About
Security engineering leader focused on building defensible cloud and hybrid environments.
Professional summary
I started out in security engineering and operations, building and running the systems that detect and respond to threats. Over nearly two decades that work expanded into architecture reviews, program leadership, and advising teams on how to secure cloud, hybrid, and AI-driven environments.
Today my focus is on making security practical: translating risk into architecture, turning threat intelligence into detections, and automating the repetitive work so teams can focus on high-impact decisions. I write and speak about these topics because security only works when engineering, leadership, and operations share the same mental model.
When I’m not leading technical reviews or incident response, I’m usually working on publications, media commentary, or mentoring the next generation of security engineers.
Current focus
Setting technical direction for cybersecurity solutions across cloud and hybrid infrastructure at Cloud Software Group — translating threat intelligence and organizational risk into architecture, controls, detection engineering, and operational practice. Present priorities include SIEM detection coverage, SOAR automation, attack surface management, data security posture, and insider threat detection.
How I work
- Architecture-first: threat model and review before anything reaches production.
- Detection as engineering: adversary TTP research becomes testable, versioned detection logic.
- Automate the repeatable: if the SOC does it twice by hand, it becomes a playbook.
- Communicate in risk, not jargon — especially with executives and auditors.