Manfred JohanningOpen to senior program, technical program & incident response roles

ManfredJohanning

Senior Program Manager · Incident Response & Program Operations

I build the operating systems behind resilient teams: incident response and business continuity, cross-functional programs, and AI that knows when a human needs to take over.

The operating foundationProjects · Programs · Organizations
01 / RESPONSEStabilize & learn
02 / DELIVERYAlign & execute
03 / AI OPERATIONSAssist & escalate
SHARED FOUNDATIONOwnership · priorities · judgment

Resilient execution starts with a shared foundation.

Response stabilizes the work and surfaces risk. Delivery turns those lessons into lasting improvements; AI helps detect and route the next exception.

Clarity under pressure. Systems that last.

68%
Reduction in average downtime from major events in the Command Center's first full year
2022 vs 2021
<5 min
SEV2 response after automating the on-call pager, against Amazon's 30-minute SEV2 guideline
Selling Partner Services · 2021–24
100+
Projects run through the portfolio and intake system I built
2020–2024
40+
Global business-continuity drills led across five sites

From seller support to the Command Center.

I joined Amazon in San José, Costa Rica, in October 2010 as a Seller Support Associate, after two years in technical support at Hewlett Packard Enterprise. Over fifteen years I moved from answering sellers to answering for the systems behind them: incident response, the Command Center I built from zero, then risk and program management in Arlington, Virginia. From 2018 I also ran my team's project work, and from 2020 to 2024 its worldwide portfolio, from intake and project office to the move to Asana in Scrum sprints. Since June 2026 I have been building AI tools for small businesses and a community association.

Tools & methodsAsanaScrumPRINCE2 AgileITILJiraSmartsheet

Trusted with

  • Hiring manager for the Command Center's major incident manager roles
  • Named single point of contact for Amazon's readiness assessment, Peak 2022 and Prime Day 2024
  • The shared-service business case, carried to director-level sign-off
  • Idea Champion for a seller-facing service health dashboard proposal, across three planning cycles

Start here2 min · with captions

What I do, in two minutes

A short animated walkthrough of my career, from the Command Center to programs to AI operations. Narrated in my own voice, captioned throughout. All 14 films ↗

At a glanceSeven chapters

The work behind
the outcomes.

Explore the command center, the programs built to last, and the software that puts those same operating principles into practice. Each chapter includes the context behind the results.

The thread through my work

Make the complex legible.
Give the work an owner.
Build the mechanism that lasts.

The operating principle / 01

Turn urgency
into ownership.

The Command Center brought four organizations onto one intake path, one severity taxonomy, and one escalation workflow.

SignalTriageOwner
<5 min

SEV2 acknowledgment
against Amazon's 30-minute guideline

Business continuity2021–2024 · drills and mock exercises

The plan gets used
before the day it matters.

Incident response handles the bad day. Business continuity makes sure everyone has practiced it first. At Amazon's Command Center I led the drills: with the Global Risk Framework team and site operations, we rehearsed weather, geopolitical and major technical events worldwide, so the people on shift knew their part before a real event.

Drills and mock events, worldwide
40+
Sites taking part
5
Site preparedness events
24
Improvement in critical-event communication response
15%
  1. 2021

    I ran tabletop exercises as disaster recovery plan audits. Each opened with an imagined incident at a site (an earthquake for a site in Costa Rica; the February 2021 Texas winter storm, hurricanes and tornadoes for a North America virtual site), walked the stakeholders through a readiness checklist from where the plan is stored to backup sites and restoration, and ended with action items that had an owner and a date. That October I started building the Command Center, with continuity in its remit.

  2. 2022

    Named single point of contact for the 41-question readiness assessment Amazon runs before its largest sales events, for the holiday peak across 20 countries: capacity, hiring, operations, readiness, resilience and risk, down to stress tests, mock drills and pager verification.

  3. 2023

    The first mock drill ran on 1 March and was recorded, so shifts that missed it could still use it. After it, and once the full program was in place, faster response and resolution times held. The drill program reached 40+ drills across five sites and 24 site preparedness events. Each site's plan started from a business impact analysis and a risk assessment, which fed the tabletop exercises.

  4. 2024

    The numbered drills continued: in January, drills 4 to 6 practiced the advisories and flash reports for events such as earthquakes and a fire near a site, each assessed for its distance to our sites and remote employees. Single point of contact again for the readiness assessment ahead of Prime Day 2024.

ScenariosWeatherGeopoliticalMajor technical eventNetwork outagePandemic

MethodsDisaster recovery plan auditsBusiness impact analysisSite risk assessmentTabletop exercisesRecorded mock drillsReadiness assessments

Watch the filmBefore the Day It Matters · 3:02How the drills fit the Command Center build

Videos14 films · 26 min · captioned

See it run.
Hear how it was built.

