Financial Infrastructure · DevOps · Boston

Engineering inside
financial services.

Ten years across private equity, retail, and asset management. Real technical experience covering infrastructure, cloud, security, and trading systems. Written plainly to help other engineers navigate this world.

Michael Harlow
Michael Harlow // sys.ghost  ·  Boston, MA
☕ Buy me a coffee
Latest post
Every engineering org I talk to is running AI agents somewhere in production now. Almost none of them have figured out how to operate them the way we operate everything else that touches customer data.
Jul 14, 2026 · 11 min read
Read →
Latest post
Every engineering org I talk to is running AI agents somewhere in production now. Almost none of them have figured out how to operate them the way we operate everything else that touches customer data.
Jul 14, 2026 · 11 min read
Read →
All posts

Archive

We scheduled a Technology Connect event for our engineering team and built a lineup of games around AI and infrastructure topics. Here's how we put it together and what I'd do differently.
← Back to posts
DevOps Apr 14, 2026 · 10 min read

Six Weeks with GitHub Copilot: What Actually Happened

Six Weeks with GitHub Copilot: What Actually Happened

I should be honest about where I started: skeptical. Not dismissively skeptical, but the kind of skeptical that comes from watching a lot of tools get adopted as productivity multipliers and then quietly fade into the background of everyone's workflow without changing much.

I had used Copilot in passing. Accepted a completion here and there, ignored it most of the time. That is not a fair evaluation of anything. So I decided to give it a proper run: six weeks, every day, across the actual infrastructure work I do. Terraform, Python scripts, Helm charts, Bash, the occasional bit of Go.

This is what I found.

The first week is misleading in both directions

The first few days felt impressive in a way that is hard to separate from novelty. Copilot was completing things before I finished typing them. It knew common Terraform patterns. It suggested the boto3 call I was about to write before I had typed the function name.

But I also caught myself accepting completions that were subtly wrong. Not catastrophically wrong. The kind of wrong that would have passed a cursory review and caused a confusing bug later. A Terraform resource block that used a deprecated argument. A Python function that handled the happy path correctly but silently swallowed exceptions in a way I would never have written myself.

The lesson from week one: Copilot is not a replacement for knowing what correct looks like. It is a tool that generates plausible code fast, and plausible is not the same as correct. Once I internalised that distinction and started reading completions the way I would read a junior engineer's PR, the tool became significantly more useful.

Where it genuinely saves time

After six weeks, the honest answer is: boilerplate and pattern repetition.

Writing the fifteenth Kubernetes deployment YAML in a project follows a pattern. Writing an argument parser for a Python script follows a pattern. Writing health check endpoints follows a pattern. For all of these, Copilot is fast and usually right. It knows the shape of what I am trying to do and produces something structurally correct that I then verify and adjust.

The specific things where I noticed meaningful time savings:

Config file generation. Fluent Bit configs, Prometheus alerting rules, nginx configs. These have well-established patterns and the completions are reliable. Not always right, but close enough that editing is faster than writing from scratch.

Writing tests for existing functions. This surprised me. Copilot is quite good at generating a reasonable test structure for a function it can see. The tests are not always comprehensive, but they are a solid starting point that I expand from. Previously I would procrastinate on tests. Now I generate a skeleton and fill it in.

Documentation comments. I started letting Copilot write the first draft of docstrings and README sections. I edit them, but it gets the structure right and I do not have to start from a blank page.

Regex and string manipulation. I am not a person who enjoys writing regex. Copilot is considerably better at it than I am at first attempt, and I can verify the result without writing it.

What it does not help with

The work that requires understanding context Copilot cannot see.

Architecture decisions. When I am deciding whether a piece of infrastructure should be a separate service or a shared library, or whether a particular Kubernetes operator is the right choice for a use case, Copilot has nothing useful to offer. These decisions require understanding the organisation, the team's operational capacity, the existing systems, the compliance requirements. That context does not fit in a context window.

Security-sensitive code. I am more cautious with Copilot on anything touching authentication, secrets handling, or network policy. Not because Copilot is uniquely bad at these, but because the cost of a subtle error is higher and I want to be deliberate rather than fast.

