December 49, 2016 | Boston, MA www.usenix.org/lisa16 - PowerPoint PPT Presentation

DevOps Culture in Life Science Implementing DevOps in a Regulated Traditionally Waterfall Environment Peter Lega & Jason Victor, Merck December 4–9, 2016 | Boston, MA www.usenix.org/lisa16 #lisa16

Who we are Introductions and About Us H 3 Merck & Co., Inc Applied Technology Peter Lega Jason Victor Healthcare Company InnovaKon Group Director, Architecture Assoc. Director, DevOps 125 Year old healthcare company, Bringing new technologies to Applied Technology, former Web/ Architect at Merck, DevOps Lead, in the Fortune 100, operaKng in speed up IT, creaKng new products Content Management lead at 15yrs in Health Science, 17yrs in IT, 140+ countries, part of a highly- and markets, enabling plaTorm- Merck. 12 years in Health Science. 6 sigma greenbelt, ITIL PracKKoner, regulated industry based technical ecosystems. Ancient Unix Kernel Hacker, Silicon Soaware Developer, Support Lead, Valley 1.0 (c|net), Middleware Masters from Drexel University, geek on Wall St, European Moravian College Mentor commission. AutomaKon dweeb.

Intro What we’ll cover today There is hope Our Appoach It is possible to implement DevOps at a Our multi-year journey to augment our traditional, regulated company. waterfall methodology with DevOps/Agile culture and methodology There is opportunity Tool Chain DevOps presents an unprecedented You still need technology to support DevOps. opportunity to accelerate the science and We’ll show you what we’re working on. practice of healthcare. There are still challenges Cultural Shifts Highly-regulated companies present unique How we went from "that will never work" to "that's challenges when introducing a technology the new way to work." culture like DevOps.

Highly Regulated Industries Definition: “a type of business that is controlled by government rules” [2] Regulations keep consumers/patients/populations safe. [2] Cambridge English Dictionary

Why Now? It’s the Perfect Storm “[Y]ounger baby boomers held an average of 11.7 jobs from ages 18 to 48.” [1] Talent & Culture • Agile career mindset • Cross-functional Organizations • CrowdSourcing • DEVOPS Exploding Sources of Data & Methods The Growing Arsenal • Longitudinal / IoT of Technology • Genomic • Big Data tooling and • Historical infrastructure • Personalized Medicine • Mainstream Platform-driven • Data-driven invention ecosystems & economies • Open Data • Collaborative-based tooling • Quantum • Open Source [1] Bureau of Labor Statistics

Impact Cycle Time [3] 14 Reducing cycle time 10.5 Launch Discovering things faster Years Phase IV 7 Clinical Pre-clinical Health - Improving lives 3.5 Discovery 0 [3] J. A. DiMasi “Metrics on Technical Risks, Clinical Development Times, and Approval Times for Cancer Drugs”

How? Our 4 Key Strategies Community DevOps Platform Improve Over-communicate Over-communicate Foster a community - Bobom up Co-Create an IT standard DevOps Iterate, improve, & Publish KPIs Over-communicate w/ Key Decision-Makers plaTorm Over-communicate

Foster a Community Key executive sponsors in word, wallet and deed. Delivery-proven SW experts from both traditional and emerging sides. (regulatory waterfall and agile/DevOps/tech) The authoritative approvers (quality, compliance) An effective training and communications group Key senior SMEs/leaders willing to facilitate cross- organizationally A set of first-follower business partners.

