Michael Williams
Security Operations: Engineering · Detection · Threat Hunting · Investigation & Incident Response · Vulnerability Management · AI Risk & Security
Security operations is the constant. Five years of it: investigations and incident response, threat hunting, detection engineering, and customer-facing security work across multi-tenant environments. Today I engineer security for a healthcare environment, where the work spans vulnerability management, identity and access, escalated investigations, and AI and software risk assessment. Most of it runs across team lines, so driving remediation with infrastructure, application, and clinical system owners is as much the job as the engineering is.
At every stop I have walked into ambiguity, found the operational pain point, and built something to fix it. That instinct is what moved me from security operations into AI security: same discipline, new attack surface. ThreatPrism is one example: a guardrail-first SOC investigation pipeline that contributed to a 48% MTTR reduction across 60+ enterprise clients while keeping production implementation details proprietary. To see how the route runs from first responder to AI security, follow My Path.
Featured Work
SOC systems, AI security research, and guardrail-first tooling
ThreatPrism
Guardrail-first SOC investigation pipeline. Automates IOC extraction, MITRE ATT&CK mapping, severity scoring, and analyst context generation before a human touches the alert. Contributed to a 48% MTTR reduction across 60+ enterprise clients via Swimlane SOAR.
AI DevSecOps Platform
AI security engineering project for detecting unsafe patterns in AI-generated code. Combines deterministic controls, semantic taint tracking, ShellGuard, LLM reasoning with Pydantic constraints, and provenance concepts. Tested with 41 adversarial and 16 logic-bomb cases.
SecureCLI-Tuner
Security-first LLM fine-tuned for agentic DevOps. Translates natural language into safe Bash commands. QLoRA fine-tuning plus a three-layer runtime guardrail architecture.