Novel problems. When I am doing something genuinely new, something without a clear pattern Copilot could have learned from, it is not helpful and sometimes actively misleading. It generates something that looks like the thing I want but is not, and I waste time understanding why it does not work before discarding it.

The PR review integration

This is where my opinion got more complicated.

GitHub has rolled out Copilot review suggestions in pull requests. The model reads your diff and leaves comments. I had it enabled for about four weeks across pull requests I was either authoring or reviewing.

The comments fall into a few categories.

Useful catches: Copilot flagged a missing null check in a Python function that I had genuinely missed. It caught a Terraform resource that was not tagging a resource it should have been. These are legitimate finds. Not things a careful human reviewer would miss, but things that get through in a fast review.

Correct but obvious: A significant fraction of the comments were things like noting that an error is not being handled in a place where the calling code handles it perfectly adequately a level up. Technically accurate observations that demonstrate the model does not have enough context to know they are not actionable.

Wrong: Some comments were simply incorrect. Suggestions based on a misreading of what the code was doing. These required a response to explain why the suggestion did not apply, which costs time.

The overall effect on my PRs: slightly useful as a first-pass check before human review. Not useful as a replacement for human review. The signal-to-noise ratio on the automated comments was around 60/40 useful to not useful, which is not high enough to trust without reading everything.

One thing I did find valuable: using Copilot Chat to ask questions about my own diff before submitting. "What edge cases does this function not handle?" produces a useful checklist I can quickly verify. That is a better use of the tool than reading its automated comments after the fact.

Six weeks later

I still use it. That is probably the most honest summary.

My workflow has adapted. I use completions freely for boilerplate and read them carefully for anything with real logic. I use Copilot Chat for a handful of specific tasks: explaining unfamiliar code, generating test skeletons, writing documentation. I do not use the PR review automation as a gating step.

The productivity question is genuinely hard to answer. I write certain things faster. I also spend time reading completions I do not accept. Net, I think it is positive, but modestly so. The people who claim it doubles their productivity are either doing different work than I am or measuring differently than I would.

What has changed more than my speed is my approach to certain tedious tasks. Tests, documentation, boilerplate. I no longer avoid these in the way I used to because the activation energy is lower. Whether that is the tool or just a mindset shift from committing to the experiment, I genuinely cannot separate.

If you work in infrastructure and have been on the fence: try it properly for a month. Not the occasional accepted completion. Actually use it, read its output critically, and form your own view. The honest answer is probably that it is more useful than you expect and less transformative than the marketing suggests.

That is usually where good tools land.

Found this useful?
☕ Buy Michael a Coffee
← More posts

Hey, I'm Michael Harlow.

Senior Systems Engineer · Boston, MA · Writing as sys.ghost

I have spent over a decade building and maintaining infrastructure at the intersection of technology and financial services. My career has taken me through three distinct sectors -- technology, private equity, and asset management -- and each one changed how I think about what reliable infrastructure actually requires.

I started in general IT, which is where most engineers who did not go straight into software end up. Data centers, networking, on-call rotations, learning to label cables properly because unlabeled cables are a promise that someone else will suffer later. The work taught me that almost every sophisticated system is, one layer down, a collection of unglamorous fundamentals that either hold or do not. I still believe that. I still label everything.

Private equity came next, and it was a different world. The infrastructure stakes there are less about uptime and more about data integrity. When deal teams are making acquisition decisions based on data you are responsible for, and when a due diligence process has a hard deadline that does not move regardless of what broke overnight, your relationship with reliability changes. A wrong number in an LP report does not cause an immediate incident. It causes a conversation in a partner meeting six weeks later, and by then you need to reconstruct what happened from imperfect records. I became obsessive about data provenance in PE and I have not stopped.

For the past several years I have been in asset management, supporting trading and investment operations infrastructure. This is the environment I find most technically interesting. The compliance requirements are demanding, the legacy systems have long institutional memories, and the tolerance for operational errors is genuinely low -- not just in terms of business impact, but in terms of regulatory consequence. When markets are open, there is no fixing it after the weekend.

