Jon Scolamiero Breaks Down DevOps Transformation, AI’s Influence, and Compliance Needs

Hey, everyone. Welcome back here to Text Junk tv. Let me introduce you to John Kuro.

Kuro. Yeah, I'm scallop. You got it.

Perfect. All right. Hey, John.

Um, John is the CSO and lead product manager of for America's for Mendix, which is actually a Siemens company, a Siemens business. But, um, John, first of all, welcome to Techstrong tv. It's great to have you on here, Man, it's a real pleasure to be here, Alan, thanks for inviting me and, uh, allowing us to talk a little bit about, uh, what's going on in the wide world of DevOps.

So, I'm, I'm pretty excited. Always Good stuff going on. But before we get into that, John, let's talk a little bit about you.

As I, as I mentioned, you know, we were gre rooming there for a while. It's not often, especially in a non-security company, or every company's a security company in my world, but in a company that's not known necessarily as a cyber company, where we see a CISO is also the lead product manager. Yeah.

So I want hear about that, but let's, let's take it from the beginning. You were born and then what happened? I mean, I spent 20, I'll just kidding.

Yeah. So, prior to joining Mendix, I, I had a, a, a little over 15 years in software development architecture, uh, including working at some of the largest names in energy and finance. So, uh, in fact, I, I like to joke around that, uh, you know, uh, often that, uh, I would end up with managers who'd say, well, I, I used to code, but I don't do that anymore.

And I, I joke, 'cause I'll say, oh, actually I still code in, in my free time for fun. So, uh, it kinda keeps me fresh. Um, then, uh, through a number of different, uh, circumstances, I ended up landing at Mendix, which is a low code software development platform.

Um, partially because I worked for a company that was a customer of theirs, and I really liked, uh, the, the modeling approach that Mendix was taking. Um, and so that led to, uh, multiple different, uh, roles here at Mendix. And most recently I've been leading up the, the field product management for Americas.

And that then led into the field CSO role, which is interesting because what, uh, my, my European colleagues have found is that the security posture and the governance posture within the Americans is very different than what they're used to. And understanding that, and tailoring a low-code soup to nuts software development lifecycle that fits into that sort of box is really difficult, especially if you're not used to thinking that way. It doesn't mean it's impossible.

It doesn't mean we can't be cloud first or cloud data while doing it, but you have to like check the boxes. And as we got more and more into the highly regulated spaces, including federal, uh, they needed somebody who was a US citizen on US soil to show up and understand not just the technical side, but the security side as well. And it just sort of naturally flew with my background.

So that's how I ended up with the CISO and the, uh, the field product manager title. So, a little, uh, complicated. I love.

Hopefully not too crazy. No, not too crazy at all. What a great, you know, I, 'cause I will tell you, you know, I have about 30 years in tech, other than the last 10, 12 years more, more, I was a startup guy.

Mm. And about 25 years in security. And, um, though I think today we see the EU probably has a little bit more process, a little bit more rigor in, in security compliance.

Once you start getting into the highly regulated industries, you know, finance, healthcare, and then once you get into the fed space, which it might last security company, about 65% of our business was, was actually DOD. Mm-hmm. And, and DOD and agencies, you know, the three letter agencies.

Yeah. Um, then you then, you know, now that cyber expertise and, and the amount of, uh, of, uh, cyber, uh, certifications and accreditations really, you know, gets ratcheted up a lot. I spent an awful lot of time at, uh, Fort Chuca, for instance, and the Army Information Assurance technology labs there, getting our products, uh, certified and so forth.

So it, it makes a lot of sense to me. Um, you mentioned no-code mm-hmm. Mentioned mendix, and I think mendix is to a certain extent with some of our audience, synonymous with no-code, low-code, no-code.

Um, how does that, is that a good, does that make you feel comfortable or not quite Alan? So, so I, I, uh, I would put it solidly in the low-code bucket. Um, and I think one of the things that attracted me to Mendix when I was on the customer side of the equation is that every conversation I had with Mendix was about respect.

It was about respect for the person doing the work and the respect for the person trying to get value out of the work, right? Uh, so you kind of got respect on both sides of the coin, and they gave you a beautiful modeling environment, but the minute that you needed to flip the switch and dive into code or do something more complex, they didn't hold your hands or try to lock you in. They instead said, go for it, and here's how you hook into us.

And that, that openness is very attractive. And I actually think as we get into more of the AI conversation, that that sort of openness, that approach is very relevant as we think about things like AI transparency and trust and, and responsibility. And it also helps you understand, uh, in your DevOps and software development lifecycle journey, what's happening at each piece of the puzzle.

