Devo SIEM Reference Architecture, Taxonomy & Detection Validation One-Pager

Devo

Security Research Engineer - Architecture Innovation

Context

Led and contributed to Devo architecture innovation work focused on SIEM reference architectures, detection taxonomy, Exchange-content validation, enterprise and MSSP deployment analysis, cloud-native detection strategy, migration guidance, and SOC maturity research. The work connected real-world customer deployments to reusable architecture patterns, detection-engineering guidance, and public research accepted at major security conferences.

Problem

Enterprise and MSSP SIEM environments often grow organically into inconsistent pipelines, brittle detection content, fragmented taxonomies, unclear onboarding patterns, weak normalization, noisy analytics, and migration debt from legacy SIEMs. Devo needed stronger architecture guidance and validation patterns that could turn deployment reality into repeatable reference models, customer guidance, and trusted detection content.

What I did

• - Analyzed hundreds of enterprise and MSSP SIEM deployments to identify maturity patterns, architecture gaps, onboarding challenges, and detection-engineering practices.
• - Redesigned or contributed to SIEM reference architectures that clarified how customers should structure ingestion, parsing, normalization, detection content, enrichment, triage, and reporting.
• - Standardized detection taxonomy so analytics, detections, Exchange content, and customer workflows could be organized and compared more consistently.
• - Validated Devo Exchange detections against practical customer and SOC requirements, looking for usability, alignment, coverage, and operational value.
• - Mapped cloud-native detection needs across infrastructure, SaaS workspace, identity, and provider-specific telemetry sources.
• - Connected architecture guidance to migration patterns from legacy SIEM environments into Devo.
• - Used security research, deployment analysis, and customer-pattern mining to identify what mature SIEM programs actually did differently.
• - Supported creation of reusable narratives for customer-facing architecture guidance, analyst education, and conference research.
• - Connected taxonomy and detection validation to broader security analytics concerns such as ATT&CK alignment, cloud coverage, triage quality, signal-to-noise, and SOC workflow fit.
• - Translated architecture and deployment findings into public thought leadership, including conference research and cloud-native security presentations.
• - Built a bridge between hands-on SOC architecture, product strategy, customer enablement, and research-backed market education.

Outcome

• - Improved the clarity and repeatability of Devo SIEM reference architecture guidance.
• - Strengthened detection taxonomy and validation practices for Devo Exchange and related detection content.
• - Converted hundreds of enterprise and MSSP deployment observations into maturity patterns and research narratives.
• - Helped customers and internal teams reason more clearly about SIEM onboarding, normalization, detection coverage, cloud telemetry, and SOC workflow maturity.
• - Supported public security research accepted at RSA, Infosecurity Europe, Cloud Native Security Conference, and other industry venues.
• - Created a strong portfolio story around cloud-native SIEM architecture, detection engineering, security analytics, customer deployment research, and conference-grade security storytelling.
• - Established a direct through-line to later AI-augmented detection engineering, agentic SOC workflows, and evidence-driven AI security control planes.

Evidence

• - Analyzed hundreds of enterprise and MSSP SIEM deployments according to uploaded resume/Profile source material.
• - Resume source references analysis of 300 enterprise and MSSP SIEM deployments to identify maturity patterns and turn findings into research accepted at RSA and industry conferences.
• - Profile source references analysis of hundreds of customer deployments and research accepted at RSA, Infosecurity Europe, and Cloud Native Security Conference.
• - Contributed to SIEM reference architecture redesign, detection taxonomy standardization, and Devo Exchange detection validation according to uploaded source material.
• - Connected architecture research to public conference work, including CloudNativeSecurityCon 2023 research on 2,000 enterprise cloud detections.
• - Public-safe metric language; exact customers, deployment names, internal dashboards, proprietary taxonomy logic, private Exchange validation details, and customer-specific findings are omitted.