Vigil leads: the live uptime dashboard I built and launched in a day. Then the two-minute version of my career, a short on waterfall vs agile projects, a film on the practices that keep projects delivering, an explainer on the four AI building blocks I work with, four stories from the Command Center, and demos of apps I built for small businesses: a hospitality team, an independent notary and a condo association. Every narrated film is captioned, and two of the demos come in English and Spanish. Pick one. When it ends, the next one is ready.

CH 01 · VigilNew

Vigil · Uptime Command Center

1:56 · Narrated and captioned

A live uptime and incident dashboard watching three real sites: whether each one is up, how fast it answers, and how many days its certificate has left. You can safely trigger a test incident, and every outage gets a plain-language digest.

1 dayfrom written brief to tested build and launch

In this film

Recorded from the live site on 24 Sep 2026. The private client site stays unnamed.

0 of 14 watched

CH 01Vigil

My newest work, live now: a command center for my own sites, built and launched in a day.

CH 02Career story

The short version, the long version, a short about growth, waterfall vs agile projects, the practices that keep projects delivering, and the four AI building blocks I work with.

CH 03Incident management

Three stories from the Command Center, and what each one taught me.

CH 04Demos

Apps I built for small businesses, recorded running: hospitality, a notary, a condo association.

Case studySelling Partner Services · 2021–2024

Building an incident response
function from zero

DurationOct 2021–Nov 2024
Organizations served4 seller-trust organizations, run as a shared service from Dec 2022
People covered13,700+ employees · 40 in-house sites plus virtual sites
RegionsAmericas · EMEA · India · Southeast & East Asia · 24/7 follow-the-sun
Under watch50+ critical systems, plus external weather and geopolitical events
Team9 incident managers at handover · 6 dedicated to the shared service
Scope ownedHiring · budget · policy · intake · escalation design
Best measured week97% first response / 100% resolution inside service level, wk 5 2023

Four Amazon organizations were each absorbing major incidents on their own: Account Health Services, Payment Risk Operations, policy enforcement and Brand Protection. Together they form the seller-trust side of the marketplace: account integrity, payment risk, policy enforcement and brand protection. When one of them goes down, the checks that protect buyers and sellers go down with it.

Each had smart people who knew what to do. What they lacked was anything shared: no common intake, no common severity language, no single escalation path between them. When something broke across two of them at once, the first twenty minutes went into working out who owned it.

I was asked to build the function that would carry all four. There was no team, no budget line, and no playbook. The job was to create all three.

The constraint that shaped everything: I couldn't take authority away from four organizations that were each already accountable for their own uptime. So the Command Center wasn't designed as a body that takes over an incident. It decides how bad this is, finds who owns it, and gets them talking: fast, and the same way every time.

A year in, the question changed. It was no longer whether four organizations could share one desk, but whether their operations teams would take it on as a shared service. In December 2022 the desk opened as a shared service across all four organizations: 13,700+ employees across 40 in-house sites plus virtual sites across the Americas, EMEA, India and Southeast and East Asia, watching 50+ critical systems and the external events that take them down: weather, geopolitical, outage. It ran as a six-month pilot at no cost to the teams that joined, so the only thing holding them was whether the numbers moved.

In the first full week of measurement, three-quarters of externally triggered alerts were answered inside the service level. Five weeks later it was 97%, and every alert that week was resolved inside its target. That happened while monthly volume went from 71 alerts to 283, roughly four times the work in a month. The sub-five-minute acknowledgement carried over to the new service: across the weeks after launch it averaged 2.23 minutes on event alerts against a five-minute goal, and six minutes to resolve against a thirty-minute goal.

Watch: Seventy-Five Percent 1:06Watch: Two Minutes 2:21

One of the three regions opened at 36% attainment in December 2022: barely one alert in three inside the service level. It recovered to 68% in January on three times the alerts, and its weekly first-response attainment reached 100% in week 5 of 2023. The coverage and training work ran on through that quarter rather than ahead of it: ten in-person leadership sessions across two sites in February, with leadership from five stakeholder teams, and escalation training delivered region by region over the weeks that followed.

01

Stand up the organization

Hiring plan, budget and cost planning, role definition, and the coaching structure underneath it. Recruited and developed the team that would run a follow-the-sun desk.

9 incident managersBudget owned
02

Define the shared mechanism

One intake path, one severity taxonomy, one escalation workflow, agreed across all four organizations. This was the hardest part of the build and almost none of it was technical.

4 orgs aligned−35% change-related misses
03

Automate the response path

Replaced a hand-worked escalation chain with an automated on-call pager and a three-deep escalation ladder that opens a bridge on acknowledgment.

<5 min SEV2 ackvs 30-min SEV2 guideline
04

Build the measurement layer

Defined the KPIs and partnered with BI to build the executive dashboards in Amazon QuickSight and Tableau, so the function's value was visible to the leaders funding it rather than argued for.

Exec dashboards95% goal, 90% floorReported weekly, by region
05

See the failure sooner

Partnered with engineering to map 50+ critical service alarm graphs into a single monitoring dashboard, and wrote a Tampermonkey script that generated incident tickets straight from escalation data instead of by hand.

50+ alarm graphs−20% ticket-creation time
06

Rehearse the failure

Ran business-continuity activities with the Global Risk Framework team, covering weather, geopolitical and major technical scenarios, so the plan had been used before the day it mattered. The first mock drill was run on 1 March 2023 and recorded so the shifts that missed it could still use it. I was the named single point of contact for the desk in the 41-question readiness assessment Amazon runs ahead of its largest sales events (capacity, hiring, operations, readiness, resilience and risk) for the 2022 holiday peak and again for Prime Day 2024.

40+ activities5 sitesFirst drill recorded, Mar 2023
07

Sell it before launching it

A shared service only works if the teams being served agree to be served. The rollout ran as a change-management campaign with named checkpoints: in-person roadshows at two sites in Asia, virtual sessions for EMEA and the Americas, a stage-by-stage RACI written with one partner organization that moved incident tasks off its real-time analyst team so they could stay on impact analysis during an event, workforce-management sign-off, escalation training region by region, director-level sign-off, an incident playbook, mock drills, and formal three- and six-month post-launch reviews.

4 organizations onboarded10 roadshow sessions6-month pilot, no cost to teams
Service level held while the work quadrupled

Externally triggered alerts, worldwide · week 52 of 2022 to week 6 of 2023 · goal 95%, floor 90%

Worldwide service-level attainment, week 52 of 2022 to week 6 of 2023

The desk opened as a shared service in December 2022 and was reported on weekly from the start. Both measures crossed the 95% goal in week 4 of 2023 and stayed at or above it. Measured by month, from December 2022 to January 2023, alert volume went from 71 to 283, roughly four times the work, while worldwide attainment rose from 75% to 88% on first response and from 73% to 89% on resolution. The region that started furthest behind went from 36% to 68% month over month and reached 100% first-response attainment in week 5 of 2023. Attribution: led. Source: the program's own weekly service-level reporting.

The consoleVisual recreation

Illustrative reconstruction · 8 seconds
  1. 50+ service alarm graphs mapped
  2. Spot exceptions across services
  3. One shared monitoring view
Explore the detailed console reconstruction

Visual recreation of the tool built in 2022. The real systems were internal Amazon tooling and cannot be reproduced or shown. They were the executive dashboards in Amazon QuickSight and Tableau, and the alarm-monitoring dashboard I built with engineering that mapped 50+ critical service alarm graphs into one view. This reconstructs their KPI structure, severity taxonomy and escalation states. The incident queue, the shift and pager readings and the rolling signal trace are illustrative examples, not real events. The reported results are real: 68%, sub-five-minute acknowledgment, 35%, and the 40+ business-continuity activities, together with the regional first-response attainment for week 5 of 2023 and the weekly service-level chart above, both taken from the program's own weekly and monthly reporting.

Average downtime from major events

Indexed to the 2021 baseline · first full year of Command Center operation

0 50 100 100 2021 BASELINE 32 2022 COMMAND CENTER −68%

Reported as a 68% reduction against the prior year, roughly 18 hours of average event downtime removed. Attribution: led. Measured by the program's own downtime reporting.

Time to acknowledge a SEV2

After automating the on-call pager, against Amazon's general SEV2 guideline

GUIDELINE THE DESK 30:00 <5:00 0 min 15 min 30 min Well inside the 30-minute guideline

The pager replaced a manual escalation chain. The gain is in acknowledgment, not resolution: getting the right owner onto a bridge, not fixing the fault. Attribution: direct.

In hindsight

The tooling was never the hard part. Standing up a pager and a dashboard is a few weeks of work. The slow part was getting four organizations to accept one shared definition of SEV1. Each had its own leadership, its own metrics and its own reasonable view of what counts as an emergency. That agreement took far longer than any build, and it was the thing that actually made the numbers move. Every minute saved in the chart above was bought by an agreement, not by a system.

If I built it again I would spend the first month doing nothing but that alignment work. I would resist the pull to show early progress by shipping tooling into an environment that hadn't yet agreed what it was for.

The other thing that held was the audit. Every missed first-response and resolution target went to a monthly review and was adjudicated ticket by ticket as a genuine miss, a one-time exception, a mis-attributed resolver, or an allowance for a large-scale event or a ramping new hire. Roughly 430 of those ticket-level decisions were made across 2023 and 2024, and the flagged-miss count fell from 51 first-response and 35 resolution misses in August 2023 to 9 and 4 in August 2024. A service level nobody argues over every month is a service level nobody believes.

