General

Mastering a Growth Mindset in Engineering Leadership with Saadia Khilji

Published Sep 14, 2023

Updated Sep 14, 2023

2 min read

This article was written over 18 months ago and may contain information that is out of date. Some content may be relevant but please refer to the relevant official documentation or available resources for the latest information.

In this episode, Tracy Lee talks with Saadia Khilji, the Head of End User Technology and Service at MassMutual. Saadia's career journey is marked by continuous growth and a commitment to fostering growth mindsets within her teams. She begins by sharing her diverse career path, from starting as a software engineer to embracing roles as a tech lead, QA support, and ultimately, her current leadership position.

Saadia's dedication to a growth mindset is a recurring theme throughout the conversation. She emphasizes the importance of actively seeking feedback, a practice she continues to this day, holding coffee chats with her team members to enhance collaboration and drive improvement.

By actively seeking feedback and encouraging learning, she has seen her team members become more innovative, inquisitive, and courageous in sharing ideas and feedback. This fosters a culture of continuous improvement and growth.

One pivotal aspect of leadership Saadia discusses is the ability to recommend solutions effectively. She advises leaders to base their recommendations on data, emphasizing the importance of backing decisions with factual information. Additionally, she champions an approach that considers the broader ecosystem and the potential impact of the proposed solutions on various parts of the organization.

Saadia's insightful perspective also touches on the hero mentality that leaders should avoid. She underscores the value of collaboration and involving experts within the organization to arrive at better solutions collectively. Her emphasis on the power of collaboration and diverse expertise resonates strongly with those aspiring to effective leadership.

Saadia shares her active involvement in organizations that empower women, such as "Pakistani Women in Computing." She discusses the importance of building a support system for women in technology, providing mentorship, career guidance, and creating opportunities for them to thrive.

Saadia's experiences underscore the significance of seizing opportunities for growth, fostering growth mindsets, and actively giving back to the community. Her career journey serves as an inspiration, emphasizing the value of seeking feedback, making data-driven decisions, and collaborating with diverse teams.

Saadia provides a compelling narrative of leadership growth, offering valuable insights into the world of engineering leadership. Her authentic commitment to continuous learning and giving back to her community makes her a remarkable figure in the field, serving as an inspiration for all aspiring leaders.

This Dot is a consultancy dedicated to guiding companies through their modernization and digital transformation journeys. Specializing in replatforming, modernizing, and launching new initiatives, we stand out by taking true ownership of your engineering projects.

We love helping teams with projects that have missed their deadlines or helping keep your strategic digital initiatives on course. Check out our case studies and our clients that trust us with their engineering.

Cybersecurity Leadership 101 with Dr. Joye Purser

Dr. Joye Purser is the field Chief Information Security Officer (CISO) at Veritas, a software company specializing in data backup systems. Veritas' global leadership in cybersecurity plays a critical role in data backup and restoration in the cybersecurity landscape. Dr. Purser's career ranges from her time at the Cybersecurity and Infrastructure Security Agency (CISA) for the U.S. Department of Homeland Security to roles at the Pentagon and the White House. Dr. Purser talks about common misconceptions regarding working in the government in the field of technology and notes the increasing trend of tech companies recruiting individuals with defense and military backgrounds due to rising threats to the private sector. There is an evolution in cybersecurity, particularly post-pandemic, with an increased sophistication of cyber threats and a rise of ransomware attacks. There is now a heightened focus on critical infrastructure security and a new outlook on the potential life-threatening consequences of cyber disruptions. The qualities of effective cybersecurity leadership are vision, adaptability, and emotional intelligence. Dr. Purser elaborates on the importance of having a clear vision, especially in an emerging role like hers at Veritas. She shares her experience obtaining the Certified Information System Security Professional (CISSP) certification, highlighting the necessity of adaptability in acquiring new skills and staying ahead of the rapidly changing cybersecurity landscape. Dr. Purser stresses the significance of soft influencing skills, adaptability in communication styles based on the audience, and the ability to read the room. She emphasizes the need for emotional intelligence when asking for resources or driving change, recognizing the discomfort associated with these demands. Listen to the podcast here: https://engineeringleadership.podbean.com/e/joye-purser/...

