Bank of America Omni-SIEM (Anvilogic + Splunk)
Re-establishing governance and delivery predictability for a stalled Anvilogic + Splunk migration
Outcome
$60K/mo coordination overhead removed, all three organizations signed off on the same roadmap for the first time.
The Challenge
A SIEM modernization across 3 organizations had produced zero detections in six months. The Omni-SIEM migration (Anvilogic + Splunk) had no shared plan. Security ops, engineering and compliance had different assumptions about sequencing and outcomes. Decision rights and ownership boundaries were undefined. Teams renegotiated priorities at every escalation, driving an estimated $60K a month in coordination overhead.
Key Decisions
Governance before roadmap
Teams were renegotiating priorities at every escalation because decision rights were undefined. I paused new roadmap commitments until ownership boundaries were in place, since a plan without clear owners would be renegotiated at the next escalation.
Define outcomes before ranking features
The program’s “outcomes” were a list of capabilities, with no MTTD baseline or MTTR target. I documented the gap and made it a standing agenda item so teams could tie priorities to detection and recovery goals.
Separate research from committed milestones
Detection research and production delivery were planned with the same certainty. I split them: research tracked separately and production commitments held to a different bar, so teams could forecast reliably and commit to a delivery schedule.
What I Delivered
Decision rights framework
Ownership and escalation paths across security ops, engineering and compliance, in a program with an estimated $60K/month in coordination overhead.
46-epic, outcome-rooted investment map
A 12-month roadmap with RAG status across the program. It gave senior leaders a shared artifact for aligning PI planning with business outcomes.
Milestoned migration roadmap
Unified Anvilogic + Splunk sequencing with discovery-phase work separated from production commitments.
Detection onboarding standard
One detection onboarding workflow, built into the migration sequence.
Outcomes
An estimated $60K a month in coordination overhead came out of the program. All three organizations signed off on the same roadmap for the first time, and senior leaders had an epic map for aligning PI planning to the business case. The migration was still in flight when my contract ended.