Devo Security Research & Conference Program One-Pager

Devo

Security Research Engineer - Architecture Innovation

Context

Developed and contributed to Devo security research that converted customer deployment analysis, SIEM maturity patterns, detection taxonomy work, cloud-native security findings, and architecture innovation into conference-grade research accepted at major industry venues including RSA, Infosecurity Europe, and CloudNativeSecurityCon.

Problem

Security research inside a SIEM company must do more than produce thought leadership. It has to reflect what real SOCs are doing, where deployments fail, how detection content matures, how cloud telemetry changes operations, and what customers need to understand. Without deployment-grounded research, conference content becomes generic market commentary rather than useful security guidance.

What I did

• - Analyzed hundreds of enterprise and MSSP SIEM deployments to identify recurring architecture, taxonomy, detection, onboarding, and maturity patterns.
• - Converted deployment observations into research themes that could support conference submissions and public security narratives.
• - Connected Devo architecture innovation work to broader SOC modernization questions around ingestion, normalization, detection content, cloud telemetry, and analyst workflow.
• - Standardized language around SIEM maturity so customer reality could be compared across deployments without exposing customer-specific details.
• - Used detection taxonomy and Exchange validation work to identify where detection content was usable, confusing, duplicative, weakly mapped, or operationally hard to adopt.
• - Developed research narratives around cloud-native detections, cloud controls, attacker motives, SOC maturity, and evolving detection-engineering requirements.
• - Translated technical findings into conference-ready talks, abstracts, speaker narratives, and public thought leadership.
• - Balanced product relevance with research credibility by grounding claims in deployment patterns rather than unsupported marketing language.
• - Worked across security research, architecture, product, customer-facing, and conference contexts to align findings with practical value.
• - Built reusable research concepts that connected SIEM architecture, cloud security, detection engineering, and AI-augmented threat response.
• - Used public-facing research to strengthen Devo's credibility while also creating useful guidance for SOC teams and security leaders.

Outcome

• - Produced and supported research accepted at major industry venues including RSA, Infosecurity Europe, and CloudNativeSecurityCon.
• - Converted customer deployment patterns into public security research without exposing customer-specific details.
• - Strengthened Devo's public positioning around cloud-native SIEM, detection engineering, SOC maturity, and architecture innovation.
• - Created a repeatable bridge between product architecture work and market-facing security research.
• - Built public credibility for the user as a security researcher and conference speaker in cloud-native SIEM and detection engineering.
• - Established a research-to-product loop where deployment analysis informed architecture guidance, taxonomy improvements, detection validation, and public education.
• - Created a portfolio story showing the user's ability to turn operational security data into conference-grade research and executive-readable narratives.

Evidence

• - Uploaded resume source describes analysis of 300 enterprise and MSSP SIEM deployments and research accepted at RSA and industry conferences.
• - Uploaded LinkedIn/Profile source describes analysis of hundreds of customer deployments and research accepted at RSA, Infosecurity Europe, and Cloud Native Security Conference.
• - Public CloudNativeSecurityCon listings identify related Devo research by David Wolf and Joshua Smith analyzing 2,000 enterprise cloud detections.
• - Research themes included SIEM reference architecture, detection taxonomy, Devo Exchange validation, cloud-native detections, SOC maturity, and cloud security operations.
• - Public-safe metric language; exact customer deployments, private datasets, internal dashboards, proprietary taxonomy logic, conference submission drafts, and non-public research artifacts are omitted.