I started Packet & Profit in January 2026 because I kept looking for the kind of writing I wanted to read and finding it mostly did not exist. There is a lot of content for engineers online. There is much less written by engineers working specifically inside regulated financial services firms, being honest about what that actually involves day to day. The compliance conversations, the legacy constraints, the incident management in front of stakeholders who measure downtime in dollars per minute. That is what I write about here.

Outside of work I have been running a Saturday morning robotics course at my local YMCA for kids aged 10 to 14. It is one of the better decisions I have made.

Certifications

Red Hat Certified Engineer (RHCE)
Certified Kubernetes Administrator (CKA)
AWS Solutions Architect -- Associate
CompTIA Security+
HashiCorp Vault Associate

My Stack

RHEL / Ubuntu
Kubernetes
OpenShift
Terraform
Ansible
Prometheus
Grafana
Python / Bash
AWS / Azure
Cisco / Palo Alto
PostgreSQL
Redis
HashiCorp Vault
Fluent Bit
Helm
ArgoCD

Career

2022 -- Present
Senior Systems Engineer, Asset Management -- Boston, MA
Leading infrastructure for trading operations and investment management systems. Responsibilities span network security, cloud migration strategy, Kubernetes platform engineering, and incident response. Deeply involved in T+1 settlement infrastructure work and the shift from overnight batch processing to near-real-time event-driven architecture.
2018 -- 2022
Systems Engineer, Private Equity -- Boston, MA
Built and maintained data infrastructure supporting deal teams, portfolio monitoring, and investor reporting. Managed infrastructure through multiple due diligence cycles with hard deadlines and high data integrity requirements. Led a major data platform migration from on-premises to cloud-hosted infrastructure, including security controls satisfying LP and regulatory requirements.
2015 -- 2018
Infrastructure Engineer, Retail Technology
Supported inventory management, real-time pricing, and supply chain integration systems across a high-SKU retail environment. Operated under peak load conditions where scale was a concrete engineering problem rather than an abstract one. Built out monitoring and alerting infrastructure from scratch and managed a full data center relocation.
2013 -- 2015
IT Engineer, Technology Sector
Established the professional fundamentals: data center operations, network infrastructure, endpoint management, and the on-call rotations that teach you more about system fragility than any textbook. Developed an appreciation for cable labeling that has never left me.

Get in Touch

If you are an engineer working in financial services, curious about the career path, or have a question about something I have written, I would genuinely like to hear from you. Use the and I will get back to you. If something here has been useful, a coffee is always appreciated.

A note on anonymity: I write under my own name but keep my current employer private. The financial services industry is small, the regulatory environment is real, and I want to write honestly without those constraints. All incidents and case studies on this site are anonymised. The technical content is real; identifying details are not.
Get in touch

Contact

Whether you are an engineer in financial services, have a question about something I have written, or just want to say hello - feel free to reach out. I read everything.

Powered by Resend · No spam, ever

Legal

Privacy Policy

Last updated: April 2026

This policy explains what information Packet & Profit collects when you visit this site, how it is used, and what choices you have.

Information We Collect

We do not require you to create an account or provide personal information to read this blog. The only personal information we collect is what you voluntarily submit through the contact form: your name, email address, and message. This information is transmitted via Resend and used solely to respond to your enquiry.

Google AdSense and Advertising

This site uses Google AdSense to display advertisements. Google AdSense uses cookies and similar tracking technologies to serve ads based on your prior visits to this and other websites. This means Google may use information about your visits to this site to show you personalised ads on other sites across the web.

You can opt out of personalised advertising by visiting Google Ads Settings, aboutads.info, or optout.networkadvertising.org. See Google advertising policies for more.

Cookies

This site uses a single first-party cookie to remember your theme preference (light or dark mode). This cookie contains no personal information. Third-party cookies may be set by Google AdSense for advertising purposes as described above.