So that way, not just the doer, but the stakeholder knows what's happening. And I, I think that's, that's really important. So I feel like we, we solidly fit into the low-code space, um, rather than the no-code space.

Uh, and I don't think that, uh, our goal is to enable everyone, we have the, the slogan go make it. Our goal is for the makers and to enable the makers to do, to do good work, if that makes sense. Absolutely.

Absolutely. John, John, I wanted to segue into DevOps. Mm-hmm.

Right? com. com in 2013 14, um, a lot of people may say, wait a second, how does low-code, you know, fit into the DevOps kind of puzzle?

Um, but it does, right? Because it, it, it's about automation, it's about kind of breaking down the silos and all of, you know, just because we're doing this in a low-code environment doesn't mean that we don't have the same issues around deployment, deployment, security mm-hmm. Operating that code, you know, everything else that we, that goes into a modern, you know, software factory, if you will.

But, you know, from where you sit, John, how do you see that connection? Well, you know, it's really interesting that you bring that up because it's, I like to say there's no such thing as magic. The rules and laws of physics still apply, okay?

Mm-hmm. At the end of the day, you know, it's still, it may be terraform, it may be helm charts, whatever it is, there's still a thing doing the work on the soup and nuts and, and bolts underneath the covers is just how you present that to the end user or to the stakeholder that matters, right? So it, it, at the end of the day, whether you are looking at a series of DevOps experts or you're literally just looking at an old Windows administrator, at the end of the day, they're still trying to get a piece of capability into the hands of somebody to get some sort of value out of it, or in order to manage that, to understand what's going on.

And so our approach at mendix is to just make that transparent, but still automated and put some nice packaging and wrapping around that. So for example, if you want a fully managed SaaS offering, we've got that. If you need to own and control your own environment and understand every step of the way, and we've got that too.

If you understand how to build pipelines in Jenkins or Azure DevOps, go for it. If you need a pipelines product that does it for you, we have that too. So it's sort of, it's at the end of the day, you're still packaging and shipping some piece of, uh, executing software.

It's just at what level do you need to know and understand that to be successful? And what, at what level can your organization know and understand that, you know, Uh, agreed. I agree, agree, agree.

So, John, you know, DevOps, well, for me anyway, DevOps is a subject area, a market that has been evolving, changing since every, you know, since I first encountered it 14 years ago, um, 15 years ago. But obviously we live in interesting times. We've got AI and the rise of shadow ai mm-hmm.

Vibe coding, right? We're, we're turning out more code than we ever did before. Uh, you know, and there it's like, and as if we didn't have enough toys to play with, AI has rendered, you know, infinite amount of new toys and apps and methodologies.

Mm-hmm. Um, platform engineering, another big thing that has risen, let's say in the last four years, maybe five years, as you look at the DevOps space now, and, and, you know, let's qualify that as it applies to the mendix business, as it applies to low code. How are all these, I don't wanna call 'em AI as a mega trend Yeah.

But how are all these different trends kind of shaping the market and what you see going forward? Well, I think, I think one of the trends that I'm seeing, and I think it's, it's a change. Um, I, I am unfortunately, uh, I hate to say it, but I'm old enough to remember when DevOps was, was controversial when you would say DevOps and people would just freak out and not really understand what you're talking about.

Um, and, you know, uh, I think there's also a lot of, uh, denial and sort of avoidance that, that entered the equation. I got the scars to prove it, my friend. Yeah, yeah, yeah.

com, right? Yeah. I, I caught the bread to that.

0, which is a, a new standard that's come out from the federal government around, uh, contractors doing business and, and the technical, the technical rigor that they have to go through to prove that they're secure enough to do business with the government these days. And the message, the message there, and it actually, if you look at the controls, DevOps solves so many of them if you do it right and well, and the message at the bottom line is it's not optional. It is now non-optional.

And moreover, it's not optional because it's safer, it's more secure, and it, it enables and empowers your people to do the work that they need to do rather than restricting them. It's not a control mechanism, it's an enablement mechanism that you can build safety, security, and governance around The tricky part here, and I think you look at all these trends like vibe, coding, um, you know, uh, a AI in the loop, human in the loop for AI and, and all of the other things that are going on, how that fits into the software development lifecycle and how you, you, and I think governance is an abused term, but how you govern control and, and build in safety without growing the pendulum too far in one way or the other is, is really key. I think some of that we're starting to get figured out, and some of that ha has not been figured out at all yet.

