Modernizing Security Operations & Detection Engineering

When I joined this program, the security operations function was fragmented: log coverage was inconsistent, detections were noisy, and analysts spent more time chasing false positives than investigating real threats. I set out to fix the underlying pipeline rather than patch the symptoms.

I led the effort to onboard the vast majority of the enterprise's log sources — well over 90% of them — into Microsoft Sentinel, giving the SOC a single, comprehensive view of activity across the environment for the first time. From there, I rebuilt detection logic from the ground up, tuning rules against real attack patterns instead of generic vendor defaults, and layered in SOAR playbooks to automate the repetitive parts of triage and response.

The impact showed up immediately in the numbers analysts felt every day: mean time to detect dropped by roughly half, false-positive alert volume fell by nearly 90%, and mean time to respond shrank by around three-quarters. Just as important, I served as the primary escalation point for significant incidents — coordinating investigation, containment, and remediation across the SOC, infrastructure teams, and business stakeholders, and closing the loop with lessons-learned reviews that fed directly back into the detection engineering backlog.

This wasn't a one-time project; it became the operating model. The playbooks, tuning practices, and cross-team escalation process I put in place are still how the organization runs its security operations today.