№ 03 / Research & Velocity / 2019

Akamai Technologies

Sr. UI/UX Developer & Designer · Hybrid design/development role

Sector
Infosec / Federal Cloud
Standard
FedRAMP
Scope
Remediation tracker · Stakeholder research · Design + build
Watch how people work, not just what they say.
Working principle

This was my first hybrid design/development role. The team needed a FedRAMP remediation tracker, and three different groups would use it: compliance officers, security engineers, and managers. Each group had their own vocabulary and way of thinking about the work.

I spent time with eight stakeholders through contextual inquiry, watching how they actually did their jobs. The research showed that they all tracked the same vulnerabilities but talked about them completely differently. The design challenge was creating one tool that worked for all three groups without forcing anyone to learn a new way of thinking.

Understanding stakeholder needs through observation.

I observed compliance officers, engineers, and managers in their daily work. Each group used different terms for the same concepts. The card sorting exercise helped me see where their vocabularies overlapped and where they diverged. That informed the information architecture.

Fig. 02 · Mental-model synthesis
COMPLIANCE n=3 Controls Frameworks Evidence SSPs ENGINEERING n=3 CVEs Tickets Fixes Deploys MANAGEMENT n=2 Risk Status Timeline Reports contextual inquiry · card sort × 3 iterations Remediation Tracker fedramp DASHBOARD REMEDIATION CONTROLS AUDIT TRAIL REPORTS HIGH CVE-2019-0847 · platform-a in progress MED CVE-2019-1122 · platform-b triage LOW CVE-2019-2301 · platform-c resolved ONE TOOL · THREE VOCABULARIES

Synthesis diagram showing three role-specific mental models feeding one shared IA. The wireframe above is representative of the shipped structure, not a screenshot.

Collaborating with stakeholders to design and build the tool.

  1. Spent time with eight stakeholders (three compliance officers, three security engineers, two managers) watching how they tracked vulnerabilities in their daily work. Observed first, asked questions second.
  2. Built a custom card-sorting tool when procurement timelines would have delayed the project. Used it to understand how each group organized and labeled the same remediation concepts. The patterns showed where vocabularies aligned and where they conflicted.
  3. Created three rounds of prototypes and tested them with the same eight stakeholders. Each iteration refined how the interface presented information to accommodate different mental models without forcing anyone to translate.
  4. Designed and developed the tool in Ruby on Rails with ERB templates and JavaScript. The information architecture used terminology from all three groups, making the tool feel native to compliance, engineering, and management perspectives.
8 Stakeholders observed and iterated with
3 Iteration rounds with the operating team
FedRAMP Vulnerability tracking tool deployed