Security operations
Security operations and incident response
When something looks wrong, you need to know what happened and how far it went. I help you find out, then make sure the next attempt is caught sooner.
When to call
When teams ask for it.
- Alerts arrive, but nobody can say whether an attack is under way
- Something has already happened and you need to know how far it went
- A suspicious file or app is spreading among staff or customers
Scope
What it involves.
- Reviewing what your logs and SIEM can and cannot see
- Building and tuning detections around how attacks actually unfold
- Incident triage, digital forensics and malware analysis
- Turning each incident into fixes and better detections
- DevSecOps and container security: checks from commit to runtime, signed images and admission policy
How it works
How the work is done.
Machines sort the alerts. People make the calls.
Routine triage is automated within policy and logged; anything with real business impact goes to a person.
- 1. Detect
- Across endpoints and SaaS
- 2. Triage
- Enriched automatically
- 3. Investigate
- Reviewed by an analyst
- 4. Respond
- Containment, approved
- 5. Hunt
- For current tradecraft
- 6. Tune
- Fewer false alarms
Outcome
What you have at the end.
Clear answers about what happened, and monitoring that catches the next attempt earlier.
Usually for: Organisations running or building a security operations function
Proof
Work and credentials behind it.
Case notes
Certifications
Writing
Other services
Other ways I can help.
- Penetration testingWeb, API, mobile, network and cloud testing from an attacker's point of view.
- GRC advisoryInformation system audits, ISO/IEC 27001 and security strategy.
- Agentic AI securitySecuring AI agents and LLM features, and automating the security work itself.
- Training and speakingSecurity awareness, technical workshops and conference talks.
Let's scope it together.
Tell me what you need to protect and by when. I'll reply with whether I can help and how I'd approach it.