What happened next

The shared-service expansion, with its five mechanisms, the rollout and the weekly numbers, is written up as a one-page case study. Read “Four Organizations, One Desk” ↗

Track record2010 – 2026

Six roles, four organizations, one employer

One employer, but four genuinely different operating problems: seller support, incident response, transportation risk, and satellite hardware supply chain. Each came with its own stakeholders, tooling and failure modes. I joined Amazon in October 2010 as a Seller Support Associate; the six roles below start in 2012.

08/2025 – 06/2026
Senior

Senior Program Manager

Amazon Leo · Customer Terminal Supply Chain · Arlington, VA

Supply-chain program management for a satellite customer-terminal launch. Standardized how Finance, Legal, Accounting, Tax and Trade engaged with public-policy launches, and built the risk framework that kept their deliverables traceable. Also where I started building AI agents in earnest.

Portfolio managementRegulatory launchRisk frameworkAsana · SmartsheetAI agent
An Atlas V rocket on its launch pad at night
03/2025 – 08/2025
Senior

Senior Risk Manager

Transportation Risk Compliance · Arlington, VA

Designed the weekly business review that ran across every worldwide regional team, and drove four process-gap projects through Scrum sprints on employee-registration compliance. Built the mechanisms that let delivery service partners surface risk themselves rather than waiting to be audited.

WBR / MBR cadenceLast-mile / DSPComplianceExecutive reporting
Highway light trails at night, long exposure
11/2024 – 03/2025
Senior

Senior Compliance Risk Manager, Seller Support Quality (transitional role after reorganization)

Selling Partner Services · Arlington, VA

Joined the quality team, which runs programs that raise Seller Support associate performance, and partnered with business intelligence to automate its internal Appeals dashboard, replacing a manual report that took more than 12 hours a week. Managed a compliance audit report for about six weeks, reporting it to operations.

Reporting automationDashboardsAudit reporting
10/2021 – 11/2024
Led 9

Manager, Major Incident Response (Command Center)

Selling Partner Services · San José, CR → Arlington, VA

Built the Incident Response Command Center from zero for four seller-trust organizations and managed the nine incident managers who staffed it. Defined the KPIs and partnered with BI on the executive dashboards. Mapped 50+ critical service alarm graphs into one monitoring dashboard with engineering. Led 40+ global business-continuity activities under the Global Risk Framework.

Org build-outHiring & budgetMTTRService monitoring & alarmingBusiness continuityAsana migrationQuickSight · Tableau
Flight controllers at consoles in NASA mission control
07/2018 – 10/2021
Manager

Command Center Incident Manager

Selling Partner Support · San José, Costa Rica

Directed the Americas incident response team: five IR managers providing worldwide coverage and carrying roughly 65% of total critical-event escalation volume. Separately supervised 13 direct reports on the Seller Support operations side, and drove a 15% year-over-year ticket reduction with the case-management engineering groups.

Security & platform incidents · 2018–2021

Ran the response to a cyberattack, a main-server outage, AWS outages, and selling-platform and internal tooling failures. Together these critical events were about 15% of the team's incident volume. By this point I owned the bridge updates outright and wrote the event summaries that went to senior leadership and to engineering, which are two very different documents.

People managementCyberattack responseAWS outage responseChange managementProject intake & PMOTicket deflection
The Americas at night from space
02/2012 – 07/2018
On-call

Incident Response Manager

Selling Partner Support · San José, Costa Rica

Six years of on-call coordination for high-severity incidents across sellers, operations, directors and third-party vendors. Coverage spanned North America, India and Europe, weekends and holidays included. This is where the escalation instincts came from. Two events in particular taught me what the job actually is.

Weather events · Hurricane Sandy onward · seller account protection

A storm takes out a seller's power and connectivity. Suddenly they cannot reach their own account to pause listings, so they keep taking orders they have no way to fulfill, and the platform starts penalizing them for it. The fix was never technical. I coordinated proactive protection of the affected seller accounts. Then I made sure those sellers were actually told what had been done for them, with the internal messaging vetted through Ops and senior leadership first. We worked with engineering to put event banners directly into the seller communication path, so the warning reached people who were never going to read an email.

A dark data center corridor lined with glowing blue server racks
Major outage · 2016 · IAD

A server warehouse in Northern Virginia lost multiple nodes and took Selling Partner Services down end to end: the applications sellers use, the internal tooling Amazon staff use to help them, and the communication channels between the two. All at once. I drove the incident: opened and ran the conference bridge, owned escalation communication while the picture kept changing, and wrote the event summaries afterward. Losing your comms channels in the same event that created the emergency is a particular kind of problem. It is the reason I later built a command center with its own intake and its own paging path.

