- Own the detection and response strategy and translate it into multi-quarter initiatives tied to Security KRs.
- Coordinate with Engineering, Infrastructure, and IT to plan logging, telemetry, and response readiness in their roadmaps.
- Set standards for detections and response as code, review practices, playbook quality, and AI-assisted workflows.
- Own detection architecture and the coverage plan for log sources, enrichment, correlation, alert routing, and cost.
- Onboard telemetry, improve signal quality, incorporate threat intelligence, and tune alerts.
- Run the detection lifecycle, including prioritization, unit tests, historical-data replay, attack simulation, and coverage reviews.
- Ship MITRE ATT&CK-aligned detections, threat hunts, and automations using Panther, Python, Git, and CI/CD.
- Improve the incident response plan, readiness, response automation, and forensic readiness.
- Lead high-severity incidents across cloud, SaaS, and corporate systems, and use incident lessons to improve detections, automation, and processes.
- Use and evaluate AI and agents for triage, enrichment, investigation, and response, with appropriate guardrails.
PythonGCPGit+1 more