About

I'm Senior Director of a Global SOC, based in the United Kingdom. I oversee security operations and incident response across a global infrastructure — the people, the detections and the processes that decide whether an organisation notices an intrusion on day one or day forty.

I came to security late and sideways, which I think is an advantage. Twenty-five years in IT, most of it in financial services, before moving into cyber security in 2017. Having spent that long building and running the infrastructure means I tend to ask a different first question about a proposed control: not is this good practice, but what will this actually do to the people who have to live with it on Monday morning.

This site is where I keep my writing, my notes and the resources I find myself sending to people more than once.

What I work on

• Incident handling — leading or supporting investigations from first alert through to the post-incident report.
• Threat hunting — proactive searches across endpoint and network telemetry for behaviour that never triggered an alert.
• Security engineering — the plumbing: log pipelines, coverage gaps, automation and the tooling that makes the above repeatable.
• Detection and response — designing, tuning and validating detections so that alerts mean something by the time they reach an analyst.

Experience

Senior Director, Global SOC —

[2024] – present

Running the global security operations centre: detection strategy, incident response, and the analysts who carry both. The job is as much about building a team that can absorb whatever arrives next as it is about any individual alert.

Most of what I do sits at the join between the technical and the strategic — translating what the SOC sees into decisions the business can act on, and translating business priorities into detections and processes that hold up under pressure.

Security analyst to security leadership

2017 – present

I moved into cyber security in 2017 as an analyst and worked up from there. The whole arc has been in and around financial services, which shapes how I think about risk: regulated, high-consequence, and with very little tolerance for a control that looks good on a slide and falls apart in production.

Infrastructure and IT

2000 – 2017

Seventeen years building and running IT, mostly in financial services. This is the part of the CV that people expect me to skip past, and it's the part I lean on most.

Certifications and training

MSc Advanced Security and Digital Forensics — Edinburgh Napier University, 2016–2018. One of a small number of UK degrees certified by GCHQ.

Applied Cybersecurity Certificate (ACS) — SANS Technology Institute, in progress. The GIAC certifications above are the coursework.

Tooling I use regularly

Cortex XDR · Splunk · Microsoft Sentinel · Suricata · Zeek · Velociraptor · Python · Sigma · MITRE ATT&CK

(Trim this to the tools you actually use — a short honest list reads far better than a long aspirational one.)

Still studying

I'm currently working through the Applied Cybersecurity Certificate at SANS Technology Institute, which is where the recent run of GIAC certifications comes from — GFACT, then GSEC, then GCIH.

There's an obvious question in doing undergraduate coursework twenty-five years into a career, and the answer is that running a SOC and being able to do the work are different skills, and the second one decays if you stop practising it. It's harder to ask sensible questions of your own analysts once you've lost the feel for what the job actually involves. So I keep sitting exams.

Beyond the day job

[Home lab, CTFs, community involvement, mentoring, speaking — whatever you want people to know. Delete this heading if the section above covers it.]

Get in touch

The quickest route is email. I'm happy to hear from people early in their security careers as well as from organisations looking for help.