"This Is Fine" with Hunter Strategy

Why would a federal agency choose a small business for technology work when it isn’t required to? Host Matt Triner sits down with Kevin Belanga, Chief Growth Officer, and Roman Zhelenko, Director of Federal Capture, both of Hunter Strategy, to make that case from inside a small contractor.

They talk through how a smaller company hires faster and adapts benefits to keep good people. They also cover why fixed-price contracts with loosely written requirements can turn small changes into contract modifications, and how a small firm’s reputation shapes the way it treats customers. Kevin and Matt each share an example of Hunter adjusting course when a program’s plans changed partway through. The conversation then turns to how cloud lowered the cost of entry for small firms, what agencies could change in their solicitations, and why HUBZone sole-source authority goes almost unused.

Chapters

• 00:00 Intro
• 02:16 Matt sets up the episode and introduces Kevin and Roman
• 04:03 Why small businesses move faster on hiring and decisions
• 06:11 Flexible benefits: the co-working space example
• 09:21 Customer service and the spirit of the contract
• 12:35 Fixed-price contracts and the “that needs a mod” problem
• 14:29 Why reputation shapes how small firms treat customers
• 17:12 Adapting a program through the JEDI-to-JWCC transition
• 20:03 Redirecting obligated funds after a product acquisition derailed a program
• 23:54 How cloud changed the economics for small businesses
• 28:47 Leveling the field: key personnel requirements and coding challenges
• 33:17 Advisory down-selects and HUBZone sole-source authority
• 36:03 Why acquisition staff overlook HUBZone firms
• 41:15 Getting more from small business events and program office time
• Wrap-up
• Outro

This week, host Matt Triner has 2 Senior DevOps engineers unpack the realities of building software in DoD environment - from cloud lock-in, ATOs, and infrastructure as code to the documentation gaps that force teams to reinvent solutions. A candid look at why government modernization is often less about the technology and more about the systems around it.

Catch show notes and more for this and previous episodes on the Hunter Strategy blog.

Episode Chapters:

00:00 Introduction

01:28 The Impact of Outdated Computer Systems

07:17 Challenges of Migrating to Cloud

10:40 Bureaucratic Hurdles and Cultural Resistance

19:21 The Use of Kubernetes in DoD

26:03 The Role of DoD Hosting Providers

30:40 Recommendations for Improvement

30:57 Improving Acquisition and Workforce Training

35:34 Explaining Cloud Concepts and Compliance

39:27 Sharing Knowledge and Best Practices

40:55 Rethinking Legacy Systems

43:15 Closing Remarks

The Authority to Operate (ATO) process is meant to show that a federal system is secure enough to run. In practice it’s usually months of checklists, interpretation, and debate with assessors. Matt talks with Chris Sowers, CEO of Watchtower Security Consultants, about why ATOs are so hard: governance lags behind technology, agencies interpret the same rules differently, and vendors get caught between FedRAMP, impact levels, and their customers’ expectations. They also cover how to get through it anyway.

Chapters

• 00:00 Intro
• 00:34 Matt sets up the episode and introduces Chris
• 01:18 An ATO explained as a yearly car registration
• 03:09 California vs. Michigan: which agencies have the strictest ATOs
• 05:30 SolarWinds and how public scrutiny shapes security posture
• 06:02 FISMA’s ambiguity and why governance can’t keep pace with cloud
• 07:54 Not applicable vs. non-compliant: the MongoDB Community Edition example
• 11:01 Mitigating controls and alternate implementations
• 12:44 Working with assessors: honesty, education, and trust
• 14:36 Advice for a company facing its first ATO
• 17:14 On-prem software in the stack: NIST 800-161, 800-171, and ITAR
• 19:25 Why impact levels apply to cloud offerings, not software
• 20:27 DocuSign vs. Salesforce: the gap in how agencies use FedRAMP
• 21:55 Customer responsibility matrices and transitive trust
• 26:26 The Jira-on-EC2 workaround
• 29:45 How agency sponsorship speeds up FedRAMP authorization
• 30:43 Wrap-up
• 31:00 Outro

Summary:

In this episode, Kevin Long, Jeff Segal, and Kevin Belanga explore the nuances of federal procurement challenges, including code challenges, oral assessments, and alternative procurement methods. They discuss how these approaches impact vendor evaluation, government decision-making, and the importance of aligning evaluation methods with project scope and complexity.