On-callIncident commandConference bridgeEvent summariesSeller commsSLA complianceAlarm monitoring
Satellite view of Hurricane Sandy over the US East Coast, October 29, 2012
Hurricane Sandy, Oct 29 2012 · NASA GOES-13

Selected programs6 shown

Things I built that outlived me

Each of these is a mechanism rather than a project, something that kept running after I handed it over.

Incident Response
68%

Average major-event downtime cut in the Command Center's first full year

Incident Response Command Center

Built from zero for four seller-trust organizations (account health, payment risk, policy enforcement, brand protection): hiring, budget, policy, intake mechanisms and escalation workflow design. Managed nine incident managers; SEV2 response inside five minutes.

Governance
5 functions

Held to customer-terminal launch milestones through a weekly cross-functional forum

Five-function risk framework, Amazon Leo satellite launch

Risk framework and deliverable-traceability tracker for Finance, Legal, Accounting, Tax and Trade, plus a centralized Asana and Smartsheet portfolio covering scope, schedule, budget and risk across the customer-terminal supply chain launches.

AI-enabled delivery
22%

Reporting time removed by an enterprise LLM agent for portfolio consultation

AI agent on Amazon Quick Suite · Amazon Leo, 08/2025 – 06/2026

Project and dashboard consultation agent with an FAQ knowledge base generated from business requirement documents. Automated weekly Asana summaries; stakeholder satisfaction up 35%.

Portfolio
100+

Projects managed on a governed intake and review framework

Project portfolio & intake governance, 2020–2024

Standardized the team’s worldwide project intake and set up its approval committee and project office in 2020 on an internal project-management tool, with monthly project flashes for the North America, Europe and India teams and a bi-weekly intake report for their managers. Redesigned the team intake in 2022, cutting its approval chain from eight approvers to six and its required fields from eleven to seven, then led the portfolio’s move to Asana in Scrum sprints in 2023 and 2024.

Business continuity
40+ drills

Run worldwide across five sites with the Global Risk Framework

Business Continuity Drill Program

Mock weather, geopolitical and major technical events with the Global Risk Framework team and site operations: 40+ drills across five sites and 24 site preparedness events, improving critical-event communication response 15%.

Operating cadence
Worldwide WBR

One milestone-status view for leadership across all regional teams

Transportation Risk Compliance Weekly Business Review

Designed and implemented across all worldwide regional teams, with mechanisms letting the Delivery Service Partner team surface risk and process-improvement opportunities, reported through director level.

Digital illustration of a tree whose trunk and roots are glowing blue circuit traces, leaves rendered as small points of light

Software3 built at Amazon · 8 built on my own

Software I've built and shipped

Professional work first: three Claude-powered tools I designed and built inside Amazon, plus the console behind the incident-response case study. Then everything I've built and shipped on my own since, end to end, each clip the running application, recorded, not a mockup.

Internal toolsDesigned & shipped inside Amazon

Three Claude-powered tools, reconstructed

Three small applications I designed and built to remove recurring manual work from my own team's week. Together they drove a 30% efficiency gain. The screens are reconstructions; the originals ran inside Amazon systems and cannot be shown.

Illustrative reconstruction · 8 seconds

01 / CLAUDE-POWERED WORKFLOW

  1. Collect stakeholder threads
  2. Surface blockers and decisions
  3. Review the priorities that need you

Weekly email summary review

Collapses a week of stakeholder threads into the decisions that actually need me, with blocked items surfaced first.

Evidence P2 · attribution: direct

Illustrative reconstruction · 8 seconds

02 / CLAUDE-POWERED WORKFLOW

  1. Extract commitments from notes
  2. Assign owners and due dates
  3. Track tasks and follow up

Meeting-note action tracker

Pulls commitments out of meeting notes, assigns owners and dates, pushes them into Asana, and chases the ones that slip.

Evidence P2 · attribution: direct

Illustrative reconstruction · 8 seconds

03 / CLAUDE-POWERED WORKFLOW

  1. Raise an issue from anywhere
  2. Set severity and assign ownership
  3. Track status and keep people informed

Mobile issue tracker

Lets a program issue be raised, triaged and watched from a phone, built because the people who spot problems first are rarely at a desk.

Evidence P2 · attribution: direct

Also from AmazonVisual recreation

The command center console behind the case study

Before any of my own products further down this page: the incident-response console from the case study, mapping 50+ critical service alarm graphs and a platform-event signal trace into one view. Recreated here, not a live capture. Read the full case study →

Illustrative reconstruction · 8 seconds
  1. 50+ service alarm graphs mapped
  2. Spot exceptions across services
  3. One shared monitoring view
Explore the detailed console reconstruction

My products5 products · 2025 – 2026 · recorded running

What I've built and shipped on my own since

Five products built end to end: design, front end, data model and deployment. They are how I keep the operational instincts sharp on something I own entirely, and why the AI work on my resume is hands-on rather than supervisory. Each clip is the running application, recorded, not a mockup.

