Trevor Smith
Technology Leader · IT & Security · Cloud & AI · Software Engineering · Business Transformation
I’m responsible for technology at a global video surveillance company: infrastructure, security, compliance, business systems, and the modernization and migrations that come with all of it.
Nights and weekends I build hockey software, coach multiple teams and programs, and still play badly in the beer leagues.
Most people with my job title stopped writing code a decade ago. I didn’t, and I’m better at both jobs for it.
The day job
Director, Information Technology at March Networks.
Video surveillance and analytics, headquartered in Ottawa, now a Delta Electronics brand. Customers and colleagues across Canada, the US, Mexico, the UK, Europe, the Middle East, and Australia.
The job is broader than any one of those words suggests. It splits about three ways.
Keep it running
- Information technology
- Cloud computing
- Hybrid infrastructure and architecture
- ERP and business systems
- Vendor and budget management
Keep it defensible
- Information security
- Compliance and audit
- AI adoption and governance
Keep it moving
- Cloud migration and modernization
- M&A integration
- Change management
- Strategic and people leadership
- Technical leadership
Nights and weekends
Two hockey apps with real users, real money and real personal data. Hobby projects, built like they aren’t.
A tool for running beer-league and pickup hockey.
I built it because organizing twenty adults in a group chat is a special kind of misery.
It doesn’t store anything about children, but it does store adult names, emails, phone numbers, attendance and reliability scores, and payment activity for season dues and spare fees. It also moves that data across group boundaries on purpose, through a cross-group spare network. That’s what changes the risk profile from a single-tenant club site to a multi-tenant data-sharing platform. A bug in the spare-matching logic doesn’t leak one team’s roster, it leaks that roster into every other group that opted into the network. And a leaked invite code doesn’t just show a stranger the schedule, it lets them join a roster under a display name with no account at all.
It also takes one-tap actions straight out of an email. “I’m in” and “I’m out” as a link you click without logging in. Convenient, and also a GET request that mutates state, so the tokens have to be signed, single-use and expiring, with no sequential IDs, nothing replayable, and nothing a crawler can follow out of a forwarded email.
So it gets the same passes I’d run on anything at work, reweighted for what’s actually here: token design and invite-code entropy, spare-network authorization boundaries, install and offline behaviour, cross-group visibility and retention rules, fee collection and the PCI scope that comes with it, batch-creating a twenty-six week season, and RSVP counts under load ten minutes before puck drop.
I keep a findings list on my own software, and it isn’t empty.
Nuxt on Vercel. PWA with a maskable-icon manifest and standalone display. Security headers set at the edge: HSTS, X-Frame-Options, and a Permissions-Policy that locks camera, mic and geolocation.
Public site and registration for a youth hockey development program.
This one takes payments and stores names, birthdates and contact details for children and their parents.
That sentence is the reason it stopped being a side project. Storing data about minors sets the floor for everything else: what gets logged, how long records live, who can read them, and what happens when an admin pastes something into a content field that lands in the public DOM.
Same passes. Backend, frontend, privacy and retention, performance, SEO, architecture, CI. Findings ranked by what they’d actually cost if someone used them, then fixed one at a time, with tests. Nothing was rewritten wholesale, because nothing needed to be.
Nuxt 4 on Vercel. TypeScript, Drizzle over Postgres, Zod schemas shared across the client/server boundary, Vitest. Session auth with an SMS second factor on admin accounts. A JSONB key-value CMS so copy changes without a deploy.
How I work
Five things I actually do, rather than five things that sound good.
- Audit before you change anything.Read the source. The README is a claim, not evidence.
- Enforce incrementally.A gate that’s slow, flaky, or noisy gets switched off inside a month. Then you have no gate, and a false sense that you do.
- Map every control to a failure.If you can’t name what it prevents, it’s ceremony. Delete it.
- Say when you’re not sure.“Needs verification” is a useful answer. A confident guess is a liability with good posture.
- Ship things people use.Everything above is worthless if nothing goes out.
Off the clock
Youth hockey coaching, programs, beer leagues, and a family that puts up with the schedule.
I coach, at our local youth hockey association and at EDGE, and I still play, badly, in the beer leagues. An unreasonable number of hours a week happen on or beside a sheet of ice.
The board and governance work came later and much of its most important work happens away from the bench: recruiting and supporting coaches, coordinating evaluations and team formation, planning player development programs, and working through the difficult decisions that keep a season running. It’s an opportunity to give back beyond coaching, and to help shape the hockey experience across an entire association.
When I’m not at work or at a rink, I’m with my family. Outdoors, on the lake at the cottage, on a plane somewhere, or doing absolutely nothing at all at home, which after most weeks is the bigger achievement.