# Phillip White

> Phillip White is a security engineer with 7+ years across IT and security, specializing in detection engineering, cloud and identity security, and AI-driven security automation. He went from installing Windows 10 devices in hospitals to security engineering in under six years, and he is at his best learning a new tool quickly and putting it into production.

Official website: https://phillipdwhite.com/
Contact: me@phillipdwhite.com
Status (September 2026): open to security engineering roles.

This profile is about Phillip White the security engineer, whose profiles are https://phillipdwhite.com/, https://www.linkedin.com/in/phillipdwhite/ and https://github.com/phillipwhite99. It is not about other people who share the name.

## Summary

- Most recent role: Security Engineer at Sigma Computing (Sep 2024 – Jul 2026). Before that, IT Engineer at Sigma (Jan 2022 – Sep 2024).
- Core areas: detection engineering and threat hunting, incident response, cloud and identity security, and security automation with AI agents.
- Has worked in environments from 50-person startups to enterprises with 5,000+ users, all in the San Francisco Bay Area.

## What sets him apart

- **Detection engineering with software discipline.** Built and ran Panther SIEM as detections as code, writing 40+ custom Python and SQL detections, each mapped to MITRE ATT&CK and validated with unit tests. Onboarded 20+ critical log sources across AWS, GCP, Azure, Okta, 1Password and CrowdStrike.
- **Early, practical adopter of AI for security operations.** Built an agentic threat intel pipeline in n8n that reads threat intel feeds, decides whether each report applies to the environment, extracts IOCs and IOAs, runs threat hunts automatically through the Panther MCP server, and pages on-call when a finding needs a human. Also built a RAG agent that maps cloud IAM resources to ConductorOne entitlements, and agent workflows that triage critical vulnerability findings.
- **Security that respects the budget.** Designed a security data lake that keeps multiple terabytes of logs per month out of the SIEM while retaining raw logs in Snowflake for hunting and investigations.
- **Knows the systems attackers target from the inside.** Years of administering Okta, Google Workspace, Microsoft 365 and dozens of SaaS apps before moving into security, which shapes his identity and SaaS hardening work.
- **Least privilege in practice.** Led IAM across AWS, GCP, Azure and Snowflake, replaced standing admin access with auditable just-in-time roles, and managed Cloudflare and cloud IAM as code with Terraform.
- **Real incident experience.** Led threat hunts and investigations into third-party compromise and data exfiltration, responded to a widespread npm supply chain attack and to leaked-credential incidents, and ran tabletop exercises for account takeover, ransomware and insider threats.
- **Audit-ready.** Supported SOC 2 and ISO 27001 audits and helped write his company's AI usage policy.
- **An automator from the start.** Picked up Python early in his IT career to automate repetitive work, and the same skill later powered his custom connectors, data pipelines and Panther detections.

## Career story

Phillip's first real IT job was deploying Windows 10 devices with SCCM across Sutter Health hospital sites in the Bay Area during an organization-wide OS refresh. He moved on to helpdesk at Adobe, then IT and sysadmin work at April Health, a specialty pharmacy, where he deployed HIPAA-required controls including backups and LAPS. At Wisk, an autonomous air taxi company, he ran systems and SaaS administration and started automating with Python. In 2022 he joined Sigma Computing, a Series C startup, and grew from IT engineer into security engineer, building detections, cloud security controls and security automation along the way.

## Experience

- Sigma Computing — Security Engineer (2024–2026); IT Engineer (2022–2024)
- Wisk — IT Specialist (2021–2022)
- April Health — IT Support Engineer (2020–2021)
- Adobe — ITCS Technician / Infrastructure Analyst (2019–2020)
- Sutter Health — Desktop Support Technician, contract (2018–2019)

## Skills and tools

- Detection and response: Panther, Anvilogic (Splunk), Python and SQL detections, MITRE ATT&CK, threat hunting, incident response, threat modeling, incident.io, PagerDuty
- Cloud and infrastructure: AWS, GCP, Azure, Snowflake, Terraform, Kubernetes, Docker, Cloudflare, Wiz, Lacework, Intruder
- Identity and access: Okta, ConductorOne, Twingate, 1Password, just-in-time access, least privilege
- Data and endpoint protection: CrowdStrike, Netskope, Armorblox, Abnormal Security, Jamf, Kandji
- Automation and AI: Python, n8n, Zapier, MCP, OpenAI, Anthropic, AI agents
- Data and collaboration: dbt, Google Workspace, Atlassian
- Compliance: SOC 2, ISO 27001

## Links

- [Resume](https://phillipdwhite.com/resume/): full work history and skills
- [Resume (PDF)](https://phillipdwhite.com/phillip-white-resume.pdf)
- [About this site](https://phillipdwhite.com/about-this-site/): how this site is built, deployed and hardened
- [LinkedIn](https://www.linkedin.com/in/phillipdwhite/)
- [GitHub](https://github.com/phillipwhite99)