Videos3 demos · 2 narrated · EN · ES Watch three of these products run. The Operations Hub and the HOA platform each have a narrated one-minute demo in English and Spanish, and the notary's site has a short screen recording. They play in Videos, under Demos, after the incident management films. Open Videos
Avellanas Group · Operations HubREC
Operations Hub dashboard: property roll-up with open requests, items needing attention, drafts awaiting approval, and an AI-drafted booking reply queued for human approval. (animated screen recording, 10s)

Multi-property operations console

Avellanas Group Operations Hub

One workspace for a surf camp and its managed properties: reservations, guest inquiries, service requests and open issues in a single reviewed queue. Role-based access separates owners from site staff, Airbnb and WhatsApp threads land in one inbox, and (the part I care about) every outbound AI-drafted reply is held for human approval before it sends.

Role-based accessAI drafting + human gateMulti-channel inboxCapacitor
Notaría · Lic. JohanningREC
Public site for a Costa Rican notary: headline promising property transfers done right the first time, a cost calculator, and an explainer on why most of a transfer fee is tax rather than notary fees. (animated screen recording, 7s)

Public site + practice console

Notaría, a 40-year practice, online

Built for a Costa Rican notary with four decades of practice and no patience for software: large type, large buttons, one screen that says what needs doing today. The public side wins consultations by explaining the thing clients are never told: most of a transfer fee is government tax, not notary fees. A calculator proves it before anyone signs.

Next.js 16Cost calculatorCase & client managementWhatsApp intakeSpanish
Bitácora · AI Operations AgentREC
Bitácora operations panel: 23 active properties, 41 second average response, 86 percent resolved without a manager, a prioritized request queue, and an agent-decision panel explaining why a suspected pool leak was escalated to a human instead of auto-resolved. (animated screen recording, 10s)

AI operations agent

Bitácora, an agent that knows when to stop

Everything arriving by WhatsApp, email or form gets classified, prioritized and assigned before the manager opens their phone. The interesting panel is not the queue, it is the one on the right. The agent declined to auto-resolve a suspected pool leak: the potential property damage and repair cost crossed its auto-resolution threshold. It escalated to a human instead, with a photo request attached.

That is a severity threshold. It is the same mechanism as a SEV taxonomy, pointed at an AI rather than an on-call rota. You decide in advance what the system is allowed to handle alone, and what has to reach a person.

Agent triageEscalation thresholdsWhatsApp + email intakeSpanish
HOA platform · sample dataREC
HOA platform running a fictional eight-home building with sample data: a dashboard where a lit window marks each home that is current on dues, a repair task marked done while a squirrel delivers an acorn, and a rainy-day jar showing months of running costs saved. (animated screen recording, 13s)

Community operations

An HOA that runs itself

Eight homes, one board, and the same problem as any small operation: everything lived in somebody's inbox. Now every home sees the same ledger, repairs become tasks anyone can claim, and an assistant answers from the building's own bylaws. Resident and board views are separated by role.

It is the intake-and-ownership pattern from the incident work at domestic scale: a resident reports a broken light, and can then see who claimed it and when it closed, instead of asking the board. The latest pass makes pitching in feel like a game: a lit window for every home that is current on dues, and a squirrel that delivers an acorn when a task is done. The recordings use a fictional building with sample data.

Role-based viewsShared ledgerTask claimingBylaws assistantGame layer
REC
Guest services mobile app: room status showing freshly cleaned, buttons to report an issue or request cleaning, and open tickets for AC and Wi-Fi with staff responses. (animated screen recording, 10s)

Guest-facing mobile app

Surf Camp Guest Services

The guest half of the same system, wrapped with Capacitor for iOS and Android. A guest sees their room status, reports an issue, and then (unusually for hotel software) actually gets to watch the ticket move. It is the same instinct as the incident work: the person who reported the problem should never have to ask what happened to it.

CapacitoriOS + AndroidGuest ticketingStatus transparency

MonitoringVigil · live · built 24 Sep 2026

A command center for my own sites

The newest product, and the one closest to the incident work: a working uptime and incident dashboard that watches three real sites, live at vigil-uptime-command-center.vercel.app. It opens with a 30-second summary for hiring teams; the live dashboard is one click further.

