Forward Deployed Engineering (FDE) Masterclass

You can explain where an FDE sits between product, sales and the customer's own engineers, and what you are accountable for when a deployment stalls.

1. What the role actually is1 hr
   • deployment ownership
   • product feedback loop
   • pre-sales support
   • customer advocacy
   • boundary with support
2. Stakeholders and competing incentives1 hr
   • account executive
   • customer IT
   • security review board
   • platform team
   • executive sponsor
3. Reading a customer environment quickly1 hr
   • estate questionnaire
   • constraint discovery
   • shadow IT
   • change control reality
   • political mapping
4. Communication under pressure1 hr
   • status cadence
   • bad news early
   • written over verbal
   • scope defence
   • escalation etiquette
5. Working across time zones and contracts1 hr
   • statement of work
   • acceptance criteria
   • change requests
   • billable boundaries
   • handover to support
6. Building your deployment toolkit1 hr
   • portable tooling
   • offline-capable scripts
   • runbook templates
   • diagnostic bundles
   • laptop hygiene

Hands-on project: Write a role charter for an FDE joining a data-platform vendor, covering escalation paths, what you own, what you refuse, and how success is measured in the first ninety days.

You can run a discovery workshop that surfaces the constraints that kill deployments, before you have written a line of integration code.

1. Structuring a discovery workshop1 hr
   • agenda design
   • right attendees
   • open questions
   • whiteboard capture
   • follow-up loop
2. Eliciting non-functional requirements1 hr
   • throughput targets
   • latency ceilings
   • retention rules
   • availability expectation
   • audit requirements
3. Mapping the existing estate1 hr
   • system inventory
   • data flow mapping
   • authentication landscape
   • network boundaries
   • legacy constraints
4. Constraint registers and assumption logs1 hr
   • constraint capture
   • assumption tracking
   • validation owner
   • expiry dates
   • escalation triggers
5. Scoping, phasing and saying no1 hr
   • phase boundaries
   • minimum viable deployment
   • deferral language
   • scope creep signals
   • written confirmation
6. Writing the deployment plan1 hr
   • milestone definition
   • dependency list
   • rollback criteria
   • acceptance test plan
   • sign-off process

Hands-on project: Run a simulated discovery session against a difficult customer brief and produce a constraints register, integration map and a risk-ranked deployment plan.

You can diagnose a Linux host you have never seen before, on a customer network, without internet access and without root on the first attempt.

1. Process, memory and the proc filesystem1 hr
   • process tree
   • proc inspection
   • memory accounting
   • open file descriptors
   • zombie reaping
2. Storage, filesystems and disk pressure1 hr
   • inode exhaustion
   • mount options
   • LVM basics
   • disk latency
   • log rotation
3. systemd units and service debugging1 hr
   • unit files
   • journalctl queries
   • restart policy
   • dependency ordering
   • socket activation
4. Users, permissions and SELinux1 hr
   • POSIX permissions
   • sudoers scoping
   • SELinux contexts
   • audit denials
   • capability bits
5. Performance triage under pressure1 hr
   • load average
   • iostat reading
   • CPU steal
   • memory pressure stalls
   • quick wins
6. Working without internet access1 hr
   • offline package mirrors
   • dependency bundling
   • air-gapped transfer
   • checksum verification
   • local registries

Hands-on project: Diagnose and fix three deliberately broken Linux hosts under restricted access, documenting each investigation as a customer-facing note.

You can trace a failing connection through proxies, firewalls and DNS in a customer network and say exactly where it dies.

1. The path a packet takes in an enterprise1 hr
   • routing tables
   • NAT boundaries
   • egress proxies
   • firewall zones
   • load balancer hops
2. DNS in corporate environments1 hr
   • split-horizon DNS
   • search domains
   • conditional forwarders
   • caching pitfalls
   • resolution debugging
3. TLS, certificates and inspection proxies1 hr
   • chain validation
   • corporate root CAs
   • TLS interception
   • SNI routing
   • certificate pinning conflicts
4. Diagnosing with tcpdump and friends1 hr
   • capture filters
   • handshake inspection
   • retransmission signals
   • MTU problems
   • ss and netstat
5. Firewall and proxy negotiation1 hr
   • allowlist requests
   • FQDN vs IP rules
   • port justification
   • change windows
   • evidence packaging
6. Hybrid connectivity patterns1 hr
   • site-to-site VPN
   • private peering
   • bastion access
   • reverse tunnels
   • zero-trust brokers

Hands-on project: Given a broken connection across three network zones, produce a packet-level diagnosis and a remediation request the customer's network team will accept.