Analytics

This site does not currently use any analytics platform beyond what Vercel provides as part of its standard hosting service (aggregated, anonymised traffic data).

Contact Form

When you submit the contact form, your name, email address, subject, and message are transmitted to the blog author via Resend. This data is not stored by this site and is not shared with any third party beyond Resend. See Resend's privacy policy for details.

Third-Party Links

Posts on this site may link to external websites. We are not responsible for the privacy practices or content of those sites.

Your Rights

If you have submitted a message via the contact form and would like that information removed, or if you have any questions about this policy, please use the contact form to get in touch.

Changes to This Policy

We may update this policy from time to time. The date at the top of this page reflects when it was last revised.

Legal

Terms of Service

Last updated: April 2026

By accessing and using Packet & Profit (packetandprofit.com), you agree to be bound by these Terms of Service. If you do not agree, please do not use this site.

Use of Content

All written content, illustrations, and code examples published on this site are the original work of Michael Harlow unless otherwise stated. You are welcome to share links to posts and quote brief excerpts (with attribution), but you may not reproduce full articles, copy content to other websites, or use the content for commercial purposes without written permission.

No Professional Advice

Content published on this site reflects personal opinions and professional experience. It is provided for informational and educational purposes only. Nothing on this site constitutes financial, investment, legal, or professional advice of any kind. See the for more detail.

Third-Party Links

This site may contain links to third-party websites. These links are provided for convenience and do not constitute an endorsement of the linked site or its content. We have no control over and accept no responsibility for external sites.

Advertising

This site participates in Google AdSense, which displays advertisements from third-party advertisers. The presence of an advertisement does not constitute an endorsement of the advertiser's products or services. Ad content is determined by Google based on the content of this site and your browsing history.

Accuracy of Information

While we make every effort to ensure the accuracy of information published on this site, technology and financial markets change rapidly. Information that was accurate at the time of publication may become outdated. We do not warrant the completeness, accuracy, or timeliness of any content on this site.

Limitation of Liability

To the fullest extent permitted by law, Packet & Profit and its author shall not be liable for any direct, indirect, incidental, or consequential damages arising from your use of, or inability to use, this site or its content.

Changes to These Terms

We reserve the right to update these terms at any time. Continued use of the site following any changes constitutes your acceptance of the revised terms. The date at the top of this page reflects the most recent revision.

Contact

If you have questions about these terms, please use the .

Legal

Disclaimer

Last updated: April 2026

Packet & Profit is a personal blog written by Michael Harlow, a Systems Engineer based in Boston, MA. The views expressed here are entirely his own and do not represent those of any employer, client, or organisation he is affiliated with.

Not Financial or Investment Advice

This site discusses financial services technology, investment management infrastructure, and related engineering topics from a technical practitioner's perspective. Nothing published here is financial advice, investment advice, or a recommendation to buy, sell, or hold any security, asset, or financial instrument. The author is not a registered financial adviser, broker, or investment professional.

Content that references financial markets, trading systems, or investment firms is provided for technical and educational context only. Any figures, case studies, or examples are illustrative and should not be relied upon for financial decisions.

Not Legal or Professional Advice

Nothing on this site constitutes legal, compliance, regulatory, or professional advice. Readers should consult qualified professionals for advice specific to their circumstances.

Professional Experience

Posts on this site draw on the author's professional experience in systems engineering across private equity, retail technology, and asset management. Specific details about employers, clients, projects, and colleagues have been anonymised or generalised. Any resemblance to specific organisations is incidental.

Accuracy

The author makes reasonable efforts to ensure published information is accurate at the time of writing. The technology and financial services landscape changes quickly. Readers should verify any technical or regulatory information against current primary sources before acting on it.

Affiliate Links and Advertising

This site displays advertisements through Google AdSense. The site may also contain links to tools, services, or products that the author uses or finds useful. These are not paid endorsements unless explicitly stated. The author's opinions are his own and are not influenced by advertisers.

Questions

For questions about anything on this site, please use the .

This site uses cookies for theme preferences and displays ads via Google AdSense, which may use cookies to personalise ads.