Vigil · narrated walkthrough · 1:56REC

Uptime and incident dashboard

Vigil · Uptime Command Center

Three real UptimeRobot monitors: this portfolio, my studio site, and a private client site shown only as "Client community portal". For each: live status, response time split into DNS, connect, TLS and first byte, certificate days left, 90-day history, incidents and the alert path, plus an incident simulator. Every panel names its data source.

Two serverless functions do the work: a live probe of a fixed allowlist of sites, and a read of UptimeRobot API v3 through a read-only key held server-side. Measured on the live site: strict Content Security Policy, HSTS preload, no third-party requests, 417 automated tests, accessibility 100. It applies the discipline of the Amazon command center, where I partnered with engineering to consolidate 50+ critical service alarms into one monitoring dashboard. Built end to end with AI-assisted development, in Claude Code and Cursor.

Live probeUptimeRobot API v3Serverless functionsStrict CSP417 automated testsAccessibility 100

Client workPura Vida AI Labs · anonymized sample

An animated sales deck, end to end

A client-ready, bilingual sales deck: three market studies with every figure fact-checked, 19 slides in Spanish and English, six animated product demos and an explainer, and native PowerPoint with editable charts. I built it in one day by orchestrating AI agents for research, design, build and review. Shown here as an anonymized sample: names are samples and the demos are illustrative concepts. Watch the 40-second film →

Anonymized sample · 9 seconds
  1. Research: three fact-checked market studies
  2. Story: 19 slides, Spanish and English
  3. Motion: six product demos and an explainer
  4. Delivery: native, editable PowerPoint

VisualizationWebb image · Abell 2744

Pandora's Cluster in depth

A 19-second looping flight through the James Webb Space Telescope's image of Pandora's Cluster (Abell 2744), plus a web page where every one of the 9,578 catalogued galaxies in the picture can be clicked to see when its light left it. 29 featured objects are reachable by keyboard. The page loads nothing from other sites and sets no cookies. It is a layered 3D visualization: distances are compressed and it is not to scale. Open the clickable page →

Layered 3D visualization, not to scale · 19 seconds
  1. Every pixel of sky comes from the Webb image
  2. The red glow is the cluster's hot gas, from the Chandra X-ray picture
  3. Each galaxy sits at the distance its published redshift gives
  4. Motion blur from 16 renders averaged per frame, delivered at 1080p and 4K

Image: NASA, ESA, CSA, I. Labbe (Swinburne University of Technology), R. Bezanson (University of Pittsburgh), A. Pagan (STScI) · X-ray: NASA/CXC/ITA/INAF/J.Merten et al · colour-graded · Webb image CC BY 4.0

Problems solved6 of them

What was broken, and what I did about it

The command center above is the headline. These are the other six: smaller, less visible, and closer to what most program work actually looks like. Each was quietly costing the business something, and each got a mechanism that stopped it.

The same tickets kept coming back. The incident team was absorbing repeat volume as though it were new work, month after month, because nobody owned the causes, only the symptoms.

What I did

Stopped treating it as a queue problem and went upstream to the engineers who owned the code. Joined their code reviews, production change deployments, UAT and service-graph monitoring, so recurring failures got fixed at source rather than re-triaged.

−15% ticket volume, year over year

The project tool was slowing intake approvals. The team's worldwide portfolio lived in an internal project-management tool with non-critical bugs and no clear fix path, and its malfunctions, including a failing approval notification, were delaying project intakes by 10.5 days.

What I did

Led the move of the whole portfolio to Asana in 2023 and 2024, run with the team's managers as Scrum sprints of four weeks at most, with training for the team, while the old portfolio stayed live so projects in flight kept their cadence. By June 2024 all of the team's projects were in Asana.

Intake approval time: about 30 days → 6.5 days, inside a 7-day SLA · visibility and team response improved 25%

Why it matters: organizations whose enterprise-wide project office is aligned to strategy report 38% more projects meeting their original goals and 33% fewer failed projects than those with low alignment (PMI, 2017), and initiatives with excellent change management are seven times more likely to meet their objectives than those with poor change management (Prosci).

Every region reported differently. Worldwide teams each had their own format and cadence, so leadership couldn't compare two regions, let alone see the whole picture, and problems stayed local until they were large.

What I did

Designed and implemented the Transportation Risk Compliance Weekly Business Review across every worldwide regional team: one format, one cadence, one milestone-and-risk view.

A single comparable view across all WW regions

Compliance gaps only surfaced in audits. By the time a process gap was found it had usually been live for months, and the delivery partners closest to it had no way to report what they were already seeing.

What I did

Ran four process-gap projects through Scrum sprints on employee-registration compliance, and built self-serve intake so Delivery Service Partners could raise risk directly instead of waiting to be audited.

−20% related contacts · +10% partner satisfaction

Five functions tracked the same launch separately. Finance, Legal, Accounting, Tax and Trade each held their own obligations for the satellite customer-terminal launch, in their own documents, so no one could say whether the launch was actually covered.