You can integrate a product with a customer's identity provider and explain the token flow well enough to satisfy their security review.

1. OAuth 2.0 and OpenID Connect flows1 hr
   • authorisation code flow
   • PKCE
   • client credentials
   • token exchange
   • refresh handling
2. SAML and legacy federation1 hr
   • SAML assertions
   • metadata exchange
   • signing certificates
   • clock skew
   • IdP vs SP initiated
3. SCIM and user provisioning1 hr
   • user lifecycle
   • group sync
   • deprovisioning
   • attribute mapping
   • reconciliation jobs
4. Claims, groups and role mapping1 hr
   • claim transformation
   • group filtering
   • nested groups
   • role derivation
   • authorisation boundaries
5. Service accounts and machine identity1 hr
   • workload identity
   • certificate auth
   • secret rotation
   • least privilege scopes
   • credential custody
6. Passing a security review1 hr
   • threat model document
   • data flow diagram
   • evidence of controls
   • pen-test findings
   • remediation commitments

Hands-on project: Federate a demo application with two different identity providers, map group claims to application roles, and pass a mock security review.

You can ship a product as containers that run identically on a laptop, a customer VM and an air-gapped cluster.

1. Image layering and build reproducibility1 hr
   • layer caching
   • multi-stage builds
   • pinned base images
   • build args
   • reproducible timestamps
2. Image hardening and minimal bases1 hr
   • distroless images
   • non-root user
   • dropped capabilities
   • vulnerability scanning
   • SBOM generation
3. Multi-architecture builds1 hr
   • buildx
   • platform matrices
   • emulation cost
   • manifest lists
   • arm64 parity
4. Private and air-gapped registries1 hr
   • registry mirroring
   • image export and import
   • signature verification
   • retention policy
   • pull-through cache
5. Configuration and secrets at runtime1 hr
   • environment vs file config
   • secret mounting
   • config precedence
   • validation on boot
   • failure to start loudly
6. Offline installation bundles1 hr
   • bundle manifest
   • checksum file
   • install script
   • upgrade path
   • uninstall cleanliness

Hands-on project: Package a three-service application into hardened, multi-architecture images with an offline installation bundle and verified checksums.

You can deploy and operate a product on a Kubernetes cluster you do not own, with limited permissions and no cluster-admin.

1. Workload primitives and when each fits1 hr
   • deployments
   • statefulsets
   • daemonsets
   • jobs and cronjobs
   • selection criteria
2. Namespace-scoped deployment without cluster-admin1 hr
   • RBAC limits
   • quota negotiation
   • admission controllers
   • PodSecurity standards
   • what to request
3. Helm charts and templating for customers1 hr
   • chart structure
   • values layering
   • upgrade hooks
   • chart testing
   • versioning policy
4. Storage, stateful workloads and backups2 hrs
   • persistent volume claims
   • storage classes
   • volume expansion
   • backup hooks
   • restore rehearsal
5. Ingress, service exposure and certificates2 hrs
   • ingress controllers
   • TLS secrets
   • cert-manager
   • external DNS
   • customer load balancers
6. Diagnosing failures in someone else's cluster2 hrs
   • events timeline
   • pending pod triage
   • OOMKilled analysis
   • image pull failures
   • node pressure

Hands-on project: Deploy a stateful application to a namespace-restricted cluster with resource quotas, then diagnose and fix three injected failures.

You can hand a customer code that stands their environment up from nothing, and prove it produces the same result twice.

