Security operations
Security operations and incident response
When something looks wrong, you need to know what happened and how far it went. I help you find out, then make sure the next attempt is caught sooner.
Scope
What it involves.
- Reviewing what your logs and SIEM can and cannot see
- Building and tuning detections around how attacks actually unfold
- Incident triage, digital forensics and malware analysis
- Turning each incident into fixes and better detections
When to call
When teams ask for it.
- Alerts arrive, but nobody can say whether an attack is under way
- Something has already happened and you need to know how far it went
- A suspicious file or app is spreading among staff or customers
Outcome
What you have at the end.
Clear answers about what happened, and monitoring that catches the next attempt earlier.
Usually for: Organisations running or building a security operations function
Proof
Work and credentials behind it.
Case notes
Certifications
Writing
Other services
Other ways I can help.
- Penetration testingWeb, API, mobile, network and cloud testing from an attacker's point of view.
- GRC advisoryInformation system audits, ISO/IEC 27001 and security strategy.
- Agentic AI securitySecuring AI agents and LLM features, and automating the security work itself.
- Training and speakingSecurity awareness, technical workshops and conference talks.
Let's scope it together.
Tell me what you need to protect and by when. I'll reply with whether I can help and how I'd approach it.