Andrew Hannaford
Building detection infrastructure that actually scales — and securing the AI layer on top of it. Version-controlled rules, automated SOC workflows, agentic security controls, and the adversarial thinking that makes alerts catch real attackers, not just pass audits.
Numbers that matter
daily across SIEM pipeline
slashed via 200+ automations
in Q1 at Brex
completed on schedule
Early in my career I learned the hard way: security automation that isn't engineered breaks under pressure. Rules without tests drift. Playbooks without version control diverge. Pipelines without observability fail silently.
So I took the practices that make application engineering reliable — version-controlled rules, automated regression tests, peer review, CI/CD deployment — and applied them to detection. The result is a detection program that gets better over time instead of just bigger.
Now that same rigor applies to AI. Agentic workflows, MCP traffic, LLM tool use on corporate endpoints — these are new attack surfaces, and they need the same visibility, controls, and enforcement posture that we'd apply to any other part of the stack. I'm building that at Brex.
Detection as Code
Rules in version control, tested in CI, deployed through automation — not manually edited in a UI.
AI Security by Design
Agentic workflows and LLM tooling need DLP, visibility, and policy enforcement from day one — not bolted on after a breach.
Adversarial Thinking
Build detections by reasoning like an attacker. CTF competition keeps that muscle sharp.
Automate the SOC
Analysts shouldn't triage what a machine can. Runbooks, batch workflows, and LLM-assisted investigation free humans for the hard problems.
Career Timeline
Featured Projects
Automated SOC Workflow
Built a fully automated SOC workflow using Claude-powered plugins integrated with Sumo Logic SIEM and additional data sources. Analysts can triage, investigate, and close tickets end-to-end with minimal manual intervention — the system pulls context, runs the relevant runbook, and surfaces a recommended action.
Developed the runbook library and batch case-working framework that now serves as the standard response operating procedure — consistent, auditable, and scalable across the entire incident backlog.
AI Security Infrastructure
Modernized enterprise AI security controls for agentic workflows (including OpenClaw), integrating Onyx, Surepath, Island, and Wiz to enforce DLP, browser isolation, and cloud security posture. Extended visibility to MCP (Model Context Protocol) traffic and AI tool usage on corporate endpoints — inspection, logging, and policy enforcement at the host layer.
XSOAR → XSIAM Migration
Led a 10-week platform migration from Palo Alto XSOAR to Cortex XSIAM across 4 business units with zero production downtime. Migrated all 200+ automation playbooks and integrations, added observability, and established CI/CD deployment patterns for ongoing development. Presented outcomes to security leadership.
Alert Enrichment & SOAR Automation
Engineered 60+ automation playbooks in Python for NBCUniversal's SOAR platform, cutting manual triage effort by 70% and enabling the SOC to absorb 30% more alert volume. Integrated 15+ threat intelligence feeds via ThreatConnect, cutting intel processing time by 55%.
Technical Toolkit
AI Security
Detection Engineering
Languages & Scripting
Platforms & Tools
Cloud & Infrastructure
Credentials
GSEC — Security Essentials
Foundational security concepts, network protocols, cryptography, and incident handling.
GIACGCIH — Incident Handler
Incident response techniques, malware analysis, and network traffic investigation.
GIACGCIA — Intrusion Analyst
Network traffic analysis, intrusion detection, and packet-level forensics.
GIACGDSA — Defensible Security Architecture
Designing and building layered, defensible enterprise security architectures.
GIACGWEB — Web Application Defender
Web application security, common attack patterns, and defensive coding practices.
GIACGCSA — Cloud Security Automation
Automating cloud security controls, DevSecOps pipelines, and cloud-native threat detection.
GIACGCPN — Cloud Penetration Tester
Offensive security techniques targeting cloud environments and infrastructure.
GIACGCPM — Certified Project Manager
Security program planning, delivery management, and stakeholder communication.
GIACGSTRT — Strategic Planning, Policy & Leadership
Security strategy, policy development, and organizational leadership for security programs.
GIACSSAP — Security Awareness Professional
Building and managing security awareness programs across organizations.
GIACGIAC Advisory Board
Review and refine GIAC certification exams, contribute to curriculum development, and advise on security education standards with SANS faculty.
AdvisoryITIL 4
IT service management framework covering service delivery, operations, and continual improvement.
ITILCSM — Certified ScrumMaster
Agile delivery methodology, sprint facilitation, and cross-functional team coordination.
Scrum AllianceCompetitive Hacking
Competitive CTF sharpens the adversarial thinking that makes detection rules actually catch attackers — not just pass audits. Understanding how exploits chain, how attackers move laterally, and what traces they leave is what separates a detection that fires on real TTPs from one that fires on a textbook example.
Academic Background
M.S. Information Security Engineering — Cloud Security
SANS Technology Institute, Bethesda, MD
B.A. Computer Science
North Dakota State University, Fargo, ND
Let's Talk
Open to conversations about detection engineering leadership, security tooling, and hard problems in scale-out security operations.