Security leadership
CISO, Deputy CISO and security program leadership. I bring organizational design, multi-year strategy, budget and vendor management, and quarterly reporting to the Board.
Cybersecurity Leader · Detection & Response · AI-Enabled Security Operations
Keith M. Soncrant
I build and scale intelligence-driven security organizations. For more than 20 years I've worked alongside executives across Fortune 500, federal and DoD environments, growing programs from three-person specialist teams to organizations of more than 200 people.
- 3,000%increase in detection coverage
- 92%reduction in mean time to respond
- 70%of incident analysis handled by an agentic triage platform
- 200+people in the largest security organization I've led
What I'm focused on next
I'm interested in senior security leadership roles where security operations, threat intelligence and AI meet.
AI-enabled security operations
Agentic SOC and AI-driven triage. I led the build of a platform that performs 70% of incident analysis automatically, and I helped shape Zscaler's Agentic SOC product.
Detection & Response at scale
Turning reactive, outsourced operations into 24x7, intelligence-driven Detection & Response programs, with governance aligned to MITRE ATT&CK and CIS.
Securing AI
Defending against threats to and from AI systems. I've built remediation programs for emerging AI threats and guardrails for AI-assisted software development.
Experience
Zscaler
Director of Detection and Response
Dec 2022 – Present · Remote
- Build and lead a global Detection & Response organization protecting more than 100,000 endpoints and 200,000 cloud assets across multi-cloud and on-premises environments.
- Partner with the CISO on strategy, organizational planning and execution across Corporate Security and Product Security, and manage the CISO organization's operating budget.
- Developed and executed a multi-year strategy that increased detection coverage by 3,000% and cut mean time to respond by 92%.
- Led development of an agentic triage platform that automatically performs 70% of analysis for every incident, reviews analyst output for quality, and gives leadership real-time situational awareness.
- Moved the SOC from an outsourced MSSP to a globally distributed 24x7 organization with standardized processes.
- Reduced analyst workload by 35%, accelerated detection engineering by 90% and increased detection output 400% year over year through automation and AI-enabled workflows.
- Report security posture and strategic risk to executive leadership and the Board of Directors quarterly. Serve as executive incident commander for major events and run annual executive tabletop exercises.
- Lead technical due diligence for acquisitions, oversee strategic vendor relationships, and work with product managers on the Agentic SOC (ASOC) product.
Equifax
Cyber Operations Transformation Lead (VP level)
Aug 2018 – Dec 2022 · Remote
- Led team development, training, process improvement and Intelligence Driven Defense fusion for more than 130 analysts across 8 functional areas.
- Raised the program's NIST CSF maturity from 1.4 to 3.6 through investment in people, process and technology.
- Cut response effort by 50% while expanding capability, through better intelligence collection and analysis automation.
- Standardized analysis and quality evaluation, raising investigation quality scores from an average of 6.5 to 9.9 out of 10.
- Built skill assessments and training programs that created 2 new functional areas and grew program headcount by 450%.
Revolutionary Security
Senior Security Consultant
Jun 2017 – Aug 2018 · Remote
- Transformed reactive SOCs into proactive, intelligence-driven Security Intelligence Centers (SICs).
- Assessed security posture for international corporations using the NIST framework and delivered short- and long-term roadmaps.
Lockheed Martin / Leidos Cyber
Cyber Intelligence Analyst Staff
Jan 2004 – Jun 2017 · Fort Worth, TX / Remote
- Progressed through four roles over 13 years, from founding member of the LM Aeronautics CIRT to Staff-level Cyber Intelligence Analyst. Selected for the inaugural Advanced Technical Leadership Program class.
- Architected an enterprise security program spanning 12+ domains, including governance, security architecture, IAM, vulnerability management, TPRM, SAST/DAST and wireless security.
- Led the LM Aeronautics malware program, reverse engineering APT specimens and delivering company-wide mitigation indicators.
- Worked with CISOs and CIOs to assess capabilities and build maturity roadmaps. Led on-site incident response for APT intrusions.
- Led red team penetration testing using known APT techniques, and built system and network integrity tooling for malware detection.
- Designed training in incident response, intelligence management, malware analysis, signature development and endpoint forensics.
Skills
- Leadership
- Security program transformation · Organizational design · Board & executive reporting · Budget & vendor management · M&A due diligence · Tabletop exercises · Mentorship & analyst development
- Security operations
- SOC/SIC design · Detection engineering · Threat hunting · Incident response · Threat intelligence · Malware analysis & reverse engineering · Forensics · Penetration testing · Attack emulation
- Frameworks
- MITRE ATT&CK · Intelligence Driven Defense · Kill Chain analysis · NIST CSF · CIS Controls
- Platforms
- SIEM (Splunk, Chronicle, ELK) · SOAR (XSOAR, Chronicle, ServiceNow SecOps) · EDR · AWS, GCP, Azure · Federal/DoD infrastructure
- AI & engineering
- Agentic triage · LLM-assisted analysis · Claude Code · Python · C/C++ · Java/JavaScript · TypeScript · SQL · Bash
Education
Master of Computer Science
Texas A&M University · 2002
Emphasis in network security and distributed computing
B.S., Computer Science
Texas A&M University · 2001
Minor in Business, Emerging Technologies
Certifications
CISSP
Certified Information Systems Security Professional
CEH
Certified Ethical Hacker
Still hands-on
I keep my technical edge by building. These are some of the security and AI platforms I've built on my own time.
Cintel: threat intelligence platform
Uses Claude to extract threat actors, malware, campaigns, ATT&CK techniques and indicators from security reporting. Every fact traces back to its source sentence, with timelines, a relationship graph and a sources-only chatbot.
vulnmon: vulnerability management
Maps internet exposure, reviews firewall configuration, scans hosts, containers and code (Semgrep, Gitleaks, ZAP, Nuclei), and ranks findings with CISA KEV and EPSS.
claude-harness: secure AI-assisted development
Guardrails, a test-first workflow, security scanning and gated deploys for building software with AI coding agents. Open source on GitHub.
AINL: AI news intelligence
Pulls in AI news, removes duplicates, uses Claude to classify and cluster stories, and publishes source-linked daily briefings.
I also build games, iOS apps and music. See them at soncrant.com.
Let's talk
The best way to reach me is on LinkedIn.
ksonc.com · linkedin.com/in/keith-soncrant · github.com/soncsec