• Org-Wide Strategy: Aligned product strategy for Entity Analytics and Graph Exploration across a ~200-engineer Google SecOps org, unifying siloed detection and analytics pipelines into a single platform to power autonomous agentic SOC workflows.
• Composite Detection (0-to-1): Incubated and shipped Composite Detection, pairing multi-stage rules with LLM triage to achieve a 98% true positive rate and 100x alert volume reduction for enterprise SOCs.
• BigQuery Graph: Championed cross-org adoption of BigQuery Graph for the next-gen SecOps entity graph, unlocking multi-hop investigation and response.
• Risk Analytics Pipeline (L6): Partnered with engineering to re-architect the risk analytics pipeline, cutting detection latency from hours to minutes and reducing compute/RAM by 95%.
• Security Command Center (L5): Built 0-to-1 threat detection across cloud control plane, Kubernetes runtime, and hypervisor introspection (co-invented 3 granted patents).

Co-founded with Anton Chuvakin (youtube.com/@cloudsecpodcast), releasing 280+ weekly episodes (every Monday, piping hot). We cover Cloud, D&R, and Agentic AI with guests including Kevin Mandia, Bruce Schneier, Fortune 500 CISOs, public company CEOs, and a former Undersecretary of State.

• Owned onboarding, identity verification, and account lifecycle for Connect Accounts—powering 90% of Stripe’s merchant population across platforms including Shopify and Lyft.
• Led engineering and executive response to a critical financial partner audit, negotiating remediation directly with auditors, Visa’s President, and CRO with zero merchant disruption.

• Owned customer console and telemetry platform for Shape’s bot-mitigation system across Fortune 500 banking, airline, and retail customers.
• Partnered with engineering to launch a new telemetry ingestion, storage, and visualization stack—cutting monthly AWS storage costs by 90% and page load times by 80%.