Technology Consulting · 2018 – 2019
Building an MDR and MSSP Capability from the Ground Up
Created a managed detection and response framework and an MSSP capability for a global technology consulting group, including SOC workflows, service catalogues, threat intelligence and incident response.
The Challenge
A global technology consulting group working across India and Europe wanted to offer managed security services to its customers. Building a credible managed detection and response business isn’t just a matter of buying tools. It needs a service that customers can rely on: defined workflows, clear service levels, threat intelligence, and an incident response process that works at 3 a.m.
What I Did
As cybersecurity tech lead, I built the capability from the ground up:
- The MDR framework: created the managed detection and response framework the service runs on.
- The MSSP capability: established SOC workflows, service catalogues, threat intelligence and incident response processes.
- Products for the market: designed and launched MDR and EDR managed service offerings for global customers, and aligned SOC workflows with client SLAs.
- A Cyber Defense Center: supported its build, covering governance, tool integration and operational planning.
- Strategy with executives: drove security strategy with executive leadership across the Nordic and APAC regions, and defined cybersecurity roadmaps and enterprise security architecture with C-level stakeholders in BFSI and critical infrastructure.
- Delivery at scale: managed cross-functional, multicultural teams across operations and engineering, and oversaw large rollouts from planning and budgeting through to post-implementation audit, including third-party vendors and tool integration.
I also delivered security gap assessments and architecture reviews for large clients, and advised on GDPR, ISO 27001 and PCI-DSS compliance.
Why It Matters
Building a security service from nothing means owning both sides of the problem: the operational detail of a SOC, and the commercial and executive conversations that make it viable. That’s the combination a CISO or board needs when they’re deciding whether to build, buy or outsource detection and response.