Sean Cullen

Acting as lead architect/engineer for a full greenfield enterprise security stack — SIEM, SOAR, EDR, and internal MSSP-style multi-tenant operations. Official title Security Analyst II; ownership and scope are at the architecture-lead level.

• Architecting a multi-tenant Microsoft Sentinel SIEM (delegated workspace model) with tenant isolation, cross-tenant detection federation, and RBAC governance — centralizing operations across independently governed business units.
• Engineering Detection-as-Code pipelines (IaC/GitOps) to version, test, and promote analytic rules, hunt queries, and watchlists across tenants — cutting content-promotion cycle time from days to minutes.
• Designing multi-tenant log ingestion (DCR normalization, per-tenant enrichment, ingestion-tier cost controls) standardizing onboarding and optimizing platform spend.
• Building an internal MSSP-style operating model — standardized tenant onboarding, detection baselines, and SOAR playbooks delivered as repeatable, auditable units.

Engineered and scaled an enterprise SIEM/SOAR platform integrating 40+ log sources with normalization, enrichment, and Logic Apps automation, reducing MTTD/MTTR by 60% and SOC operating costs by 20%. Designed end-to-end security architecture for a multi-tenant cloud environment; serve as incident response lead, validating controls through adversary emulation and driving operational readiness across all acquired business units.

• Directed rapid EDR/MDR deployment — integrating 60+ security technologies and rolling out CrowdStrike Falcon and Microsoft Defender for Endpoint across 11,000 assets in under 100 days, establishing a hardened endpoint baseline in a greenfield environment.
• Architected secure-by-design controls (least-privilege IAM, compliance-aligned guardrails, resilient telemetry, AI/ML detection pipelines), reducing aggregate enterprise risk exposure by 90%.
• Directed end-to-end incident response across identity, network, endpoint, and business teams, reducing potential incident impact by $5M+ annually.
• Unified SOC operations across 15 acquired businesses by standardizing SIEM/SOAR platforms, detection content, and IR playbooks, delivering centralized visibility and consistent enterprise-wide threat coverage.
• Partner directly with the CISO and CIO on cybersecurity strategy, board-level reporting, and Zero Trust roadmap execution across all business units.
• Designed an incident response tabletop exercise (TTX), streamlining the hiring process and capability validation for Security Analysts.

Promoted from analyst into a full-time engineering role as the organization's first dedicated cybersecurity engineer. Managed SIEM and SOAR platforms, developing behavioral threat analytics, designing automated response workflows, and building threat-hunting dashboards. Partnered directly with the CISO to stand up the security organization from the ground up.

• Optimized detection and response by re-engineering SIEM pipelines and tuning analytic logic — cutting SIEM ingestion costs 40%, accelerating MTTR 2.5x, and cutting false-positive volume 3x.
• Engineered and scaled SOAR automation across 11,000 endpoints and 25,000 identities using KQL and conditional Azure Logic Apps workflows, driving 22,000+ automated incident resolutions and 12,000+ response actions.
• Built and maintained a MITRE ATT&CK-mapped detection content library — analytic rules, hunt queries, and watchlists — expanding technique coverage and accelerating proactive threat hunting.
• Authored a 92-page situational Incident Response Plan and accompanying automated playbooks, aligning orchestration with human decision points, regulatory obligations, and enterprise risk objectives.
• Strengthened identity security with JIT access via Azure PIM, risk-based Conditional Access through Entra ID Protection, and removal of local admin rights, reducing identity attack surface by 45%.
• Performed systemic threat modeling and attack-surface assessments across Active Directory, EASM inventories, internet-facing applications, and executive impersonation vectors, reducing exploitable risk by 60%.
• Mentored junior analysts and engineers, established SOC standard operating procedures, and represented security in change-advisory boards, vendor evaluations, and architecture reviews alongside CIO leadership.

Served as a frontline, advanced SOC analyst specializing in deep forensic investigations, threat hunting, and high-fidelity incident response across cloud, identity, and endpoint domains. Played a key role in maturing detection capabilities by reducing false positives, operationalizing threat intelligence, and establishing repeatable investigative standards.

• Performed advanced forensic analysis across endpoint (EDR), identity (Azure AD/Entra ID), and cloud telemetry to reconstruct attack timelines, identify root cause, and scope enterprise-wide impact.
• Executed hypothesis-driven threat hunting aligned to adversary TTPs (MITRE ATT&CK), uncovering previously undetected persistence mechanisms and lateral movement activity.
• Led hands-on incident response for high-severity events (phishing, credential compromise, malware, privilege escalation), coordinating containment, eradication, and recovery actions.
• Developed and standardized SOC SOPs and designed comprehensive investigative dashboards (Sentinel Workbooks).
• Integrated and operationalized external threat intelligence feeds into SIEM workflows, enriching detections and enabling proactive identification of emerging threats.
• Tuned SIEM detection logic and correlation rules to significantly reduce false positives while increasing detection fidelity and signal-to-noise ratio.
• Collaborated with engineering teams to translate investigative findings into durable detection improvements and automated response enhancements.

Leveraged a mechanical engineering background, technical writing, and Six Sigma methodology to optimize IT workflows while integrating hardware with existing infrastructure across 6+ Fortune 500 organizations. Provided on-site integration and process consulting, delivering reliable system implementations in enterprise environments.

• Seamless integration of commercial compute resources into enterprise technology infrastructure.
• On-site engineering and customer management.