Design organization-scale monitoring, capture the right telemetry, and diagnose gaps between signals, findings, alerts, and responders.
Design monitoring and alerting for AWS accounts and organizations, including ownership, aggregation, prioritization, and response routing.
Select, protect, centralize, normalize, and retain security-relevant logs for detection, investigation, and assurance.
Trace missing or noisy signals across configuration, permissions, delivery, aggregation, suppression, and notification layers.
Detection starts with the decision a responder must make, then works backward to the evidence, delivery path, permissions, retention, and owner. A service enabled without a response path is configuration, not a detection capability.
For every signal, trace: activity → source record → protected destination → normalization or finding → prioritization → routed notification → accountable responder → validation. At organization scale, include delegated administration, cross-account resource policies, KMS permissions, Regions, retry paths, dead-letter handling, and tamper resistance.
Collecting everything without retention or query ownership creates cost, not assurance. A central log bucket does not help if a key policy blocks delivery. A Security Hub finding does not prove the underlying signal is complete. A notification success does not prove a human or automation owns the response.
Given one suspicious API call, explain where its authoritative record originates, how it crosses account boundaries, what can block delivery, who receives the resulting alert, and how you would test the entire route without generating harmful activity.