What I did

Built a risk framework and a deliverable-traceability tracker across all five functions, and ran the weekly cross-functional forum that kept them aligned to launch milestones.

Compliance and milestone commitments held across 5 functions

A launch cost couldn't get approved. Transportation costs for the customer-terminal launch sat unapproved because the requirements had never been reconciled against jurisdiction-specific cost rules, so leadership had nothing it could responsibly sign.

What I did

Aligned the launch requirements against the jurisdiction rules that actually governed them, then proved the numbers through user acceptance testing across each fulfillment stage before taking it up.

Leadership approval secured for the launch's KYC transportation costs

CapabilitiesTools · methods · credentials

What I bring, and how to check it

Incident & crisis

  • Major incident management · incident command
  • Command center operations · 24/7 follow-the-sun
  • SEV1 / SEV2 response · escalation management
  • Cyberattack, server & cloud-outage response
  • Seller-trust & account-protection incidents
  • On-call & paging design · MTTR reduction
  • Service monitoring & alarming
  • Problem management · post-incident review
  • Crisis communication
  • Incident desk as a shared service · multi-team onboarding
  • Service-level design, attainment reporting & exception audit
  • High-volume sales event readiness · 24×7 incident bridges

Resilience & risk

  • Business continuity planning
  • Disaster recovery exercises
  • Operational risk management · global risk frameworks
  • Third-party & vendor oversight
  • Governance forums · audit traceability
  • Regulatory and public-policy launch support
  • Executive risk reporting
  • Mock drills, tabletop exercises & readiness assessment
  • Business impact analysis per site
  • External-event risk monitoring: weather, geopolitical, outage

Operating mechanisms

  • Operating model design
  • Intake & escalation workflow
  • Service levels & SLAs · standard operating procedures
  • Governance cadence · business review design (WBR/MBR)
  • Capacity & resource planning
  • Budget & cost planning
  • Program performance measurement
  • Service & tool catalogue · vital business function mapping
  • Severity taxonomy & prioritisation matrices
  • On-call runbooks, handover protocol & manager-on-duty escalation criteria

Program & delivery

  • Program & portfolio management
  • Project intake, approval committee & PMO setup
  • Tool migration & adoption: Scrum sprints and team training
  • Change & release management · UAT
  • SDLC partnership · dependency management
  • Team build-out & hiring · coaching
  • Executive & KPI reporting · roadmap planning
  • Process improvement & automation
  • Program events & workshop facilitation
  • Change management: roadshows, training & executive sign-off
  • Backwards-planned launch schedules · RACI & handoff design
  • Hiring-manager ownership: role definition to live requisition

Methods & tools

  • Agile · Scrum · Waterfall · ITIL · PRINCE2
  • Lean Six Sigma · PMBOK (PMI)
  • Jira · Confluence · Asana · Smartsheet · Workfront
  • ServiceNow · TestRail · Salesforce (Omni-channel, Cases, Quip)
  • Tableau · Amazon QuickSight · Amazon Quick Suite · SQL
  • Claude / LLM tooling · Tampermonkey · AWS S3
  • Figma · SharePoint · Slack · Teams · Zoom · Baan

Credentials

  • PRINCE2 Agile® Foundation & PractitionerSureSkills · 2022 · ID GR656247640MJ
  • Scrum Master Professional CertificateCertiProf · 2022
  • ITIL® Foundation Certificate in IT Service ManagementPeopleCert · June 2017 · ID GR750315196MJ · trained at Universidad Cenfotec
  • Technical Associate, Project ManagementInstituto Tecnológico de Costa Rica · 2015–02/2016
  • Portuguese Language CertificationCEBI Institute of Costa Rica · 2015

Formal project management education grounded in the PMI PMBOK® Guide (5th Edition), the body of knowledge on which the PMP credential is based.

Verification & references

PRINCE2 Agile® credential ID GR656247640MJ Issued by SureSkills, 2022, verifiable with the issuer
Employment history Amazon · 2012–2026 Six roles across four organizations; confirmable through Amazon's verification service
Professional references Available on request Former directors and peers from SPS Incident Response, TRC and Amazon Leo

Every metric on this page comes from a documented program outcome or my own measurement of it, and is attributable as direct or led. Nothing here is a shared result claimed as sole ownership. Happy to walk through how any figure was measured.

Open to senior program, technical program & incident response roles

Let's talk about
the bad day.

I'm most useful to teams that have outgrown informal escalation. Incidents, risk or launches are still handled by whoever happens to notice, and it's time that became a mechanism. Based in Washington, DC; open to remote, hybrid, or relocation.

Manfred Johanning
Manfred Johanning
Washington, DC