Build detections and guardrails that catch account takeover, MFA fatigue attacks, and session token theft.
Endpoint & device lifecycle: write and ship device policy as code — configuration profiles, remediation scripts, enforcement rules across macOS and Windows.
Maintain and improve EDR stack's detection and response coverage across the fleet.
SaaS posture: reduce SaaS risk at scale through SSPM tooling and automation, including detection of risky OAuth grants, shadow IT, and configuration drift.
Own security configuration for SaaS tools (Google Workspace, Slack, and similar).