Eric Kelly

Technical lead for incident response at a large U.S. bank. First chair on DDoS, credential stuffing, phishing, malware, and multi-cloud incidents spanning Microsoft 365, AWS, Azure, and GCP.

Built IR capability in AWS and the playbooks that sit beside it. Lead SOC quality with an AI-first approach. Defensive lead in peer-bank cyber competitions. IR technical lead when the red team comes through the door.

Progressed from SOC analyst to hunt and adversary-simulation lead. Designed a structured methodology for proactive hunts. Mapped alerting and telemetry to MITRE ATT&CK so coverage gaps were visible, not guessed.

Built an in-house tool for EDR signature operations. Wrote detection logic against database activity monitoring across Oracle, SQL Server, and DB2.

Vetted red-team operator. Hack the Pentagon live events with Synack: 2018 at the Pentagon in Washington, D.C., 2019 in Las Vegas. Critical findings across web, hardware, host, mobile, and IoT — the kind you report, not the kind you tweet.

Two-day course taught by NVIDIA’s AI Red Team. Jupyter labs on attacking machine-learning systems: evasion, model extraction, inversion, membership inference, dataset poisoning, and the same classes of attack against large language models.

Inaugural four-day course. Built TTP-based hunt hypotheses against MITRE ATT&CK, then hunted live post-exploitation with Sysmon, ELK/HELK, ACE, and host baselining — the kind of adversary behavior signature tools miss.