs into
a single monitoring dashboard, and wrote a Tampermonkey script that
generated incident tickets straight from escalation data instead of by
hand.
50+ alarm graphs−20% ticket-creation time
06
Rehearse the failure
Ran business-continuity activities with the Global Risk Framework team,
covering weather, geopolitical and major technical scenarios, so the plan
had been used before the day it mattered. The first mock drill was run on
1 March 2023 and recorded so the shifts that missed it could still use it.
I was the named single point of contact for the desk in the 41-question
readiness assessment Amazon runs ahead of its largest sales events (capacity, hiring, operations, readiness, resilience and risk) for the 2022
holiday peak and again for Prime Day 2024.
40+ activities5 sitesFirst drill recorded, Mar 2023
07
Sell it before launching it
A shared service only works if the teams being served agree to be served.
The rollout ran as a change-management campaign with named checkpoints:
in-person roadshows at two sites in Asia, virtual sessions for EMEA and the
Americas, a stage-by-stage RACI written with one partner
organization that moved incident tasks off its real-time analyst team so
they could stay on impact analysis during an event, workforce-management
sign-off, escalation training region by region, director-level sign-off,
an incident playbook, mock drills, and formal three- and six-month
post-launch reviews.
4 organizations onboarded10 roadshow sessions6-month pilot, no cost to teams
Service level held while the work quadrupled
Externally triggered alerts, worldwide · week 52 of 2022 to week 6 of 2023 · goal 95%, floor 90%
The desk opened as a shared service in December 2022 and
was reported on weekly from the start. Both measures crossed the 95% goal in
week 4 of 2023 and stayed at or above it. Measured by month, from December 2022 to January 2023, alert volume went from 71 to 283, roughly four times the work, while worldwide attainment rose from 75% to 88% on first response and from 73% to 89% on resolution. The region that started furthest behind went from 36% to 68% month over
month and reached 100% first-response attainment in week 5 of 2023. Attribution: led.
Source: the program's own weekly service-level reporting.
The consoleVisual recreation
Illustrative reconstruction · 8 seconds
50+ service alarm graphs mapped
Spot exceptions across services
One shared monitoring view
Explore the detailed console reconstruction
Command Center · Major Incident ResponseLIVE
Shift NA–DAYOn call 9Orgs 4
Active incidents
3
1 SEV1 · 2 SEV2
Mean time to acknowledge
4:12
▼ target < 5:00
Avg event downtime
−68%
▼ vs prior year
Change-related misses
−35%
▼ vs baseline
SeverityEventOwnerAge
SEV1Catalog ingestion pipeline: WW write failuresAcct Health · Ops00:41
CLEARSeller auth service: regional failover completeAcct Health · Eng08:30
Automated on-call pager
Primary paged00:00:14
Acknowledged00:04:12
Bridge opened00:05:48
Escalation depth1 of 3
First response within SL · wk 5, 2023
NA92%
EU100%
IN100%
Business continuity
Activities led40+
Sites covered5
Preparedness events24
Platform event signal, rolling 60sNOMINAL
Visual recreation of the tool built in 2022. The real systems were internal Amazon
tooling and cannot be reproduced or shown. They were the executive dashboards
in Amazon QuickSight and Tableau, and the alarm-monitoring dashboard I built
with engineering that mapped 50+ critical service alarm graphs into
one view. This reconstructs their KPI structure, severity taxonomy and
escalation states. The incident queue, the shift and pager readings and the rolling
signal trace are illustrative examples, not real events. The reported results
are real: 68%, sub-five-minute acknowledgment, 35%, and the 40+
business-continuity activities, together with the regional first-response
attainment for week 5 of 2023 and the weekly service-level chart above, both
taken from the program's own weekly and monthly reporting.
Average downtime from major events
Indexed to the 2021 baseline · first full year of Command Center operation
Reported as a 68% reduction against the prior year, roughly 18 hours of
average event downtime removed. Attribution: led. Measured by the
program's own downtime reporting.
