Blog
Real stories from the compliance, FinOps & operations battlefield
Learnings, frameworks, and lessons from 15+ years implementing ISMS, optimizing cloud costs, and scaling Service Delivery teams in fintech and digital banking across LATAM. No vendor pitch. No fluff.
How much certification costs, how long it takes, and what evidence regulators ask for.
Compliance (ISO 27001 · SOC 2)
How much certification costs, how long it takes, and what evidence regulators ask for.
The day they asked you for the evidence
2015. We were still a small startup, but we'd reached the point where 'everyone does things their own way' stopped being an agile virtue and became a risk. When you define the process yourself, the first audit that asks you to show evidence feels like a threat. It isn't: an audit is about the processes, not the people.
How much does ISO 27001 certification cost and how long does it take in Mexico?
The cost of ISO 27001 certification in Mexico ranges from $80,000 to $450,000 MXN for startups and SaaS/fintech companies, with a typical timeline of 9 to 14 months. I explain what each cost block depends on, why it varies so much between providers, and why an initial diagnosis is the cheapest way to avoid over-quoting or under-estimating the project.
How to choose an ISO 27001 consultant in Mexico?
Before hiring, evaluate five objective criteria: the consultant's real certification (Lead Auditor, not just a 'specialist'), whether you work directly with the person who executes, whether the scope also covers cloud costs and account health, price transparency, and whether support continues after certification.
Should your organization move from the annual pentest to continuous AI monitoring?
The annual pentest model is no longer defensible when the environment changes daily. Continuous validation with agentic AI is already a formal market category (Gartner: Adversarial Exposure Validation, 2026). The real challenge is no longer the technology, but governance: who owns the finding when the one detecting it is an AI agent.
The real cost of not having ISO 27001: lost contracts and how to quantify them
The most common cost of not having ISO 27001 isn't a fine — it's the contract, tender, or funding round that's silently lost. Certification is no longer a differentiator: it's the minimum entry filter in enterprise purchasing. A 3-question method to quantify the loss.
Information security for fintechs in Colombia: what the SFC requires in 2026
Mandatory open finance (Decree 0368/2026), cybersecurity (External Circular 007), SARLAFT 4.0, and sensitive biometric data. Why ISO 27001 is the most direct way to demonstrate compliance with the SFC.
Information security for fintechs in Peru: what the SBS requires in 2026
The Open Finance Department, the Banking as a Service (BaaS) regulation, the sanctions regime, and Legislative Decree 1700. Why the SBS turned security into a requirement, not an option, for fintechs.
Why is compliance shifting from an annual event to a continuous service?
The Compliance as a Service market already exceeds $6 billion and keeps growing because companies are abandoning the "get ready before the audit" model in favor of always being ready. What the shift means, why the annual audit is no longer enough, and how to adopt it.
How to get product to prioritize a SOC audit control
Product saw the access control as a low-priority technical matter. Translating it into contractual risk — a qualified opinion, penalties from key clients — changed the conversation. The change landed in the sprint and the SOC opinion came out clean.
The security requirement that almost blocked a go-live, and how it was solved in a week
A bank in Peru demanded custom tokenization weeks before go-live. The requirement had been mentioned several times, but nobody escalated it as a blocker. Escalating it as P1 got it delivered in under a week.
The security risk nobody sees: active access from people who no longer work with you
Manual tickets to deactivate former employees: 10–15% of a Colombian bank's monthly volume, urgent by nature. Automating offboarding-email detection removed the risk, the volume, and later served onboarding too.
Why scaling compute masks the real problem and how to regain control of spend.
FinOps (Cloud Costs)
Why scaling compute masks the real problem and how to regain control of spend.
The cost nobody sees: users, non-production environments, and the contract gap
Your total cloud bill doesn't tell you whether your architecture scales well — cost per user does. A real story about defining a non-production vs. production benchmark, closing the contract gap around QA SLAs, and what to do when a client saturates your test environments without bad intent.
The end-of-month Pantitlán station: why scaling well is more than scaling cheap
Sizing infrastructure so it never fails, without looking at real usage data, almost always means overpaying the whole month to cover a peak that happens a few days. How to detect silent overprovisioning and why autoscaling needs to know the business calendar, not just the time of day.
FinOps — The PDF that cost $1,500 a month for an unsupervised design
How much does a bad cloud architecture design cost, and how do you fix it at the root? A real case: a Chrome instance that was never closed drove over $1,500 USD/month in avoidable costs. The real fix wasn't more compute — it was fixing the root cause and migrating to Kubernetes.
The client who was taking everyone else down, without meaning to
One tenant saturated the shared compute capacity and caused timeouts that affected other clients on the same platform. The fix was a circuit breaker — isolating and backing off that consumption — the pattern Netflix popularized with Hystrix.
The variable that should never have changed between environments — and did
A banking integration component didn't treat environment variables as immutable between QA and DEV — the first change disabled real operations. Configuration failures are the #1 cause of outages (Uptime Institute 2026).
How to reverse a negative NPS, avoid silent churn, and scale the operation.
Customer Success
How to reverse a negative NPS, avoid silent churn, and scale the operation.
From negative NPS to +24: the Customer Success turnaround we did at Formiik
When we started measuring NPS on a new client, the numbers were in the red and the 52 enterprise accounts across 7 countries showed signs of silent churn. We identified friction points in each stage of the customer journey, engaged the client directly, and defined a stabilization and improvement plan. In 12 months, NPS was +24.