Key Topics:

Differences between in-room and take-home code challenges

The value and limitations of oral assessments

The role of external evaluators and source selection boards

Balancing cost, complexity, and procurement methods

The importance of aligning evaluation methods with project scope

Challenges of evaluating technical competence remotely

Innovative approaches to vendor vetting, including pair programming

The impact of procurement methods on small and large businesses

Episode Chapters:

00:00 Introduction to Federal Procurement Challenges

02:01 Different Types of Code Challenges in RFPs

03:55 Evaluating Technical Competence Remotely

05:53 The Role of External Evaluators and Source Boards

07:56 Balancing Cost and Complexity in Procurement

09:48 Innovative Vetting Methods: Pair Programming

11:47 The Value of Oral Assessments

13:57 The Theater of In-Person and Virtual Challenges

16:01 Challenges for Small Businesses in Procurement

18:14 Alternative Approaches to Traditional RFPs

19:58 Simplifying Vendor Vetting with Pair Programming

22:06 The Cost and Time of Code Challenges

24:00 The Utility of Oral Presentations

26:11 Media and Video in Vendor Evaluation

28:13 Guarding Against Bait and Switch

30:09 The Future of Federal Procurement Strategies

Matt Triner talks with PMO leaders Monique Williams and Tom Arnold about what separates a project management office that actually helps from one that's just overhead in government IT. They dig into the gap between mission goals and what the systems can really do, how to deal with tech debt, and what happens when siloed stakeholders keep stalling delivery. Later in the episode they get into agility, earning buy-in, and building trust on hybrid teams. Worth a listen if you're standing up a new PMO or trying to fix the one you've got.

Episode Chapters:

00:00 The Role of PMOs in IT Initiatives

01:14 Critical Competencies of Effective PMOs

06:09 Understanding Technical Aspects in PMOs

10:45 Balancing Stakeholder Needs and Project Goals

16:20 Measuring PMO Effectiveness

20:58 Evaluating Good vs. Bad PMOs

23:45 Agility in Project Management

28:11 Engagement in a Hybrid Workforce

34:38 Trends in PMO Operations

41:06 Key Recommendations for Establishing a PMO

Cloud and code don't sit in separate lanes anymore, and neither do their vulnerabilities. Dan Beller (Director of Cloud Solutions) and Greg Vanore (Director of Software Development) join This Is Fine to dig into what secure software development actually demands once the checklist runs out. They cover the widening blast radius of cloud misconfigurations, the quiet risk of open source dependencies that lose their maintainers, and why "shift left" stays a slogan until contracts actually fund it. A detour through JavaScript's messy history makes the case that unchecked abstraction is its own security problem, tooling included. They also dig into why government agile adoption keeps colliding with government security posture, and what the NIST SSDF gets right about treating security as a mindset rather than a gate. It's a candid, occasionally cursed (RIP JScript) conversation about building software that survives contact with reality.Episode Chapters:

00:00 Introduction and Podcast Production

00:44 Exploring Secure Software Development

01:43 The Changing Threat Landscape

03:05 Impact of Open Source Software

04:55 Infrastructure Security and Open Frameworks

05:57 Balancing Tooling and Understanding

06:53 The Evolution and Challenges of JavaScript

10:22 The Stabilization of UI Frameworks

12:18 Challenges in Government Cloud Environments

15:01 Agility and Security in Government

16:40 Reconciling Agile Processes with Security

22:35 Embedding Security in the Development Process

24:55 The Scope of Secure Software Development

Everyone claims their testing tool does AI now, and Jay Newlin (Director of Quality Assurance) has the flooded inbox to prove it. He and Greg Vanore (Director of Software Engineering) join host Matt Triner to talk about cutting through that noise, why customers still don't believe automation is worth paying for, and the readable, declarative test frameworks that actually change their minds. Then things get personal with the two worst legacy code handoff stories you'll hear this year, one on burned CDs, one on three-ring binders of printed source code, and what disciplined test automation looks like when you inherit either one.Episode Chapters:

