Work — Nabil Arnaoot

Case Studies

Program ManagereBay · 2009–2011

eBay Site Security Program

eBay Marketplaces' Site Security team had the right people but no shared map. The work in progress was invisible, product teams couldn't easily tell when they needed a security review, and the group's way of working didn't scale. I built the map, smoothed out the intake, designed how the team showed up as partners, not obstacles — and opened a cross-company conversation with PayPal's security org.

Before and after: a foggy harbor with a dark lighthouse, then the same lighthouse lit with its beam crossing a second lighthouse's beam over the water

01Make the work visible

Built a roadmap so the team and its stakeholders could see what was on deck and when. Transparency turned out to be the missing prerequisite for everything that came after.

02Unblock the intake

Picked up a stalled questionnaire project and shipped it — a triage tool product teams could use themselves to identify whether their work needed security consultation.

03Operationalize the consulting role

Designed engagement processes so the team functioned better as internal consultants — clearer entry, clearer handoff, fewer surprises on either side.

04Open the cross-company conversation

Started a recurring discussion group with PayPal's security org. Both companies were learning the same lessons; this turned them into shared lessons.

The team stopped firefighting and started consulting. Product teams learned when to loop them in, and the work that mattered got the attention it needed.

Engineering Project Manager → Business AnalystApple · 2011–2018

Making iTunes' Crashes Countable

iTunes was crashing constantly, and my team — the site reliability engineers carrying the pagers — knew exactly why. New features kept shipping, bugs kept accruing, technical debt kept growing. We held post-mortems, but the results lived in Word documents nobody could aggregate or compare. Even the basic question, is downtime getting better or worse?, had no answer: every property measured it differently, every year measured it differently. Leadership kept prioritizing features over bug fixes because the conversation couldn't land on the bugs. The team knew. There was no data backing us up yet.

Before and after: SRE pagers going off through the night, then quiet pagers at rest

01Get the root causes captured consistently

Found a web-based outage system the team could use. Talked the owners into letting me add the fields we actually needed. Trained the SREs and convinced them — one at a time — to use it. Suddenly there was a record of why outages happened, not just that they had.

02Build the data pipeline — on a discarded machine

Stood up a MySQL prototype on a spare box, hooked it to Tableau, started shipping regular reports to management. Iterated on the format until it worked for the readers. Then handed the prototype off to my team — the logic, the data model, all of it — and led them in building the production system properly online.

03Show leadership what the team already knew

Provided the visualizations for the monthly downtime reviews. The data said what the SREs had been saying for years: the majority of iTunes downtime came from bugs that were already tracked, just not fixed.

04The screenshot that changed the roadmap

A friend called from the iTunes offsite with a screenshot — one of my visualizations, up on the VP's slide. The VP was using it to tell the engineers that bug fixes were going to start coming before new features. It was a triumph.

I left Apple before the new roadmap played out, so there's no tidy number to point at. But iTunes crashes a lot less these days than it did when my people carried pagers.

Business Analyst / Process EngineerApple · 2014–2018

Kernel Updates for 500,000 Systems

At Apple, kernel-update tickets generated themselves by the hundred every day. The information that mattered lived inside spreadsheets attached to each ticket — outdated by the time anyone opened them, impossible to scan. Most managers had given up trying to act on them. Across 500,000 systems and 40+ engineering groups, the work was happening in the dark, and the people responsible for it were burnt out. I pulled on three threads at once.

Before and after: from overgrown chaos to an organized garden

01Surface what the tickets buried

A live dashboard pulled the at-a-glance state — what needed updating, what was failing, where the risk concentrated — out of the spreadsheet attachments and onto a single screen managers could actually read.

02Automate the work itself

Led the deployment of a new process that applied updates across the fleet at scale. Spotting what needed doing and actually doing it stopped being two separate hard problems.

03Renegotiate the bar

Brokered a new agreement between ops and infosec — replacing security requirements no one could realistically meet with ones engineers could actually deliver against.

Better security, and reverse burnout. Managers got a screen that showed exactly what needed doing; the work to do it was already automated; the bar was set where the team could clear it. Teams that had given up started knowing what they had to do — and being able to do it.

What People Say

Robert Mooney · Principal Security Architect

"He's a natural. He takes a large amount of disparate and easily confused data and packages it into an easily understood, easily communicated snapshot of progress. He knows how to ask the right questions and does not relent until he has a clear understanding — but he's not a nuisance to the busy engineer. He has a genuine concern for others."

Chris Winter · Manager

"He brought a level of humanity to our team that we sometimes forget. When he leaves, we'll go back to being robots."

Sneha Phadke · Director, Application Security · eBay

"He is an extremely dynamic and versatile program and project manager. Besides being an eloquent speaker and writer, he brings teams together and makes projects successful. If there is a difficult moment in a project, he faces it and resolves it with a unique charm that makes it fun to work with him."

Faron Lyons · Enterprise Account Manager

"Nabil does much more than translate geek speak; he is able to lead. My experience with him has left me confident that any project under his responsibility will end successfully."

Kim Anderson · Colleague & Friend

"You mentor others — especially women, people of color, shy folks, young people. You pass on knowledge horizontally and vertically. You like shy cats, and you cannot lie."

Frankie Pauncevolt Hill

"A broad-ranging, incisive and inspired mind; relentless passion; bright, glowing kindness; independence of judgment — you don't form your ideas to suit an existing framework, but think the values through until you know what you support deeply."

Ipsita · MS Cohort, Saint Mary's College

"I really appreciate the way you explain, the way you solve a problem, the way you help us and the way you talk. I've learned a lot of things from you."

Career

A painted river winding past signposts for eBay, Apple, St. Mary's College, and SFMTA

I started out managing projects, moved on to solving org-wide problems, and now I put it all into public service.

Trust for Public Land 2000–05 · Elegrity 2006–09 · eBay 2009–11 · Apple 2011–18 · Sabbatical 2018–20 · MS, Saint Mary's 2020–22 · Consulting 2022–24 · SFMTA 2024–now

Notes, Essays & Side Quests

Nametag Prototype

Nametag shows you the people in the room as a wall of hand-tilted name tags — face, name, pronouns, and a line about right now — so you can walk over and say hello. No feed, no follows, no messages. A private little app I vibe-coded for the parties where I can never quite remember names.

Try the prototype →

Secret Gardens of San Francisco

Downtown San Francisco hides public gardens on its rooftops and inside its office towers — the kind you reach by walking past a security guard to an unmarked elevator. A coworker showed me my first; I've been tracking them down and mapping them ever since.

Explore the map →

Conditional Probability for Normal Humans

If you test positive for malaria, how likely is it you actually have malaria? Many doctors get this wrong. Here's the intuition, without a single formula.

Read the explainer →

Chasing Unicorns for Pride

In honor of Pride, I dug into Google searches for the word "unicorn." When were these searches most popular, where, and why? The answer surprised me.

Follow the search →

Selected Work