Security Operations Center Analyst / Threat Defense Lead
-
Incident command
I'm the incident commander for our high severity incidents. I coordinate containment, eradication and recovery with the IT, infrastructure and risk teams.
-
Threat hunting and detections
I hunt through SIEM and endpoint telemetry and review our detections against MITRE ATT&CK. I drove our SIEM rule tuning and brought in threat intel mapped to ATT&CK. That work helped bring false positives down by about 40%.
-
Defender for IoT
I led the rollout of Microsoft Defender for IoT across the company. It helped cut the time it takes to detect IoT and OT threats by about 60%.
-
Playbooks and mentoring
I write IR playbooks and case documentation, and I mentor junior analysts.