Software Development Extremes Agile VS Traditional Regulated Mindset Innovation Mindset (Agile) Risk Averse Fail Fast Deliver complete solution Minimum Viable Product (MVP) Specialization and hand-offs Cross-disciplinary teams Get it right / lock it down Continuous Improvement Focused on Quality of Output Focused on Quality of Output

Bridging Understanding With “Why” Agile Why Traditional Regulated Mindset Innovation Mindset (Agile) Decrease Failure Risk Averse Fail Fast Deliver Right Product Deliver complete solution Minimum Viable Product (MVP) Increase Efficiency Specialization and hand-offs Cross-disciplinary teams Get it right / lock it down Continuous Improvement Increase Quality Focused on Quality of Output Focused on Quality of Output

From Conflict to Synergy DevOps Traditional Established Support and OperaKons at Scale Viral CollaboraKon Ecosystems Increased Transparency Global Coverage Accelerated Soaware Delivery Global CommunicaKons Services Culture of InnovaKon & InvenKon Mature Regulatory Services Industry Edge Sensing Deep Regulatory Knowledge

From Conflict to Synergy AND DevOps Traditional Established Support and OperaKons at Scale Viral CollaboraKon Ecosystems Global Coverage Increased Transparency Global CommunicaKons Services Accelerated Soaware Delivery Mature Regulatory Services Culture of InnovaKon & InvenKon Deep Regulatory Knowledge Industry Edge Sensing

Our 4 Key Strategies Community DevOps Platform Improve Over-communicate Over-communicate Foster a community - Bobom up Co-Create an IT standard DevOps Iterate, improve, & Publish KPIs Over-communicate w/ Key Decision-Makers plaTorm Over-communicate

Our DevOps Toolchain Service Management Auto Testing Monitoring Test Mgmt (Robot Container Mgmt tools Framework) DevOps Program Continuous Tracking SCM Integration (CI) Ideas Definitive Media Library (JIRA) (Bitbucket ) Orchestration (Jenkins) IT Automation Collab. Wiki Release (Confluence) Mgmt Rel. Mgmt Search Guardrails Office API Service InfoSec Scans Mgmt CMDB Test Mgmt IT Automation Deployment Target (IaaS and DBaaS) Test Data (Container or Server) CD Orchestration Mgmt (On-Prem or Cloud)

Our 4 Key Strategies Community DevOps Platform Improve Over-communicate Over-communicate Foster a community - Bobom up Co-Create an IT standard DevOps Iterate, improve, & Publish KPIs Over-communicate w/ Key Decision-Makers plaTorm Over-communicate

Iterate, Improve & Gather Insights Process that grows over time Wiki, Issue Tracking Start with the basic CI / CD Suite code check in Partly Qualified Git Repo Fully Qualified Collaboration Regulated processes can use Regulated processes can fully Suite pieces of the DevOps Stack utilize the DevOps Stack Automate

Acceleration of Dev Tools Usage Active Projects Active User Count 600 JIRA 450 1,300 300 Bitbucket Confluence 150 500 3,300 0 Q1 Q2 Q3 Q4 Q1 Q2 Q3 2015 2016 JIRA Bitbucket Confluence

Acceleration of APIs API Usage API Costs per user CENTS 800 0.8 600 0.6 400 0.4 200 0.2 0 0 J F M A M J J A S O N D J F M A M J J A S Jan Feb Mar Apr May Jun Jul Aug Sep 2015 2016 2016 Requests/Month (thousands) GBs/Month

Iterate, Improve & Gather Insights Rinse & Repeat Inform the portfolio Sales App Clinical Trials App Cross project insight & improvement 6 months instead of 18 Working MVP in 2 months

Our 4 Key Strategies Community DevOps Platform Improve Over-communicate Over-communicate Foster a community - Bobom up Co-Create an IT standard DevOps Iterate, improve, & Publish KPIs Over-communicate w/ Key Decision-Makers plaTorm Over-communicate

Over Communicate Telling stories Sharing success Showing data Plain English, please

In the Spirit of Over Communicating… Our 4 Key Strategies Community DevOps Platform Improve Over-communicate Over-communicate Foster a community - Bobom up Co-Create an IT standard DevOps Iterate, improve, & Publish KPIs Over-communicate w/ Key Decision-Makers plaTorm Over-communicate

Impact Cycle Time 14 Reducing cycle time 10.5 Launch Discovering things faster Years Phase IV 7 Clinical Pre-clinical Health - Improving lives 3.5 Discovery 0

Impact Reducing cycle time Discovering things faster Health - Improving lives Remember - It’s Personal