I’ve spent more than ten years in IT and cyber defense. I started on the repair bench in Morehead City, then ran IT for a Crystal Coast marina, then became a senior security consultant at a global managed-security provider, advising large enterprise clients from the C-suite down.
At the world’s largest convenience-store chain, I took over a cyber defense program that was a burning hole in the ground. The documentation was gone, no policies existed, the team was empty, and much of the environment was whitelisted problems. I wrote the policies and procedures, handled every incident myself at first, and hired the team: five engineers and 25 to 30 analysts over time. It was my program to build.
I built the in-house Security Operations Center, which handled about 3,000 alerts a month and saved the company $1.8 million a year. Then I automated it. Using SOAR tools and my own Python and Bash scripts, analysis time dropped from about an hour to five minutes, and roughly 95% of manual triage went away. That automation won us sandboxing competitions, and we were recognized for advanced use of threat intelligence: tracing attacks back to first contact and tracking the actors behind them.