// detection engineering & AI security tooling
Ship detections like software.
Fixed-scope, project-based engagements with concrete deliverables. No slide decks. Working code you own.
@ FBI · CrowdStrike · Expel.
BACKGROUND
~/ services
Detection Rule Library
30–50 rules grounded in real-world experience, with MITRE ATT&CK mapping and tuning guidance.
from $8Kci/cdDetection-as-Code Pipeline
Version control, automated validation on every PR, and deployment to your SIEM/EDR via API.
from $15KaiAI-Powered SOC Tooling
Triage assistants, RAG knowledge bases, and enrichment pipelines. Prototype first, then production.
from $5K~/ products
rag · aiRocky Raccoon
An AI security assistant I built end-to-end: RAG pipeline, vector search, chat interface, REST API, and MCP server. Used by detection engineers and threat hunters for process triage, detection writing, and threat hunting.
rockyraccoon.io →~/ git log --author=brian
Building Rocky Raccoon, an AI security assistant for detection engineers and threat hunters. Offering detection engineering consulting with fixed-scope, project-based engagements.
Built and grew EchoTrail Insights into a widely-used Windows process behavior database for detection engineers worldwide.
Led the team building detection infrastructure for a 24/7 SOC, transforming raw telemetry from diverse security tools into actionable, high-fidelity detections. Joined during Series C, contributed through Series D.
Joined as employee ~70 before the Falcon platform launched. Built CrowdStrike's first behavioral detection engine. Co-founded and led what became the Overwatch threat hunting team. Built streaming analytics processing millions of events per second.
Investigated nation-state cyber intrusions. Selected for the FBI Cyber Action Team (CAT) responding to the most complex cyber incidents in the country. Built automated analysis tools for large-scale network forensics.
Led real-time embedded software development in C++ for Navy satellite communications. Designed encryption subsystems for classified SATCOM.
Let's talk about your detection program.
Book a 30-minute intro call to walk through your environment and where you need coverage, or send a message. Fixed scope, fixed price, working code you own.
brian@echotrail:~$ ./book-intro-call