Jan 16, 2024

2 mins

Engineering Leadershipcybersecurity

Innovation is NOT Just Creating Something New: Dylani Herath, FinTech Leader

Dylani Herath, a well known FinTech leader who has worked at organizations such as Greenwood, JP Morgan, and FIS sat down with Rob Ocel, Engineering Lead at This Dot Labs and shared some insight on how digital leaders can improve culture and lead successful transformations by balancing business objectives and engineering needs. Dylani began her career with a scholarship that allowed her to work for an engineering company while studying. This experience laid the foundation for her future endeavors in consulting, where she focused on process improvement, quality assurance, automation, and optimization. Eventually, she found herself in the fintech industry, working with large organizations to transform and optimize their engineering processes. Ways to be a Successful Transformative Leader Creating a roadmap with measurable objectives One key aspect of effective leadership is aligning the team's technological capabilities with the organization's transformation initiatives. This alignment ensures that the team is equipped to drive change and achieve the desired outcomes. She emphasizes the importance of tying transformation initiatives to measurable objectives, as this provides a clear roadmap for success. Creating a relationship with your team Another crucial factor in driving transformation is having the right people on board. Dylani highlights the significance of leaders building strong relationships with their staff to foster a collaborative and supportive environment. This enables the team to work together towards common goals and drive change effectively. Building platforms to allow ideas and innovation Creating forums for brainstorming and innovation is another strategy Dylani suggests for engineering leaders. These platforms allow team members to share ideas, think outside the box, and come up with innovative solutions to challenges. By encouraging creativity and collaboration, leaders can harness the full potential of their team. Clear and transparent communication Communication is also a vital aspect of effective leadership. Dylani advises leaders to clearly communicate the reasons behind unpopular decisions, ensuring that they align with the organization's long-term goals. This transparency helps build trust and understanding among team members, even in the face of difficult choices. Incremental transformation, incremental wins Taking innovative solutions such as new AI tools and harnessing the power of those tools, but implementing them incrementally as there are opportunities for transformation within an organization is the best approach versus investing in large initiatives that take a long time to see results. Done incrementally, organizations can gain valuable insights from their data and make informed decisions that drive transformation and optimize processes. Dylani's insights on engineering leadership and championing change provide valuable guidance for leaders looking to drive transformation within their organizations. You can follow her on LinkedIn at https://www.linkedin.com/in/dylaniherath/. You can listen to the podcast here: https://engineeringleadership.podbean.com/e/innovation-is-not-just-creating-something-new-dylani-herath-fintech-leader/...

Jan 10, 2024

3 mins

Engineering Leadership

Lessons from the DOGE Website Hack: How to Secure Your Next.js Website

Lessons from the DOGE Website Hack: How to Secure Your Next.js Website The Department of Government Efficiency (DOGE) launched a new website, doge.gov. Within days, it was defaced with messages from hackers. The culprit? A misconfigured database was left open, letting anyone edit content. Reports suggest the site was built on Cloudflare Pages, possibly with a Next.js frontend pulling data dynamically. While we don’t have the tech stack confirmed, we are confident that Next.js was used from early reporting around the website. Let’s dive into what went wrong—and how you can secure your own Next.js projects. What Happened to DOGE.gov? The hack was a classic case of security 101 gone wrong. The database—likely hosted in the cloud—was accessible without authentication. No passwords, no API keys, no nothing. Hackers simply connected to it and started scribbling their graffiti. Hosted on Cloudflare Pages (not government servers), the site might have been rushed, skipping critical security checks. For a .gov domain, this is surprising—but it’s a reminder that even big names can miss best practices. It’s easy to imagine how this happened: an unsecured server action is being used on the client side, a serverless function or API route fetching data from an unsecured database, no middleware enforcing access control, and a deployment that didn’t double-check cloud configs. Let’s break down how to avoid this in your own Next.js app. Securing Your Next.js Website: 5 Key Steps Next.js is a powerhouse for building fast, scalable websites, but its flexibility means you’re responsible for locking the doors. Here’s how to keep your site safe. 1. Double-check your Server Actions If Next.js 13 or later was used, Server Actions might’ve been part of the mix—think form submissions or dynamic updates straight from the frontend. These are slick for handling server-side logic without a separate API, but they’re a security risk if not handled right. An unsecured Server Action could’ve been how hackers slipped into the database. Why? Next.js generates a public endpoint for each Server Action. If these Server Actions lack proper authentication and authorization measures, they become vulnerable to unauthorized data access. Example: * Restrict Access: Always validate the user’s session or token before executing sensitive operations. * Limit Scope: Only allow Server Actions to perform specific, safe tasks—don’t let them run wild with full database access. * Don’t use server action on the client side without authorization and authentication checks 2. Lock Down Your Database Access Another incident happened in 2020. A hacker used an automated script to scan for misconfigured MongoDB databases, wiping the content of 23 thousand databases that have been left wide open, and leaving a ransom note behind asking for money. So whether you’re using MongoDB, PostgreSQL, or Cloudflare’s D1, never leave it publicly accessible. Here’s what to do: * Set Authentication: Always require credentials (username/password or API keys) to connect. Store these in environment variables (e.g., .env.local for Next.js) and access them via process.env. * Whitelist IPs: If your database is cloud-hosted, restrict access to your Next.js app’s server or Vercel deployment IP range. * Use VPCs: For extra security, put your database in a Virtual Private Cloud (VPC) so it’s not even exposed to the public internet. If you are using Vercel, you can create private connections between Vercel Functions and your backend cloud, like databases or other private infrastructure, using Vercel Secure Compute Example: In a Next.js API route (/app/api/data.js): ` > Tip: Don’t hardcode MONGO_URI—keep it in .env and add .env to .gitignore. 3. Secure Your API Routes Next.js API routes are awesome for server-side logic, but they’re a potential entry point if left unchecked. The site might’ve had an API endpoint feeding its database updates without protection. * Add Authentication: Use a library like next-auth or JSON Web Tokens (JWT) to secure routes. * Rate Limit: Prevent abuse with something like rate-limiter-flexible. Example: ` 4. Double-Check Your Cloud Config A misconfigured cloud setup may have exposed the database. If you’re deploying on Vercel, Netlify, or Cloudflare: * Environment Variables: Store secrets in your hosting platform’s dashboard, not in code. * Serverless Functions: Ensure they’re not leaking sensitive data in responses. Log errors, not secrets. * Access Controls: Verify your database firewall rules only allow connections from your app. 5. Sanitize and Validate Inputs Hackers love injecting junk into forms or APIs. If your app lets users submit data (e.g., feedback forms), unvalidated inputs could’ve been a vector. In Next.js: * Sanitize: Use libraries like sanitize-html for user inputs. * Validate: Check data types and lengths before hitting your database. Example: ` Summary The DOGE website hack serves as a reminder of the ever-present need for robust security measures in web development. By following the outlined steps–double-checking Server Actions, locking down database access, securing API routes, verifying cloud configurations, and sanitizing/validating inputs–you can enhance the security posture of your Next.js applications and protect them from potential threats. Remember, a proactive approach to security is always the best defense....