Time to acknowledge a SEV2
After automating the on-call pager, against Amazon's general SEV2 guideline
The pager replaced a manual escalation chain. The gain is in
acknowledgment, not resolution: getting the right owner onto a bridge,
not fixing the fault. Attribution: direct.
In hindsight
The tooling was never the hard part. Standing up a pager and a dashboard is a
few weeks of work. The slow part was getting four organizations to accept one
shared definition of SEV1. Each had its own leadership, its own metrics and
its own reasonable view of what counts as an emergency. That agreement took
far longer than any build, and it was the thing that actually made the numbers
move. Every minute saved in the chart above was bought by an agreement, not by
a system.
If I built it again I would spend the first month doing nothing but that
alignment work. I would resist the pull to show early progress by shipping
tooling into an environment that hadn't yet agreed what it was for.
The other thing that held was the audit. Every missed first-response and
resolution target went to a monthly review and was adjudicated ticket by ticket as a genuine miss, a one-time exception, a mis-attributed resolver, or an
allowance for a large-scale event or a ramping new hire. Roughly
430 of those ticket-level decisions were made across 2023 and 2024, and
the flagged-miss count fell from 51 first-response and 35 resolution misses
in August 2023 to 9 and 4 in August 2024. A service level nobody argues over
every month is a service level nobody believes.
What happened next
The shared-service expansion, with its five mechanisms, the rollout and the weekly numbers, is written up as a one-page case study.
Read “Four Organizations, One Desk” ↗
Track record2010 – 2026
Six roles, four organizations, one employer
One employer, but four genuinely different operating problems: seller
support, incident response, transportation risk, and satellite hardware
supply chain. Each came with its own stakeholders, tooling and failure modes. I joined
Amazon in October 2010 as a Seller Support Associate; the six roles below
start in 2012.
08/2025 – 06/2026
Senior
Senior Program Manager
Amazon Leo · Customer Terminal Supply Chain · Arlington, VA
Supply-chain program management for a satellite customer-terminal launch.
Standardized how Finance, Legal, Accounting, Tax and Trade engaged with
public-policy launches, and built the risk framework that kept their
deliverables traceable. Also where I started building AI agents in earnest.
Designed the weekly business review that ran across every worldwide
regional team, and drove four process-gap projects through Scrum sprints
on employee-registration compliance. Built the mechanisms that let
delivery service partners surface risk themselves rather than waiting to
be audited.
Senior Compliance Risk Manager, Seller Support Quality (transitional role after reorganization)
Selling Partner Services · Arlington, VA
Joined the quality team, which runs programs that raise Seller Support
associate performance, and partnered with business intelligence to
automate its internal Appeals dashboard, replacing a manual report that
took more than 12 hours a week. Managed a compliance audit report for
about six weeks, reporting it to operations.
Reporting automationDashboardsAudit reporting
10/2021 – 11/2024
Led 9
Manager, Major Incident Response (Command Center)
Selling Partner Services · San José, CR → Arlington, VA
Built the Incident Response Command Center from zero for four seller-trust
organizations and managed the nine incident managers who staffed it.
Defined the KPIs and partnered with BI on the executive dashboards. Mapped
50+ critical service alarm graphs into one monitoring dashboard with
engineering. Led 40+ global business-continuity activities under the
Global Risk Framework.
Directed the Americas incident response team: five IR managers providing
worldwide coverage and carrying roughly 65% of total critical-event
escalation volume. Separately supervised 13 direct reports on the Seller
Support operations side, and drove a 15% year-over-year ticket reduction
with the case-management engineering groups.
Security & platform incidents · 2018–2021
Ran the response to a cyberattack, a main-server outage, AWS outages,
and selling-platform and internal tooling failures. Together these
critical events were about 15% of the team's incident volume. By this
point I owned the bridge updates outright and wrote the event summaries
that went to senior leadership and to engineering, which are two very
different documents.