1. Terraform fundamentals and state1 hr
   • resource graph
   • remote state backends
   • state locking
   • import of existing resources
   • state surgery risks
2. Module design for reuse across customers1 hr
   • input variables
   • sensible defaults
   • output contracts
   • module versioning
   • registry publishing
3. Environment parity and drift detection1 hr
   • plan in CI
   • drift alerts
   • tainted resources
   • manual change reconciliation
   • policy as code
4. Secrets in infrastructure code1 hr
   • Vault integration
   • dynamic credentials
   • no secrets in state
   • encrypted backends
   • rotation workflow
5. Ansible for configuration management1 hr
   • idempotent playbooks
   • inventory management
   • check mode
   • role structure
   • vault-encrypted vars
6. Teardown, cleanup and cost hygiene1 hr
   • destroy safety
   • orphan detection
   • cost tagging
   • trial environment expiry
   • customer handover

Hands-on project: Write a Terraform module that provisions a complete customer environment, with remote state, drift detection and a documented teardown.

You can build a batch pipeline against a customer's real data, including the dirty parts, and make it restartable after it fails at three in the morning.

1. Source system analysis and extraction2 hrs
   • source profiling
   • incremental keys
   • watermarks
   • read replica safety
   • extraction windows
2. Airflow DAG design and scheduling2 hrs
   • task dependencies
   • sensors
   • backfill strategy
   • SLA misses
   • pool management
3. Idempotency and restartability1 hr
   • upsert semantics
   • run identifiers
   • partial failure recovery
   • checkpointing
   • duplicate suppression
4. Schema drift and contract enforcement1 hr
   • schema registry
   • breaking change detection
   • quarantine tables
   • alerting on drift
   • contract negotiation
5. Data quality gates2 hrs
   • row count checks
   • null thresholds
   • referential checks
   • freshness assertions
   • failing loudly
6. Performance and cost of batch jobs2 hrs
   • partition pruning
   • parallelism tuning
   • file format choice
   • compaction
   • warehouse credit control

Hands-on project: Build an Airflow pipeline that ingests from a legacy SQL source into a warehouse, with schema drift handling, idempotent reruns and data quality gates.

You can stand up a streaming integration with ordering and delivery semantics you can explain to a customer architect without hand-waving.

1. Kafka fundamentals for integration work2 hrs
   • topics and partitions
   • consumer groups
   • offset management
   • retention policy
   • compaction topics
2. Delivery semantics and ordering guarantees2 hrs
   • at-least-once
   • exactly-once
   • partition ordering
   • idempotent producers
   • transactional writes
3. Change data capture with Debezium2 hrs
   • logical replication
   • snapshot phase
   • connector configuration
   • tombstone records
   • replication slot risks
4. Schema evolution in streams1 hr
   • schema registry
   • compatibility modes
   • field addition
   • field removal
   • consumer upgrade order
5. Backpressure, lag and replay2 hrs
   • consumer lag monitoring
   • rebalance storms
   • replay from offset
   • dead letter topics
   • poison message handling
6. Streaming sinks and downstream contracts1 hr
   • sink connectors
   • upsert sinks
   • ordering at the sink
   • sink failure handling
   • downstream SLAs

Hands-on project: Build a CDC pipeline from PostgreSQL into Kafka with exactly-once sink semantics, schema evolution and a documented replay procedure.

You can write the glue service a deployment needs, to a standard you would be happy to hand to the customer's own engineers to maintain.

1. API design and contract-first development2 hrs
   • OpenAPI specification
   • resource modelling
   • versioning strategy
   • error schema
   • deprecation policy
2. Building the service: FastAPI and Go2 hrs
   • request validation
   • dependency injection
   • async handlers
   • structured errors
   • graceful shutdown
3. Authentication and authorisation at the edge1 hr
   • token validation
   • scope enforcement
   • mTLS
   • API keys
   • per-tenant isolation
4. Resilience patterns for integrations2 hrs
   • timeouts
   • retry with backoff
   • circuit breaker
   • bulkheads
   • idempotency keys
5. Rate limiting, quotas and fair use1 hr
   • token bucket
   • per-tenant quotas
   • 429 semantics
   • retry-after headers
   • quota reporting
6. Webhooks and asynchronous callbacks2 hrs
   • signature verification
   • delivery retries
   • ordering caveats
   • replay protection
   • subscriber management

Hands-on project: Build a production integration service with typed contracts, authentication, rate limiting, retries, idempotency and an OpenAPI specification.

You can deploy into a regulated or disconnected environment and produce the evidence an auditor asks for.

