Risk Modeling

I work across quantitative risk modeling and the software engineering that puts models into production. The interesting problems tend to sit where those two meet — in the assumptions that get lost between a methodology and its implementation — and being fluent in both is what lets me work there, whether that means building it, reviewing it, or setting the standards a team works to.

I’ve owned models end to end: the data strategy underneath them, the methodology itself, the production implementation, and the evidence that both are correct. I know how to make a model trustworthy before the data arrives to prove it — through invariants, regression discipline, calibration against whatever data does exist, and structured review by people who know the domain.

A model is never finished, so review cycles, change management, and impact analysis are as much of the work as the modeling. Every methodology change has to be versioned, communicated to the people relying on the previous numbers, and shipped with a quantified statement of what it does to results already published. The same discipline applies to the path from prototype to production, which is only useful as long as the two don’t drift apart.

A model nobody can explain doesn’t get used, so I also spend time defending numbers in front of clients and executives, and translating between the people who build models and the people who act on them.

Currently I lead the development of the cyber risk quantification model at Squalify, a Munich Re subsidiary where I’m responsible for its methodology, its production implementation, and the standards both are held to.

Selected post from my blog

I illustrate some of my work and discuss challenges in these blog posts: