Category: Blue Team & SOC
Detection engineering, incident response and security automation.
-
Nobody hires you for the tools. They hire you for the architecture
Listing SIEM, EDR and SOAR on a CV is easy. Explaining how they fit together is what gets the offer.
-
Your ATT&CK heat map is probably lying to you
Coverage claimed from vendor datasheets is not coverage. Emulation is the only honest measurement.
-
Automate the alert you have already triaged four hundred times
SOC burnout is rarely caused by hard problems. It is caused by easy problems arriving relentlessly.