Use-case selection
Identify workflows with enough repetition and friction to justify AI intervention.
Applied AI
Use AI where it improves the operation, not where it creates theatre.
I help security teams evaluate and adopt AI against real SOC workflows, operational controls and measurable outcomes.
What I focus on
Operational value with controls intact.
AI can reduce friction in security operations, but it can also introduce new ambiguity, hidden assumptions and review burden. The useful question is not whether a product has AI. It is whether a specific workflow becomes better and whether that improvement survives real operational conditions.
Evaluation
Test output quality, consistency, failure modes and analyst review requirements.
Procurement
Challenge vendor claims against operational requirements, integration needs and controls.
Workflow design
Define where AI assists, where a human decides and where evidence must remain visible.
Adoption
Integrate capability into existing processes rather than creating a parallel AI workflow.
Measurement
Track time saved, quality, rework, consistency and downstream operational impact.
Experience
Grounded in security operations.
I have been directly involved in procurement and deployment of AI-enabled SOC technology, alongside practical experimentation with local and edge AI using NVIDIA Jetson hardware.
That combination matters because AI adoption in a SOC is not simply a model-selection exercise. It touches data access, analyst trust, quality assurance, escalation, auditability and service ownership.
A practical evaluation loop
- Choose a high-friction analyst task with a clear baseline.
- Define acceptable quality, control and evidence requirements.
- Test AI output against representative operational cases.
- Integrate the capability into the existing workflow.
- Measure time saved, rework and decision quality.
- Expand only when the outcome is consistently better.
Related
AI works best in context.
Security Operations
The operating-model and service context around AI adoption.
Explore security operations →Microsoft Security
Sentinel, Defender, KQL, detections and automation.
Explore Microsoft Security →About Jamie
Background across security operations, solution design and leadership.
View background →Contract enquiries
Evaluating AI for a SOC or MXDR service?
I can help turn the question from “which AI product?” into a controlled evaluation of real operational value.