Home / Vaults / Interim CISO application pack

An application for a job, as a vault

A candidate pack for an interim CISO role, delivered as an encrypted vault instead of a CV attached to an email. Three routes through one artefact — the recruiter, the hiring company, and anyone curious — over four documents that each exist as PDF, Word, Markdown and JSON. The claim it makes about how the candidate works is the same claim the artefact demonstrates by existing.

See it live, here

Open the vault in a new tab ↗The document viewer needs room — better in its own tab than in the frame.

The idea worth stealing: the pack is the evidence

Every candidate pack asserts something about how the candidate works. This one is constructed so that the assertion and the demonstration are the same object. Its own front page says it plainly:

“This pack is itself an example of how he works: a voice memo became a brief, a team of AI agents researched and built the material, and it is delivered as an encrypted, versioned vault.”

A claim to work with agents, made in a document that agents built. A claim about handling sensitive material, made in an artefact whose server cannot read it. The reviewer does not have to believe the claim — the thing in their hands is the test of it.

Three routes, because three people read a CV for different reasons

The interesting structural choice: rather than one document that compromises between audiences, the pack splits at the front door and lets each route stand alone.

A recruiter needs text to paste; a hiring manager needs an argument; a curious reader needs context. Those are genuinely different documents, and the vault holds all three without any of them being a compromise.

Four formats, and the fourth is the interesting one

Each of the four documents — short CV, full CV, the one-page case, the recommendations — exists as PDF, Word, Markdown and JSON, generated from one source by the pack's own build.

PDF is for the human. Word is because recruiters still ask for it. Markdown is for whoever pastes it somewhere. JSON is the one that matters: a CV as structured data, so a machine reading the pack gets fields rather than a page it has to parse. It is the same instinct as this site's llms.txt — publish the thing, and publish it again in the shape a machine wants.

The build refuses what the authoring contract refuses

The pack's own pipeline fails if the page declares a vault resource with <link href>, <script src> or <img src>, uses fetch(), writes location.hash, references a missing file, or contains a JavaScript syntax error. That is the vault authoring contract enforced by the artefact's own build rather than discovered after a push — and the last of those checks is the one that caught a shipped bug on riskmandate.ai the day before.

The viewer degrades honestly too: inside a vault host it loads PDF.js through sg.loadJs and reads bytes through sg.vfs.read, with isEvalSupported: false; where PDF.js cannot run, it falls back to page images rendered at build time. app.json asks for exactly one permission — downloads — so files save without a prompt each time, and the app never writes to the vault.

What it refuses to do, which is the part to copy

• It does not name the client. The role is described as an interim CISO position at a FTSE 250 company and nothing further; one line in the strategy brief states outright that “nothing here characterises the client, which is not named.”
• It discloses its own redaction rather than hiding it. The strategy brief carries an editor's note saying which sections were removed for publication — the off-payroll analysis, pricing, and two contract items on status and rate — and that nothing else changed. The brief keeps its original date.
• It states its limits inside the argument. The same note records that this is not legal or tax advice, that several paragraph numbers could not be read at the primary source and are marked, that one tribunal outcome comes from commentary rather than the decision, and that no reported case was found on one question — “reported as a gap rather than as comfort.”
• It includes a conflict disclosure and a section called Tensions in the material written for the people deciding whether to hire.
• The recommendations are dated and sourced. Thirteen of them, each carrying its 2019 job title and relationship, attributed to the candidate's own 2019 deck (CC BY-SA), which ships in the vault's archive/ so the source can be checked rather than taken on trust.

The pre-publication audit

Run against a full clone with the published read key, before this page existed. The submitter's position was that the vault holds no sensitive data, does not identify the company, and reuses material that was already public. Checked, and it holds — with one point worth a reader knowing:

This page quotes the candidate and the pack's own framing; it does not reproduce the individual recommendations, which stay where their provenance is stated.

What to take from it

• Split at the front door, not inside the document. If three people read a thing for three reasons, three routes beat one compromise.
• Ship the machine-readable copy beside the human one. A CV as JSON costs one build step and changes what a machine can do with it.
• Put the redaction note in the artefact. A document that says what was removed is more trustworthy than one that reads as though nothing was.
• Let the artefact be the proof of the claim it makes. This is the most portable idea here and it is not about hiring.

Shape

Published as row #29. ← All published vaults · The publishing method