Bryan H

Triage Security Engineer 2

Arctic Wolf • Full time

Jun 2023 - Present • 2 yrs 11 mos

I work in a 24x7 security operations environment performing advanced alert triage and incident analysis across identity, endpoint, network, and log telemetry. My role focuses on investigating suspicious activity, correlating evidence across multiple data sources, identifying likely attacker behavior, and supporting effective escalation and resolution. I regularly work through ambiguous security events where context, investigative structure, and sound judgment matter more than simply following a checklist. This includes evaluating authentication activity, endpoint behavior, suspicious process execution, and broader patterns that may indicate malicious activity, misconfiguration, user error, or benign operational noise. In addition to day-to-day investigations, I contribute to improving analytical consistency by refining workflows, strengthening investigative approaches, and helping raise team capability through mentoring and technical knowledge sharing. I have also delivered technical presentations and internal learning sessions focused on improving analyst understanding, investigative reasoning, and operational effectiveness. This experience directly supports the work I offer here: helping aspiring, new, and developing SOC analysts build the practical thinking skills needed to succeed in the role. That includes alert triage, investigation flow, escalation judgment, interview preparation, and career growth within security operations.