CAPABILITIES
Technical judgment.
Operational leadership.
Experience across investigations, security engineering and team leadership—connecting the technical work with the decisions that make it effective.
SOC leadership & operations
SOC operating models, analyst development, escalation and service quality across Microsoft and global MSSP environments.
Explore SOC leadership →Detection engineering
SIEM/XDR detection authoring, validation and tuning, with DevOps and sprint-based practices for repeatable delivery.
Read the detection chapter →Incident response & threat intelligence
Advanced-threat investigations, evidence handling, containment decisions and applying findings to detection and response.
Explore incident decision rights →Security engineering & product delivery
Technical direction across telemetry, investigation workflows and security-product development in mixed-vendor environments.
Read about the Microsoft work →AI security & governance
AI-enabled security operations, agent identity, authorization and operational evidence, connected to AI management-system implementation and assurance.
Explore AI governance →Risk & executive communication
Helping technical and business stakeholders examine control effectiveness, uncertainty and security investment decisions.
Explore Cyber P&L →APPLIED WORK
From telemetry to response readiness.
Across 8 SIEM and 2 XDR platforms, that work has included telemetry integration, playbooks, permissions, human approvals, evidence preservation and rollback. These resources show the approach in practice.