Support and provide insight into security incidents, particularly analysing and correlating datasets in Splunk. Experience has enhanced the ability to develop anomaly detection criteria in Splunk. Following resolution of incidents, tuning detection criteria to reduce false positive alerts.Conducted numerous threat hunting exercises, both hypothesis driven and from known indicators of compromise. Resulted in several incident response plans being initiated, including end-to-end support from hunting to triage, investigation to resolution. Developed threat models for three of the Bank’s most critical systems to identify vulnerabilities and most likely attackers and attack vectors. Led prioritisation discussions with senior stakeholders and influenced decisions on security investment.Created numerous security detection rules and dashboards in Splunk, mapping these to the MITRE ATT&CK knowledge base to provide a structured approach enabling adversary detection at multiple stages in the attack lifecycle.Developed playbooks for all monitoring rules and run scenarios with responder teams to ensure there is a self-contained, documented set of prescriptive steps for triage. Subsequently, developed automation of multiple playbooks in Phantom. Successfully mentored two apprentices during the two-year Firebrand IT Apprenticeship, finishing in March 2019. Developed their technical and soft skills and successfully guided them through applying and gaining permanent roles within the team and multiple promotions.

Deployed information security policies and standards across the organisation and ensured governance through compliance testing.

Created an incident management process for a financial services organisation, testing the process through a simulated malware infection scenario, outlining detailed steps to follow at each stage of the process to effectively manage the incident.Conducted multiple technical control assessments for financial services organisations, mapping to industry standards, such as the CIS Control Framework.