Mar 7, 2025

4 mins

NextJS

Incremental Hydration in Angular

Incremental Hydration in Angular Some time ago, I wrote a post about SSR finally becoming a first-class citizen in Angular. It turns out that the Angular team really treats SSR as a priority, and they have been working tirelessly to make SSR even better. As the previous blog post mentioned, full-page hydration was launched in Angular 16 and made stable in Angular 17, providing a great way to improve your Core Web Vitals. Another feature aimed to help you improve your INP and other Core Web Vitals was introduced in Angular 17: deferrable views. Using the @defer blocks allows you to reduce the initial bundle size and defer the loading of heavy components based on certain triggers, such as the section entering the viewport. Then, in September 2024, the smart folks at Angular figured out that they could build upon those two features, allowing you to mark parts of your application to be server-rendered dehydrated and then hydrate them incrementally when needed - hence incremental hydration. I’m sure you know what hydration is. In short, the server sends fully formed HTML to the client, ensuring that the user sees meaningful content as quickly as possible and once JavaScript is loaded on the client side, the framework will reconcile the rendered DOM with component logic, event handlers, and state - effectively hydrating the server-rendered content. But what exactly does "dehydrated" mean, you might ask? Here's what will happen when you mark a part of your application to be incrementally hydrated: 1. Server-Side Rendering (SSR): The content marked for incremental hydration is rendered on the server. 2. Skipped During Client-Side Bootstrapping: The dehydrated content is not initially hydrated or bootstrapped on the client, reducing initial load time. 3. Dehydrated State: The code for the dehydrated components is excluded from the initial client-side bundle, optimizing performance. 4. Hydration Triggers: The application listens for specified hydration conditions (e.g., on interaction, on viewport), defined with a hydrate trigger in the @defer block. 5. On-Demand Hydration: Once the hydration conditions are met, Angular downloads the necessary code and hydrates the components, allowing them to become interactive without layout shifts. How to Use Incremental Hydration Thanks to Mark Thompson, who recently hosted a feature showcase on incremental hydration, we can show some code. The first step is to enable incremental hydration in your Angular application's appConfig using the provideClientHydration provider function: ` Then, you can mark the components you want to be incrementally hydrated using the @defer block with a hydrate trigger: ` And that's it! You now have a component that will be server-rendered dehydrated and hydrated incrementally when it becomes visible to the user. But what if you want to hydrate the component on interaction or some other trigger? Or maybe you don't want to hydrate the component at all? The same triggers already supported in @defer blocks are available for hydration: - idle: Hydrate once the browser reaches an idle state. - viewport: Hydrate once the component enters the viewport. - interaction: Hydrate once the user interacts with the component through click or keydown triggers. - hover: Hydrate once the user hovers over the component. - immediate: Hydrate immediately when the component is rendered. - timer: Hydrate after a specified time delay. - when: Hydrate when a provided conditional expression is met. And on top of that, there's a new trigger available for hydration: - never: When used, the component will remain static and not hydrated. The never trigger is handy when you want to exclude a component from hydration altogether, making it a completely static part of the page. Personally, I'm very excited about this feature and can't wait to try it out. How about you?...

Mar 14, 2025

3 mins

AngularJavaScript

Let's innovate together!

We're ready to be your trusted technical partners in your digital innovation journey.

Whether it's modernization or custom software solutions, our team of experts can guide you through best practices and how to build scalable, performant software that lasts.

Mastering a Growth Mindset in Engineering Leadership with Saadia Khilji

You might also like

Cybersecurity Leadership 101 with Dr. Joye Purser

Innovation is NOT Just Creating Something New: Dylani Herath, FinTech Leader

Lessons from the DOGE Website Hack: How to Secure Your Next.js Website

Incremental Hydration in Angular

Let's innovate together!

You might also like

Cybersecurity Leadership 101 with Dr. Joye Purser

Innovation is NOT Just Creating Something New: Dylani Herath, FinTech Leader

Lessons from the DOGE Website Hack: How to Secure Your Next.js Website

Incremental Hydration in Angular