People managementCyberattack responseAWS outage responseChange managementProject intake & PMOTicket deflection
02/2012 – 07/2018
On-call
Incident Response Manager
Selling Partner Support · San José, Costa Rica
Six years of on-call coordination for high-severity incidents across
sellers, operations, directors and third-party vendors. Coverage spanned
North America, India and Europe, weekends and holidays included. This is
where the escalation instincts came from. Two events in particular taught
me what the job actually is.
A storm takes out a seller's power and connectivity. Suddenly they
cannot reach their own account to pause listings, so they keep taking
orders they have no way to fulfill, and the platform starts penalizing
them for it. The fix was never technical. I coordinated proactive
protection of the affected seller accounts. Then I made sure those
sellers were actually told what had been done for them, with the
internal messaging vetted through Ops and senior leadership first. We
worked with engineering to put event banners directly into the seller
communication path, so the warning reached people who were never going
to read an email.
Major outage · 2016 · IAD
A server warehouse in Northern Virginia lost multiple nodes and took
Selling Partner Services down end to end: the applications sellers
use, the internal tooling Amazon staff use to help them, and the
communication channels between the two. All at once. I drove the
incident: opened and ran the conference bridge, owned escalation
communication while the picture kept changing, and wrote the event
summaries afterward. Losing your comms channels in the same event
that created the emergency is a particular kind of problem. It is the
reason I later built a command center with its own intake and its own
paging path.
Each of these is a mechanism rather than a project, something that kept
running after I handed it over.
Incident Response
68%
Average major-event downtime cut in the Command Center's first full year
Incident Response Command Center
Built from zero for four seller-trust organizations (account health, payment risk, policy enforcement, brand protection): hiring, budget, policy, intake mechanisms and escalation workflow design. Managed nine incident managers; SEV2 response inside five minutes.
Governance
5 functions
Held to customer-terminal launch milestones through a weekly cross-functional forum
Five-function risk framework, Amazon Leo satellite launch
Risk framework and deliverable-traceability tracker for Finance, Legal, Accounting, Tax and Trade, plus a centralized Asana and Smartsheet portfolio covering scope, schedule, budget and risk across the customer-terminal supply chain launches.
AI-enabled delivery
22%
Reporting time removed by an enterprise LLM agent for portfolio consultation
AI agent on Amazon Quick Suite · Amazon Leo, 08/2025 – 06/2026
Project and dashboard consultation agent with an FAQ knowledge base generated from business requirement documents. Automated weekly Asana summaries; stakeholder satisfaction up 35%.
Portfolio
100+
Projects managed on a governed intake and review framework
Project portfolio & intake governance, 2020–2024
Standardized the team’s worldwide project intake and set up its approval committee and project office in 2020 on an internal project-management tool, with monthly project flashes for the North America, Europe and India teams and a bi-weekly intake report for their managers. Redesigned the team intake in 2022, cutting its approval chain from eight approvers to six and its required fields from eleven to seven, then led the portfolio’s move to Asana in Scrum sprints in 2023 and 2024.
Business continuity
40+ drills
Run worldwide across five sites with the Global Risk Framework
Business Continuity Drill Program
Mock weather, geopolitical and major technical events with the Global Risk Framework team and site operations: 40+ drills across five sites and 24 site preparedness events, improving critical-event communication response 15%.
Operating cadence
Worldwide WBR
One milestone-status view for leadership across all regional teams
Transportation Risk Compliance Weekly Business Review
Designed and implemented across all worldwide regional teams, with mechanisms letting the Delivery Service Partner team surface risk and process-improvement opportunities, reported through director level.
Software3 built at Amazon · 8 built on my own
Software I've built and shipped
Professional work first: three Claude-powered tools I designed and built inside
Amazon, plus the console behind the incident-response case study. Then everything
I've built and shipped on my own since, end to end, each clip the running
application, recorded, not a mockup.
Internal toolsDesigned & shipped inside Amazon
Three Claude-powered tools, reconstructed
Three small applications I designed and built to remove recurring manual work
from my own team's week. Together they drove a 30% efficiency gain. The
screens are reconstructions; the originals ran inside Amazon systems and
cannot be shown.