1. Threat modelling a deployment1 hr
   • trust boundaries
   • STRIDE walkthrough
   • attack surface
   • mitigations
   • residual risk
2. Secrets management with Vault1 hr
   • dynamic secrets
   • transit encryption
   • auth methods
   • lease renewal
   • seal and unseal
3. Supply chain security and SBOMs1 hr
   • SBOM generation
   • image signing
   • provenance attestation
   • vulnerability triage
   • patch SLAs
4. Air-gapped and disconnected operation1 hr
   • offline licence activation
   • bundle transfer
   • update cadence
   • telemetry suppression
   • time sync
5. Compliance regimes you will meet1 hr
   • SOC 2 evidence
   • ISO 27001 controls
   • GDPR data flows
   • sector-specific rules
   • auditor questions
6. Logging, retention and data residency1 hr
   • log classification
   • PII redaction
   • retention windows
   • in-region storage
   • deletion evidence

Hands-on project: Produce a complete security package for an air-gapped deployment: threat model, data flow diagram, SBOM, scan results and an evidence index.

You can answer why the customer's instance is slow using only what their environment lets you collect.

1. The three signals and what each is for1 hr
   • metrics
   • logs
   • traces
   • profiles
   • signal selection
2. Prometheus, exporters and recording rules1 hr
   • scrape configuration
   • cardinality control
   • recording rules
   • alert rules
   • federation
3. Distributed tracing with OpenTelemetry1 hr
   • span propagation
   • context injection
   • sampling strategies
   • Jaeger backend
   • trace analysis
4. Grafana dashboards customers will actually read1 hr
   • golden signals
   • dashboard hierarchy
   • annotation of deploys
   • alert links
   • avoiding wall art
5. Diagnostic bundles and remote support1 hr
   • bundle contents
   • redaction before transfer
   • size limits
   • reproducibility info
   • secure transfer
6. Performance investigation method1 hr
   • USE method
   • RED method
   • hypothesis ordering
   • bisecting changes
   • proving the fix

Hands-on project: Instrument a deployed system with metrics, logs and traces, then diagnose an injected performance regression from the telemetry alone.

You can run an incident with a customer watching, and write the post-mortem that keeps the account.

1. Incident command and roles1 hr
   • incident commander
   • comms lead
   • scribe
   • severity levels
   • escalation ladder
2. Communicating during an outage1 hr
   • update cadence
   • what not to promise
   • holding statements
   • internal vs external
   • channel discipline
3. Mitigation before diagnosis1 hr
   • rollback first
   • feature flags
   • traffic shedding
   • failover trigger
   • stop the bleeding
4. Writing a blameless post-mortem1 hr
   • timeline reconstruction
   • contributing factors
   • counterfactual avoidance
   • action items
   • owner and date
5. Root cause analysis techniques1 hr
   • five whys limits
   • causal chains
   • change correlation
   • reproduction attempts
   • evidence standards
6. Rebuilding trust after a bad deployment1 hr
   • credibility repair
   • commitment tracking
   • follow-through evidence
   • executive briefing
   • contract implications

Hands-on project: Run a simulated production incident with a hostile stakeholder, then deliver the written post-mortem and remediation commitments.

You can take a realistic enterprise customer from first discovery call to a signed-off production deployment, including the parts that go wrong.

1. Discovery, constraints and deployment plan2 hrs
   • workshop execution
   • constraints register
   • risk ranking
   • phased plan
   • acceptance criteria
2. Environment build and identity integration2 hrs
   • infrastructure as code
   • network requests
   • SSO federation
   • role mapping
   • smoke tests
3. Application deployment and data integration2 hrs
   • Helm deployment
   • batch pipeline
   • CDC stream
   • quality gates
   • runbook drafting
4. Custom API layer and client systems2 hrs
   • contract agreement
   • service build
   • resilience patterns
   • integration tests
   • documentation
5. Security evidence and observability handover2 hrs
   • threat model
   • SBOM and scans
   • dashboards
   • alert routing
   • support handover
6. Injected incident and acceptance defence2 hrs
   • incident response
   • customer comms
   • post-mortem
   • remediation plan
   • panel sign-off

Hands-on project: Onboard a simulated enterprise customer end to end: discovery and constraints register, network and identity integration, containerised deployment to a restricted cluster, batch and streaming data integration, custom API layer, security evidence package, observability, a live injected incident with post-mortem, and final acceptance sign-off defended to a panel.