Technologies: Splunk, Azure Sentinel, IBM QRadar, SUMO Logic, Devo, SentinelOne, CrowdstrikeResponsibilities:• Created roadmaps for Content in customer environments to provide a custom-tailored Detection Web encompassing their areas of interest• Worked with Customers to identify key visibility gaps and develop Custom Detection Rules for these use cases• Provided guidance on logging enhancements and future planning for further infrastructure. • Coordinated with internal and external teams to improve the accuracy of detection capabilities and implement custom processes depending on customer requirements• Performed detection reviews on Content across numerous technologies to ensure fidelity of rules• Tracked down and identified issues with Content when not performing as expected• Helped develop statics based off coverage to convey success and areas of improvements to executives• Helped develop new training processes for SIEM technologies and taught incoming new hires.

Technologies: Splunk, IBM QRadar, SUMO Logic, Devo, SentinelOneResponsibilities: • Researched and deconstructed cyber-attacks into sequenced Indicators of Compromise (IOC) detectable through numerous log sources including Operational Technologies.• Created abstract rules to detect potentially malicious activity leveraging IOC and MITRE Tactics, Techniques, and Procedures (TTP)• Conducted open ended analysis of large data sets in order to find network activity baselines as well as abnormalities • Implemented SIEM detections across SIEM technologies• Tested and verified SIEM rules operate accurately and efficiently• Clearly and effectively documented work to inform multiple audiences of how to use the developed rules and content.• Helped develop new training processes for SIEM technologies and taught incoming new hires.