Um, and in fact, I think 2026 is, uh, uh, was actually a prediction. We just, uh, released, I think 2026 is the year that we have the major ai, uh, security breach. I think that, that we haven't had the major AI explosion yet.

This is the ma this is the year something goes wrong, right? Like the, the target breach or, or something similar, the EE Equifax breach, right? This is the year we have that for ai, and it's not because that's impossible to control for now, it's that we are not being as responsible and transparent and trustworthy as we run this race as we should be.

Uh, which, you know, kind of is, is, you know, uh, expected, but with great power is, you know, the same goes, comes great responsibility. And those capabilities are key. So what we're doing at Mendix a little bit, and I I hate to self plug, but we are really honing in on not just enabling and empowering people to go build and make, but also to understand, you know, there's always a human in the loop.

There's always a, a guard and a check. But then that responsibility and trust needs to be visible to a layer of people who don't understand how the technology is executing what it's doing. And that's true.

Whether, whether you're building the software or whether you're deploying it. And I think a, a very poorly, I don't wanna say it's poorly understood, it's not widely understood, but this concept of software supply chain is just so crucial and critical, as you can see with some of the recent issues with MPM packages, um, and the recent breaches there. It's something that we have to get our, our hands around in a way that is enabling and empowering, uh, rather than, you know, uh, I think you and I are both old enough to remember the, uh, the fallout of Sarbanes Oxley and, you know, we just quadrupled the time it takes to get anything done.

We don't wanna end up in that scenario again, if that makes sense. Right? Absolutely.

And I, I think, you know, that's a high wire balancing act, right? Providing compliance that's worth its salt versus the level of, of, of bureaucracy, if you will. And, and it's something we, you know, as, as we move from EU to, to North America, you know, there, there, I think there is a different, uh, focus.

I I, it's not focus, you know, what it is in America. I don't know if we have the political will to get things done as much as they seem to have over in the EU with some of these newer compliance, even just AI itself compliance. Mm-hmm.

Right? The EU is kinda way out in front of that. We're still talking about how much, you know, trillions of dollars we could gather up to spend on this thing.

Um, so I, I do, it's gonna be an interesting, I think, look, these things have a way of kind of smoothing out over time. Mm-hmm. And it's gonna be an interesting couple of years here as, as we see sort of, you know, the, the quest to do more fast versus the, the, the imperative to do it safely and securely.

Uh, they gotta cut, you know, at some point they've gotta come together. They can't exist in two separate kind of, uh, points. But yeah.

Anyway, Sorry, go ahead. No, no. I was just gonna say, I, it's, it's gonna be, it, it's interesting time.

I mean, there's so much going on and it's, it's, it's interesting times, John. I I wanted to let people know, look, if you're interested in what we're talking about here, if you're interested in what Mendix is about and what they're doing, John, what's the best way to engage with Mendix? Oh, that's easy.

com. Uh, we have lots of, whether you're in the defense space, the industrial space, finance, banking, whatever, we have lots of, uh, user information, user stories, user journeys, testimonials, uh, you can get demos. We also have a lot of really good, well thought out, um, white papers and guides around, uh, governance around, uh, executing and, and building COEs around how do you do this in a highly regulated, uh, fashion, right?

A manner we've, one of our most popular guides is the, the guide for our defense industrial base, uh, folks. com. Um, you can also reach out to me.

com. I'm happy to connect you with, uh, with the right folks here at Mendix. Um, and you know, Alan, there's, you know, there's some interesting trends here around, um, what vibe coding is, what AI can really do, but also the cost in human capital, the cost and human knowledge, and understanding that, you know, we're just starting to be able to tackle.

And I think it's, it's, they're interesting discussion to have. com and, uh, tech tv. I, I really like some of the thoughts that are going on there, especially around responsible ai.

And I, I really look forward to seeing more of that content up. So, uh, it's been a real pleasure to be here and talk with you a little bit about it. Certainly.

Well, John, don't worry too much. Elon says the robots are gonna take all our place. Oh yeah.

We're gonna eliminate poverty, and we're all going to get a basic income, a livable, basic income. So let the good times roll. Um, anyway, John, it's a pleasure having you on.

Keep up the great work. Come back and visit us. Keep us posted on what's going on at Mendix.

Okay. Uh, I'd love to, Alan. All right.

Cheers, sir. Thank you. All righty.

John Koro, ciso, lead product manager, America's, uh, from Mendix here on Techstrong tv. We're gonna take a break. We'll be back.