Open to remote security engineering, detection and SOC roles
Ryan Williams
Detection Engineering & Cloud Security
I build detections that analysts can trust and keep cloud environments audit-ready. Six-plus years in SOC operations across AWS and Azure, most recently as the primary detection engineer and continuous monitoring lead for a FedRAMP High cloud SOC. US citizen, eligible for Public Trust and security clearance.
- 87%
- reduction in SOC triage volume, from 3,000 to under 400 hours a month, through detection tuning
- 100+
- MITRE ATT&CK-aligned detections built across Splunk, Microsoft Sentinel and Defender, and Elastic
- 8
- customer AWS and Azure environments standardized under one detection strategy
- Under 4 hours
- to prepare FedRAMP audit evidence, down from 3+ days, after automating artifact collection
Projects
Detections
27 detections for Splunk, Microsoft Sentinel and Elastic, one file per detection: what it looks for and why, the query for each platform, expected false positives, blind spots, how to trigger it safely in a lab, and what to do when it fires.
- Windows and Active Directory (18): ransomware and recovery tampering, credential dumping (LSASS, DCSync, hive copies), lateral movement, persistence through Run keys and WMI, password spraying and brute force, event log clearing
- AWS (8): disabled logging, root use, missing MFA, credentials and admin policies granted, resources opened to the internet, KMS key deletion, snapshots shared outside the account
- Linux (1): shells spawned by web servers
unopened
A static malware triage command-line tool for SOC analysts. It examines a suspicious file and never executes it.
- Covers PE files, Office macros, LNK, scripts, HTML smuggling, PDF, archives and phishing email (SPF, DKIM, DMARC and look-alike domains)
- Produces rule-based verdicts, defanged IOCs, and hunt queries for Splunk, Sentinel and Elastic
- Validated in an isolated VM on MalwareBazaar holdout sets and 347 benign files, with 0 malicious false positives
- I designed the scope, safety rules and validation; the code was written with Claude Code
Writing
-
It converted, it never fired: three Sigma-to-Elastic bugs found by testing on a real engine
Regex rules that silently match nothing, Windows paths that break ES|QL LIKE, and a fix too complex to run. How testing converted queries against real events found them, and the fixes now merged into SigmaHQ.
-
Cutting SOC triage from 3,000 hours a month to under 400
Measuring analyst time instead of alert count, asking one question of every noisy rule, and keeping ATT&CK coverage intact while cutting 87% of triage hours.
-
Every 17 minutes: finding the foothold a ransomware investigation missed
An REvil incident where the outside responders confirmed ransomware but not the way in. A beacon on a fixed interval led to the scheduled tasks and the stale domain admin account behind it.
-
When a log source goes quiet: baselining ingestion per source
Why a 'no logs received' alert breeds complacency, and an hourly Splunk check that compares each source with its own same-weekday and 14-day baseline, for low and high volume.
-
FedRAMP 2026 vulnerability deadlines, worked through an example scan
Severity-based deadlines are gone. How the new exploitability, reachability and impact evaluation changes what is due when, and how to turn a scan export into a first pass at the answers.
-
Five Entra ID detections to deploy first
Privileged role assignments, MFA methods registered from unfamiliar addresses, risky app consent, Conditional Access changes and credentials added to applications. Sentinel and Splunk queries with tuning notes.
-
Five CloudTrail detections to deploy first
Logging tampering, root use, console logins without MFA, credentials created for someone else, and resources opened to the internet. Splunk queries with tuning notes, plus Sentinel for the logging alert.
-
Catching shadow copy deletion before the encryption starts
One detection for vssadmin, wmic, wbadmin, bcdedit and PowerShell recovery tampering (T1490), written for Splunk, Sentinel and Elastic.
-
Detecting ransomware encryption by behavior, not file extension
Why extension watchlists fail, and three detections that hold up: mass renames that collapse many file types into one, the same note dropped in every folder, and a canary file.
-
AD account deletion: turning event 4726 into a useful alert
Alerting on every deletion is noise. Three variants that carry signal: deletions by an unexpected admin, bulk deletion, and accounts created and deleted within a day.
-
FedRAMP's 2026 rules: what changes for continuous monitoring
POA&Ms are gone, ConMon is now Ongoing Certification, and impact levels became classes. A summary of the Consolidated Rules for 2026 and the dates that matter.
-
One-liners for triage
Short Python, Bash and PowerShell snippets for hashing, pulling URLs, checking listeners, startup items and AD password expiry.
-
What makes a SOC analyst stand out
Six habits that separate analysts who close alerts from analysts who improve the SOC.