00:00 Introduction

00:07 Automated Quality Assurance Testing in Software Development

01:22 Challenges in Assessing Tools for Automation Testing

02:42 The Importance of Automation in Testing

03:50 Educating Customers on the Value of Automation Testing

04:41 Expanding Testing Techniques Beyond Traditional Methods

05:48 Customer Perception of Automated Testing

07:09 The Future of Automated Testing

15:57 Balancing Rapid Deployment and Quality

16:58 The Importance of Unit Test Coverage

17:56 Maintaining Test Automation During Rapid Deployment

20:41 The Role of Tooling in Government Environments

22:56 Deliverables and Documentation in Government Contracts

25:12 Testing Legacy Systems

27:56 Considerations for Legacy Systems in Test Automation

34:43 The Future State of Automated Testing

Ask 5 people to define threat intelligence and you'll get 5 different answers, and that's exactly where this episode starts. Will Elchert (Senior CTI Analyst, Hunter Strategy) and Jake Williams (VP of R&D, Hunter Strategy) join host Matt Triner alongside two clients living this from the buyer's side: Keith McCartney, SVP of Security and IT at DNA Nexus, and Billy Martin, CTSO at Vigor. Together, they break down what separates a threat intel program that actually drives decisions from one that's just, as Jake puts it, "cyber story time with the CTI team." The conversation covers where AI genuinely helps in CTI workflows and where it falls flat, how red and blue teams each get value out of the same intelligence, and what metrics actually prove a security program's worth to leadership.

Episode Chapters:

00:00 Introduction to Cyber Threat Intelligence

02:51 Defining Threat Intelligence

05:41 Stakeholder Engagement in Cybersecurity

08:34 Risk Management and Cyber Threat Intelligence

11:36 Industry-Specific Approaches to Threat Intelligence

14:25 The Importance of Context in Threat Intelligence

17:07 Integrating Cybersecurity Functions

19:51 Actionability of Threat Intelligence

25:24 The Evolution of Cyber Threat Intelligence

28:58 AI's Role in Cybersecurity

32:19 Data Analysis and AI Integration

37:14 Challenges and Opportunities with AI

41:27 Human Element in Cyber Threat Intelligence

49:57 Red Team vs Blue Team Dynamics

52:28 Red Team vs Blue Team: Who Leverages CTI Better?

55:02 Funding and Capability Development in Cybersecurity

58:11 The Importance of Communication and Collaboration

01:01:14 Metrics for Measuring Threat Intelligence Effectiveness

01:09:45 Building a Cybersecurity Program from Scratch

Threat modeling is one of cybersecurity's most valuable practices, and one of the most skipped. Xander Keele (Director of Solution Architecture) and Greg Vanore (Director of Software Engineering) join host Matt Triner to break down frameworks like STRIDE and PASTA, why developers push back on it, and how to get buy-in without falling into pure theory. They also dig into how AI is changing the pace of both attacks and defenses.

Episode Chapters:

00:00 Introduction to Threat Modeling in Cybersecurity

02:12 Defining Threat Modeling and Its Overlooked Nature

07:13 The Role of Risk Assessment in Threat Modeling

12:09 Social Skills in Threat Modeling and Development

22:06 Higher-Level Threat Modeling and Industry Context

24:45 Real-World Applications of Threat Modeling Techniques

31:49 Enhancing Threat Models with Market Insights

34:10 The Role of Market Share in Risk Assessment

36:36 Contractual Implications of Threat Modeling

41:34 Integrating Threat Modeling into Development Culture

52:02 Adapting Threat Modeling for Emerging Technologies

Open source software promises cost savings and faster innovation, but the Department of Defense's approach to it is messier than most people realize. Host Matt Triner sits down with Hunter Strategy's Greg Vanore (Director of Software Engineering) and Nate Kingsley (CIO) to unpack the real risks: contributor license agreements that can sign away government-funded code, foreign ownership questions that don't always get consistent answers, and a supply chain that's only as trustworthy as its weakest link. They also dig into what's actually fixing the problem, from CI/CD pipelines to continuous ATO. This one gets spicy.Episode Chapters:

00:00 Introduction and Overview

01:59 Defining Open Source Software

03:49 Contributor License Agreements and Licensing Issues

06:08 The Challenges of Open Source Software in the DoD

08:39 The Need for Clear Policies

11:25 The Financial Challenges of Open Source Software

17:19 The Risk of Support and Lack of Governance

20:12 The Permissiveness of Open Source Software in the DoD

24:02 Supply Chain Risk and Software Sourcing

30:11 Improving the Use of Open Source Software

35:16 The Role of S-BOMs and Information Sharing

37:49 Conclusion and Call to Action