Illustrative reconstruction · 8 seconds
01 / CLAUDE-POWERED WORKFLOW
Collect stakeholder threads
Surface blockers and decisions
Review the priorities that need you
Weekly email summary review
Collapses a week of stakeholder threads into the decisions that actually need me, with blocked items surfaced first.
Evidence P2 · attribution: direct
Illustrative reconstruction · 8 seconds
02 / CLAUDE-POWERED WORKFLOW
Extract commitments from notes
Assign owners and due dates
Track tasks and follow up
Meeting-note action tracker
Pulls commitments out of meeting notes, assigns owners and dates, pushes them into Asana, and chases the ones that slip.
Evidence P2 · attribution: direct
Illustrative reconstruction · 8 seconds
03 / CLAUDE-POWERED WORKFLOW
Raise an issue from anywhere
Set severity and assign ownership
Track status and keep people informed
Mobile issue tracker
Lets a program issue be raised, triaged and watched from a phone, built because the people who spot problems first are rarely at a desk.
Evidence P2 · attribution: direct
Also from AmazonVisual recreation
The command center console behind the case study
Before any of my own products further down this page: the incident-response console from the
case study, mapping 50+ critical service alarm graphs and a platform-event
signal trace into one view. Recreated here, not a live capture. Read the full case study →
Illustrative reconstruction · 8 seconds
50+ service alarm graphs mapped
Spot exceptions across services
One shared monitoring view
Explore the detailed console reconstruction
Command Center · Major Incident ResponseLIVE
Shift NA–DAYOn call 9Orgs 4
Active incidents
3
1 SEV1 · 2 SEV2
Mean time to acknowledge
4:12
▼ target < 5:00
Avg event downtime
−68%
▼ vs prior year
Change-related misses
−35%
▼ vs baseline
Platform event signal, rolling 60sNOMINAL
My products5 products · 2025 – 2026 · recorded running
What I've built and shipped on my own since
Five products built end to end: design, front end, data model and deployment.
They are how I keep the operational instincts sharp on something I own entirely,
and why the AI work on my resume is hands-on rather than supervisory. Each clip
is the running application, recorded, not a mockup.
One workspace for a surf camp and its managed properties: reservations,
guest inquiries, service requests and open issues in a single reviewed
queue. Role-based access separates owners from site staff, Airbnb and
WhatsApp threads land in one inbox, and (the part I care about) every
outbound AI-drafted reply is held for human approval before it sends.
Role-based accessAI drafting + human gateMulti-channel inboxCapacitor
Source available on request
Notaría · Lic. JohanningREC
Public site + practice console
Notaría, a 40-year practice, online
Built for a Costa Rican notary with four decades of practice and no
patience for software: large type, large buttons, one screen that says
what needs doing today. The public side wins consultations by explaining
the thing clients are never told: most of a transfer fee is government
tax, not notary fees. A calculator proves it before anyone signs.
Everything arriving by WhatsApp, email or form gets classified,
prioritized and assigned before the manager opens their phone. The
interesting panel is not the queue, it is the one on the right. The agent
declined to auto-resolve a suspected pool leak: the potential property
damage and repair cost crossed its auto-resolution threshold. It escalated
to a human instead, with a photo request attached.
That is a severity threshold. It is the same mechanism as a SEV taxonomy,
pointed at an AI rather than an on-call rota. You decide in advance what
the system is allowed to handle alone, and what has to reach a person.
Eight homes, one board, and the same problem as any small operation:
everything lived in somebody's inbox. Now every home sees the same
ledger, repairs become tasks anyone can claim, and an assistant answers
from the building's own bylaws. Resident and board views are separated
by role.
It is the intake-and-ownership pattern from the incident work at
domestic scale: a resident reports a broken light, and can then see
who claimed it and when it closed, instead of asking the board. The
latest pass makes pitching in feel like a game: a lit window for every
home that is current on dues, and a squirrel that delivers an acorn
when a task is done. The recordings use a fictional building with
sample data.
The guest half of the same system, wrapped with Capacitor for iOS and
Android. A guest sees their room status, reports an issue, and then
(unusually for hotel software) actually gets to watch the ticket move.
