When I joined the project, the SOC-as-a-Service offering had been sold, but the technical solution to deliver it hadn’t been developed. I stepped in to turn that commitment into a working platform.
01Engineering & service delivery
Building a security service from the ground up.
The offering had been sold; the technical solution still needed to be built. I architected the platform, built its federated-search integration, and developed the engineering team and delivery operation as the service grew from 1 to 16 customers.
- 1 to 16 customers
- Federated search
- Distributed, multi-tenant SIEM
I architected the solution and personally designed and built the custom API integration. As the service grew, I developed the organizational structure, established service delivery processes and standard operating procedures, hired engineers, and managed delivery.
The custom API integration enabled federated search across multiple customer logging-platform tenants, giving the SOC team a single view across customer environments. This enabled a distributed architecture and delivery of a multi-tenant SIEM. The Splunk-based platform spans cloud, hybrid, and on-prem environments, with a reusable content framework for consistent detections.
The service grew from 1 to 16 customers. The work expanded from creating the technical solution to building the team and operating structure needed to deliver the service as it scaled.