- Design, build, test, and tune detections across cloud, identity, endpoint, and email telemetry using detection-as-code practices mapped to MITRE ATT&CK.
- Manage security logging, SIEM, and alerting pipelines.
- Monitor AI tools, agents, MCP integrations, and API keys for data exposure, misuse, and anomalous behavior.
- Lead investigation, containment, eradication, and recovery for security incidents.
- Coordinate significant incident response with legal, compliance, and leadership on regulatory notification obligations.
- Maintain incident response plans, playbooks, and runbooks, and conduct tabletop exercises and post-incident reviews.
- Deploy and manage security operations tools, including cloud security monitoring, WAF, DDoS protection, IDS, CrowdStrike EDR, and email security.
- Build AI agents and automation for alert triage, enrichment, investigation, and response.
- Review vulnerability scan and penetration test results, identify true positives, and propose remediation or mitigating controls.
- Advise on AWS cloud security and secure design, and mentor security and partner engineering teams.
AWSPython