It is the same instinct as the incident work: the person who reported the
problem should never have to ask what happened to it.
The newest product, and the one closest to the incident work: a working uptime
and incident dashboard that watches three real sites, live at
vigil-uptime-command-center.vercel.app.
It opens with a 30-second summary for hiring teams; the live dashboard is one
click further.
Vigil · narrated walkthrough · 1:56REC
Uptime and incident dashboard
Vigil · Uptime Command Center
Three real UptimeRobot monitors: this portfolio, my studio site, and a
private client site shown only as "Client community portal". For each:
live status, response time split into DNS, connect, TLS and first byte,
certificate days left, 90-day history, incidents and the alert path,
plus an incident simulator. Every panel names its data source.
Two serverless functions do the work: a live probe of a fixed allowlist
of sites, and a read of UptimeRobot API v3 through a read-only key held
server-side. Measured on the live site: strict Content Security Policy,
HSTS preload, no third-party requests, 417 automated tests, accessibility
100. It applies the discipline of the Amazon command center, where I
partnered with engineering to consolidate 50+ critical service alarms
into one monitoring dashboard. Built end to end with AI-assisted
development, in Claude Code and Cursor.
Live probeUptimeRobot API v3Serverless functionsStrict CSP417 automated testsAccessibility 100
A client-ready, bilingual sales deck: three market studies with every figure
fact-checked, 19 slides in Spanish and English, six animated product demos and
an explainer, and native PowerPoint with editable charts. I built it in one day
by orchestrating AI agents for research, design, build and review. Shown here as
an anonymized sample: names are samples and the demos are illustrative concepts.
Watch the 40-second film →
Anonymized sample · 9 seconds
Research: three fact-checked market studies
Story: 19 slides, Spanish and English
Motion: six product demos and an explainer
Delivery: native, editable PowerPoint
VisualizationWebb image · Abell 2744
Pandora's Cluster in depth
A 19-second looping flight through the James Webb Space Telescope's image of
Pandora's Cluster (Abell 2744), plus a web page where every one of the 9,578
catalogued galaxies in the picture can be clicked to see when its light left
it. 29 featured objects are reachable by keyboard. The page loads nothing from
other sites and sets no cookies. It is a layered 3D visualization: distances
are compressed and it is not to scale.
Open the clickable page →
Layered 3D visualization, not to scale · 19 seconds
Every pixel of sky comes from the Webb image
The red glow is the cluster's hot gas, from the Chandra X-ray picture
Each galaxy sits at the distance its published redshift gives
Motion blur from 16 renders averaged per frame, delivered at 1080p and 4K
Image: NASA, ESA, CSA, I. Labbe (Swinburne University of Technology), R. Bezanson (University of Pittsburgh), A. Pagan (STScI) · X-ray: NASA/CXC/ITA/INAF/J.Merten et al · colour-graded · Webb imageCC BY 4.0
Problems solved6 of them
What was broken, and what I did about it
The command center above is the headline. These are the other six: smaller,
less visible, and closer to what most program work actually looks like. Each
was quietly costing the business something, and each got a mechanism that
stopped it.
The same tickets kept coming back. The incident team was absorbing
repeat volume as though it were new work, month after month, because nobody
owned the causes, only the symptoms.
What I did
Stopped treating it as a queue problem and went upstream to the engineers who owned the code. Joined their code reviews, production change deployments, UAT and service-graph monitoring, so recurring failures got fixed at source rather than re-triaged.
−15% ticket volume, year over year
The project tool was slowing intake approvals. The team's worldwide
portfolio lived in an internal project-management tool with non-critical bugs
and no clear fix path, and its malfunctions, including a failing approval
notification, were delaying project intakes by 10.5 days.
What I did
Led the move of the whole portfolio to Asana in 2023 and 2024, run with the team's managers as Scrum sprints of four weeks at most, with training for the team, while the old portfolio stayed live so projects in flight kept their cadence. By June 2024 all of the team's projects were in Asana.
