Incident response
Leading complex investigations from the first signal through containment, recovery, and the lessons that follow.
Incident command / Digital forensics / CSIRT
SECURITY ENGINEERING & INCIDENT RESPONSE
Anthony
Russo.
I investigate security incidents and build
automation that helps teams respond.
A CONTINUOUS PRACTICE
Human judgment.Thoughtful automation.
AUSTIN, TEXASCurrently, Senior Incident Response Analyst at Atlassian
01 / WHAT I WORK ON
Clarity in the complex.
My work sits where investigations, engineering, and operations meet. The goal is straightforward: understand what happened, respond well, and improve the system.
Detection engineering
Connecting endpoint, cloud, and identity telemetry to find useful signals and give analysts better context.
CrowdStrike / Splunk / Wiz / AWS
Security automation
Building repeatable workflows that take care of the routine and leave room for human judgment.
Python / Tines / SaaS APIs / AI-assisted triage
02 / EXPERIENCE
Built through practice.
A decade across enterprise security, cloud platforms, and military cyber defense.
Atlassian
DEC 2022 — PRESENTSenior Incident Response Analyst
CURRENTPreviously SecOps Team Lead & Incident Response Analyst
Leading high-severity investigations and developing response standards across commercial and FedRAMP environments. Building the workflows, review points, and guardrails for AI-assisted security operations.
40%lower mean time to respond
through SOC automation
through SOC automation
20%less investigation time
with Python enrichment
with Python enrichment
Unity
JAN 2021 — DEC 2022Senior SecOps & Incident Response Analyst
Built high-fidelity detections, automated incident enrichment, and partnered with engineering to bring detection capabilities into the infrastructure.
U.S. Air Force
MAY 2016 — MAY 2020Cybersecurity Analyst / Staff Sergeant
Helped establish a regional cyber defense team in Europe, developed Python anomaly detection tools, and trained analysts supporting mission defense.
ALSO ALONG THE WAY Rapid7 · Texas Workforce Commission · Microsoft
EDUCATION
M.S., Information Security Engineering
SANS Technology InstituteSELECTED CERTIFICATIONS
CISSP · GCFA · GCIH · GCIA
Security leadership, forensics, and incident handling03 / RESEARCH
Thinking beyond the incident.
SANS TECHNOLOGY INSTITUTE / DEC 2024
Implementing large language models as dynamic SOAR tools
My research into how LLMs can support security orchestration, automation, and response.
Read the research (opens in a new tab)04 / CONTACT
Let’s compare notes.
Always interested in a good conversation about security,
incident response, or building useful things.