Google Tag Manager is an absolute cancer on web development.

Once it's in, you'll never get rid of it.

Apparently it lets people drop in random code from a bunch of different analytics platforms, so it's pretty much guaranteed to consist entirely of the sort of stuff I have NoScript enabled to block in the first place.

Some random guy in his basement assured someone in marketing they could handle our volume? Chuck their tag in and watch their website get DDoS'ed with millions of requests per minute, which takes out our website because marketing made it fail loudly.

IT can often be "we make someone else's bad idea happen," and that's because we simply lack veto power.

Personal attacks for doing your job? If you're still there, the stock options had better be enormous!

If you are the most knowledgeable person then you get blamed for their bullshit fantasies being impossible or unwise (or illegal)

"I trust people just fine. I trust people working for outside companies dependent on information gathering to gather information. Google has no fiduciary duty to our clients. Same with Facebook. We DO have a fiduciary duty to our clients and it includes not doing things that may send their confidential information to third parties because SOME of the information used may be useful to our marketing department."

Hiring people is difficult as there is lack of supply of talented people. We hire InfoSec on contract basis not full-time and they don't join such meetings due to the nature of the contract. So all the responsibility fell on me to defend our technical decisions at that point in time.

I'm working on building out the engineering culture / awareness within management now, to ensure these things do not happen, and I don't have to be questioned as to why we cannot install "google tag manager" in our front-end.

It all comes down to creating awareness, and making people understand. Fortunately for me our CEO gets it, he ended up siding with me.

To me, this is an even more concerning issue. But then, I have no idea how the finance services world works, so maybe this is more common than I think?

Outsourced CISO/InfoSec is a valid and reasonable thing for some companies.

If I was running a financial services startup, those groups would be near the front of my list in terms of internal hiring.

But again, since it's not always easy to find the right people I end up having to fill in for everything we don't have a team member to execute on.

Usually I try to reason with management first. If it can be resolved internally we would not include outside consultants, however if it gets serious beyond something we can handle internally we would ask outside consultant to come in.

You really need to present well and be careful about arguments like “millions of websites use GTM”. I did days of research and presented that while yes using GTM on Wordpress sites that hold no sensitive data might be fine however we are a financial services and we collect customer private data. So getting everyone on the same page and presenting alternative ways of solving the problem was critical.