Business & Operations

Review payment webhooks for signature verification, replay and duplicate handling, ordering, durable processing, retries, and reconciliation.

Review payment data flows, tokenization, credential boundaries, PCI DSS scope, authorization, sensitive logging, and checkout abuse cases.

Reconcile orders, provider transactions, fees, refunds, chargebacks, settlements, payouts, and ledger entries.

Review payment-provider migrations for parity, token portability, dual processing, routing, reconciliation, rollback, and decommissioning.

Support controlled capture, cancellation, refund, resend, and lookup operations with approval, limits, idempotency, and audit records.

Review payment conversion, authorization, webhook, refund, reconciliation, latency, provider health, alerts, and privacy-safe telemetry.

Design and implement provider-neutral payment integrations with explicit state machines, idempotency, failure recovery, and auditable order linkage.

Review payment fraud signals, velocity controls, risk rules, step-up actions, manual review, false positives, and feedback loops.

Test authorization, capture, settlement, cancellation, refund, timeout, decline, authentication, webhook delay, and provider outage paths.

Review payment controls and evidence for PCI DSS, privacy, SCA, retention, access, auditability, outsourcing, and exceptions.

Review exit plans, data return, provider transitions, emergency operations, suboutsourcing, cloud dependencies, and business impact.

Review backup and restore, failover, disaster recovery, restart procedures, crisis exercises, scenario tests, and lessons learned.

Review model versioning, training data, bias, drift, monitoring, approvals, reproducibility, model registry, and deployment gates.

Review database migrations, schema changes, breaking changes, rollback ability, backward compatibility, and zero-downtime deployments.

Review GenAI workloads for prompt injection, tool permissions, data exfiltration, RAG sources, sensitive prompt logging, evals, guardrails, and model access.

Review Kubernetes clusters, namespaces, RBAC, NetworkPolicies, Pod Security, admission controllers, resource limits, secrets, ingress, tenancy, and upgrades.

Review modern JavaScript for async behavior, modules, runtime correctness, security, tests, and performance.

Review IAM, roles, service accounts, groups, tokens, OIDC federation, GitLab or GitHub permissions, cloud rights, and privilege-escalation paths.

Review cloud, SaaS, outsourcing, subcontractors, contracts, exit strategies, concentration risks, and DORA information-register readiness.

Review ICT risks, protection needs, criticality, controls, residual risks, treatment, and recurring reassessment.

Review ICT incident classification, escalation, documentation, reportability, timelines, responsibilities, templates, and communication chains.

Review Argo CD or Flux setups, sync policies, drift detection, promotion, rollback, app-of-apps, secrets, cluster access, and deployment governance.

Review cloud costs, budgets, rightsizing, reserved or committed usage, anomalies, showback or chargeback, and team cost transparency.

Create auditable evidence packages from tickets, pipeline results, test reports, approvals, scans, and architecture information.