Project Fenix: when your client wins an international award and you were behind the operation
Our largest client in Peru —with 2,000+ field users and 300+ offices— won the 2026 Innovation Excellence Award from Global Banking & Finance Review with Project Fenix, a field-agent digitization project. The platforms we operated were the key tool, and I was serving as Director of Operations making sure everything ran at the level a project of this visibility demanded.
The 30% of tickets that never should have been ours
A client headcount reduction left us absorbing work outside our contractual scope. The fix wasn't just automating — it was automating first and renegotiating scope after: 70-75% less configuration time, 40% fewer tickets.
When "it's simple" doesn't mean "it's worth it"
A stakeholder insisted on a visual feature described as a "simple quick win", while the real business backlog stayed unfinished. Holding the right priority —not the loudest one— is what allowed the project to scale to every client office.
When there's no playbook, build the missing piece
Different clients got stuck at the same integration step. Instead of waiting for the roadmap, we built a .NET base project with the classes ready: 10–15% less integration time and nearly zero repeated sessions.
Why 20% of your repeated tickets should never have been reopened
Closing tickets fast is incident management. Treating known errors as their own category — Problem Management — cut repetitive cases by more than 20% over two years, sustaining 97% CSAT, +60 NPS, and 99.95% uptime.
First-person stories and reflections on operating SaaS platforms.
Leadership & Operations
First-person stories and reflections on operating SaaS platforms.
The compute that masks problems without solving them
Your platform isn't slow because it lacks compute. And deep down, you already know it. After 15 years running software in production, I learned the most expensive technology fails if there's no team that operates it well. Scaling infrastructure is politically easier than finding the root cause — but the underlying problem stays.
When one person's departure almost cost us the account
A key contributor left unplanned from a fully in-person banking account served remotely — metrics sank. An on-site intervention and a structural shift from remote to local reversed the trend and rebuilt trust.
The evidence that built trust where there was no hierarchy
An integration error caused false positives between our platform and a client's banking core. Without formal authority over the external vendor, irrefutable evidence —not hierarchy— got the collaboration and the fix.
Why a hotfix for a "known" problem can take down the operation
The hotfix did fix the root cause — but the UAT pipelines pointed to an obsolete TenantId. Familiarity with the problem meant nobody assessed the risk. 35 transactions affected. A checklist to prevent it.
The 15-20 hours a week a 7-country team lost to manual maintenance
Manual backups, database tuning, resizing resources: 15–20 weekly hours, nearly half an FTE, on a 7-country team. Automating with runbooks cut it to nearly zero in two months, without adding a person.
The error that wiped 5,000 records, and the lesson I still use 15 years later
As a junior developer I ran a poorly scoped query and affected ~5,000 shipment records. What defined the outcome wasn't the error — it was my leader's reaction: impact, options, communication. I still use it 15 years later.
Stories about developing, course-correcting, and caring for the people on a team.
People Leadership
Stories about developing, course-correcting, and caring for the people on a team.
The 6-hour feature that should never have been built
A new manager was about to request a 6-8 hour feature the platform already handled. Showing the reports live avoided the build and built their mental model. Context: engineers spend 17.3 h/week on technical debt (Stripe).
What the numbers didn't explain — until I asked
A team member's performance dropped for no apparent reason. Instead of watching them, I asked: it was a health issue, not a commitment issue. Adjusting their schedule restored their numbers. Context: 86% of employees value empathetic leadership (EY).
Why a talent development plan fails (and how to catch it early)
An impeccable plan on paper: defined courses, regular feedback, a clear destination. What was missing was the person's conviction. The training was never completed and they left for performance. Dated milestones and an honest conversation.
The overtime nobody sees: preventing burnout on a support team under pressure
A headcount reduction left us over capacity: 30–40% of cases were out-of-contract configurations. The risk wasn't the overtime — it was the overtime becoming part of the landscape. Compensation by choice, a visible plan, and automation.
How we built, from scratch, the team that later generated more than half our ARR
Four people built with no defined process, documenting while serving clients. Assigning responsibilities by each person's real strength and resolving disagreements with objective criteria — not hierarchy — held it together. That team generated more than 50% of ARR.
Why we took 30% longer to hire a DevOps engineer, and why it was worth it
We depended entirely on Jenkins with no internal expert and R&D was blocked. Pressure said "hire whoever keeps it running". We waited for someone who could truly modernize: they retired Jenkins, migrated to Azure DevOps, and mentored today's infrastructure leaders.
When someone didn't choose the role they were asked to lead
A colleague became the CEO's Chief of Staff during a restructuring — a role she didn't choose. The support wasn't about process, but communication: bringing real concerns to the CEO without softening them. Commitment reliability improved by more than 25%.
The feedback that was hardest for me to accept, and how I turned it into a habit
Direct feedback that executive communication was a real area for improvement. Instead of getting defensive, a concrete plan and AI as a second pair of eyes when preparing executive summaries. Still working on it: continuous practice, not a checked box.
Agreeing with the decision, disagreeing with how it was communicated
The CEO split the team into implementation and support. The assignment of people was never discussed with me first, and I was direct with my leader about disagreeing with the form — not the decision. The specialization accelerated onboarding and enabled expansion.
Want each article in your inbox?
No spam. One real story every 2-3 weeks about what works (and what doesn't) in compliance, cloud, and operations for fintech.