Andrew Hannaford
Building detection infrastructure that actually scales — version-controlled rules, automated tests, peer review, CI/CD pipelines, and the adversarial thinking that makes alerts catch real attackers, not just pass audits.
Numbers that matter
daily across SIEM pipeline
slashed via 200+ automations
in Q1 at Brex
completed on schedule
Early in my career I learned the hard way: security automation that isn't engineered breaks under pressure. Rules without tests drift. Playbooks without version control diverge. Pipelines without observability fail silently.
So I took the practices that make application engineering reliable — version-controlled rules, automated regression tests, peer review, CI/CD deployment — and applied them to detection. The result is a detection program that gets better over time instead of just bigger.
I've done this at scale at Brex, built tooling for it at Rockstar Games, and learned the adversarial half by competing in CTFs — because the best detection comes from genuinely understanding how attackers think.
Detection as Code
Rules in version control, tested in CI, deployed through automation — not manually edited in a UI.
Adversarial Thinking
Build detections by reasoning like an attacker. CTF competition keeps that muscle sharp.
Enrichment First
An alert without context is noise. Context at detection time means analysts spend time hunting, not pivoting.
Measure Everything
False-positive rate, mean time to detect, coverage gaps — detection health is only improvable when it's measurable.
Career Timeline
Featured Projects
Substation OSS
I designed the core transformation pipeline — the composable functions detection engineers use to filter, enrich, and route events. Substation is a cloud-native toolkit for building event-driven security data pipelines: ingest raw telemetry, normalize it, enrich with threat intel, and route to your SIEM or data lake — all in version-controlled, testable configuration.
The goal was to treat security data pipelines the same way engineers treat application pipelines: observable, tested, deployed through CI/CD, and composable by anyone on the team without bespoke scripting.
XSOAR → XSIAM Migration
Led a 10-week platform migration from Palo Alto XSOAR to Cortex XSIAM across 4 business units with zero production downtime. Migrated all 200+ automation playbooks and integrations, added observability, and established CI/CD deployment patterns for ongoing development. Presented outcomes to security leadership.
Alert Enrichment & SOAR Automation
Engineered 60+ automation playbooks in Python for NBCUniversal's SOAR platform, cutting manual triage effort by 70% and enabling the SOC to absorb 30% more alert volume. Integrated 15+ threat intelligence feeds via ThreatConnect, cutting intel processing time by 55%.
Headless Hunter Platform
Designed and shipped a threat hunting platform at Raytheon (Python, MongoDB, Elastic Stack) processing 50K+ threat signals per week across 3 federal programs for DHS and CISA clients.
Technical Toolkit
Detection Engineering
Languages & Scripting
Platforms & Tools
Cloud & Infrastructure
Credentials
GSEC — Security Essentials
Foundational security concepts, network protocols, cryptography, and incident handling.
GIACGCIH — Incident Handler
Incident response techniques, malware analysis, and network traffic investigation.
GIACGCIA — Intrusion Analyst
Network traffic analysis, intrusion detection, and packet-level forensics.
GIACGDSA — Defensible Security Architecture
Designing and building layered, defensible enterprise security architectures.
GIACGWEB — Web Application Defender
Web application security, common attack patterns, and defensive coding practices.
GIACGCSA — Cloud Security Automation
Automating cloud security controls, DevSecOps pipelines, and cloud-native threat detection.
GIACGCPN — Cloud Penetration Tester
Offensive security techniques targeting cloud environments and infrastructure.
GIACGCPM — Certified Project Manager
Security program planning, delivery management, and stakeholder communication.
GIACGSTRT — Strategic Planning, Policy & Leadership
Security strategy, policy development, and organizational leadership for security programs.
GIACSSAP — Security Awareness Professional
Building and managing security awareness programs across organizations.
GIACGIAC Advisory Board
Review and refine GIAC certification exams, contribute to curriculum development, and advise on security education standards with SANS faculty.
AdvisoryITIL 4
IT service management framework covering service delivery, operations, and continual improvement.
ITILCSM — Certified ScrumMaster
Agile delivery methodology, sprint facilitation, and cross-functional team coordination.
Scrum AllianceCompetitive Hacking
Competitive CTF sharpens the adversarial thinking that makes detection rules actually catch attackers — not just pass audits. Understanding how exploits chain, how attackers move laterally, and what traces they leave is what separates a detection that fires on real TTPs from one that fires on a textbook example.
Academic Background
M.S. Information Security Engineering — Cloud Security
SANS Technology Institute, Bethesda, MD
B.A. Computer Science
North Dakota State University, Fargo, ND
Let's Talk
Open to conversations about detection engineering leadership, security tooling, and hard problems in scale-out security operations.