Intake approval time: about 30 days → 6.5 days, inside a 7-day SLA · visibility and team response improved 25%
Why it matters: organizations whose enterprise-wide project office is aligned to strategy report 38% more projects meeting their original goals and 33% fewer failed projects than those with low alignment (PMI, 2017), and initiatives with excellent change management are seven times more likely to meet their objectives than those with poor change management (Prosci).
Every region reported differently. Worldwide teams each had their own
format and cadence, so leadership couldn't compare two regions, let alone see
the whole picture, and problems stayed local until they were large.
What I did
Designed and implemented the Transportation Risk Compliance Weekly Business Review across every worldwide regional team: one format, one cadence, one milestone-and-risk view.
A single comparable view across all WW regions
Compliance gaps only surfaced in audits. By the time a
process gap was found it had usually been live for months, and the delivery
partners closest to it had no way to report what they were already seeing.
What I did
Ran four process-gap projects through Scrum sprints on employee-registration compliance, and built self-serve intake so Delivery Service Partners could raise risk directly instead of waiting to be audited.
−20% related contacts · +10% partner satisfaction
Five functions tracked the same launch separately. Finance, Legal,
Accounting, Tax and Trade each held their own obligations for the satellite customer-terminal launch,
in their own documents, so no one could say whether the launch was actually
covered.
What I did
Built a risk framework and a deliverable-traceability tracker across all five functions, and ran the weekly cross-functional forum that kept them aligned to launch milestones.
Compliance and milestone commitments held across 5 functions
A launch cost couldn't get approved. Transportation costs for the customer-terminal launch sat
unapproved because the requirements had never been reconciled against
jurisdiction-specific cost rules, so leadership had nothing it could
responsibly sign.
What I did
Aligned the launch requirements against the jurisdiction rules that actually governed them, then proved the numbers through user acceptance testing across each fulfillment stage before taking it up.
Leadership approval secured for the launch's KYC transportation costs
CapabilitiesTools · methods · credentials
What I bring, and how to check it
Incident & crisis
Major incident management · incident command
Command center operations · 24/7 follow-the-sun
SEV1 / SEV2 response · escalation management
Cyberattack, server & cloud-outage response
Seller-trust & account-protection incidents
On-call & paging design · MTTR reduction
Service monitoring & alarming
Problem management · post-incident review
Crisis communication
Incident desk as a shared service · multi-team onboarding
Tableau · Amazon QuickSight · Amazon Quick Suite · SQL
Claude / LLM tooling · Tampermonkey · AWS S3
Figma · SharePoint · Slack · Teams · Zoom · Baan
Credentials
PRINCE2 Agile® Foundation & PractitionerSureSkills · 2022 · ID GR656247640MJ
Scrum Master Professional CertificateCertiProf · 2022
ITIL® Foundation Certificate in IT Service ManagementPeopleCert · June 2017 · ID GR750315196MJ · trained at Universidad Cenfotec
Technical Associate, Project ManagementInstituto Tecnológico de Costa Rica · 2015–02/2016
Portuguese Language CertificationCEBI Institute of Costa Rica · 2015
Formal project management education grounded in the PMI PMBOK® Guide
(5th Edition), the body of knowledge on which the PMP credential is based.
Verification & references
PRINCE2 Agile® credential IDGR656247640MJIssued by SureSkills, 2022, verifiable with the issuer
Employment historyAmazon · 2012–2026Six roles across four organizations; confirmable through Amazon's verification service
Professional referencesAvailable on requestFormer directors and peers from SPS Incident Response, TRC and Amazon Leo
Every metric on this page comes from a documented program outcome or my own
measurement of it, and is attributable as direct or led. Nothing here
is a shared result claimed as sole ownership. Happy to walk through how any figure
was measured.
Open to senior program, technical program & incident response roles
Let's talk about the bad day.
I'm most useful to teams that have outgrown informal escalation. Incidents,
risk or launches are still handled by whoever happens to notice, and it's time
that became a mechanism. Based in Washington, DC; open to remote, hybrid, or
relocation.