Sigma Computing
San Francisco, CASecurity EngineerSep 2024 – Jul 2026
IT EngineerJan 2022 – Sep 2024
Detection and Response
- Built and maintained Panther SIEM using detections as code, writing 40+ custom Python and SQL detections, each mapped to MITRE ATT&CK, validated with unit tests against sample log data and tuned to cut false positives.
- Built an agentic threat intel pipeline in n8n that ingests RSS intel feeds, assesses each report's relevance to our environment, extracts IOCs and IOAs, and runs automated threat hunts through the Panther MCP server, posting results to Slack and paging on-call when findings warranted investigation.
- Onboarded 20+ critical and high-priority log sources, including AWS, GCP, Azure, Okta, 1Password and CrowdStrike.
- Designed a cost-conscious security data lake that filters logs before SIEM ingest, keeping multiple terabytes per month out of the SIEM while retaining raw logs in a team-owned Snowflake database for hunting and investigations.
- Led threat hunts and investigations, including scoping data exposure from a compromised third-party SaaS integration (partnering with compliance on customer notification), detecting unauthorized transfers of company data to personal infrastructure, and investigating offboarded employees for data exfiltration.
- Responded to a widespread npm supply chain attack as part of a company-wide incident response, supporting containment and remediation.
- Responded to multiple leaked-credential incidents, coordinating secret rotation and cleanup with engineering teams.
- Reverse engineered suspicious Chrome extensions based on CrowdStrike and other threat intelligence, and identified risky AI tool usage through browser extensions.
- Led threat modeling of critical systems, designed incident response processes and ran tabletop exercises covering account takeover, ransomware and insider threats, plus internal phishing awareness campaigns.
- Served as primary and secondary on a monthly security on-call rotation.
Cloud and Identity Security
- Led IAM across GCP, Azure, AWS and Snowflake, implementing RBAC and least privilege access.
- Cleaned up Snowflake admin access by creating auditable just-in-time roles with manager and stakeholder approval flows for non-standard privileged access; used ConductorOne to extend just-in-time access to other critical resources.
- Built a RAG agent that inventories cloud IAM resources and maps them to ConductorOne entitlements, letting engineers ask which roles or permissions they need for a given task.
- Managed infrastructure as code with Terraform/Atlantis, including Cloudflare DNS, WAF and rate limiting rules, and Azure, AWS and GCP IAM, firewall rules and other infrastructure.
- Hardened Okta and GitHub, and reviewed the policies and posture of critical apps to close data exfiltration and attack paths.
- Deployed Twingate ZTNA to secure access to clusters and Snowflake instances.
- Owned vulnerability and cloud security posture management in Wiz (and previously Lacework), using it to track and prioritize infrastructure, container and misconfiguration findings across AWS, GCP and Azure.
- Worked cross-functionally with engineering teams to drive remediation of prioritized findings, and resolved IAM and access findings directly or with my team.
- Built agent workflows to triage critical and high vulnerability findings, prioritizing by the infrastructure and libraries/packages involved.
Data Protection, Governance and Compliance
- Ran DLP and insider-risk monitoring with Netskope, and administered CrowdStrike and Kandji (Iru) endpoint security.
- Expanded SaaS data security coverage with Reco and Wiz to find sensitive data exposure and enforce access controls across cloud and SaaS apps.
- Led email security rollouts of Armorblox and Obsidian.
- Worked with compliance to develop LLM tool guidelines, approved settings, data controls and AI usage policy.
- Supported SOC 2 and ISO 27001 audits with evidence collection, quarterly access reviews and meetings with compliance vendors and certifiers; performed data collection and discovery for legal and executive leadership.
- Secured credentials and secrets in 1Password, establishing secure sharing and rotation policies.
IT Engineering and Automation
- Built a Python integration to automate Okta user lifecycle management from our HRIS (ADP Workforce Now) where no native connector existed.
- Architected data pipelines to populate our data lake with actionable information for analysis in the Sigma platform.
- Coordinated the entire IT build-out for new offices, including ISPs, networking contractors and vendors, conference rooms and all-hands spaces, and physical security planning.