Derik Callahan

Derik Callahan

Senior Manager, IT Security — Security Engineering & Operations

AI risk & agentic security · Cyber operations & threat management · Zero Trust, identity & SSE modernization

MarkdownJSON ResumeSave as PDF

Summary

Player-coach security leader with 15 years in IT and cybersecurity, 7 of them managing security teams. I lead security engineering and operations for a publicly traded company.

Our 24/7 SOC runs through an MDR partnership at a mean time to detect under 5 minutes and a mean time to respond under 1 hour. We got there through detection engineering and SOAR automation, not added headcount.

I rebuilt that SOC around agentic AI. Production agents triage phishing, endpoint, and identity alerts, and an analyst reviews every incident with AI doing the enrichment and investigation legwork.

I sit on our AI Center of Excellence and architecture committee and lead safe AI adoption: use-case risk review, AI/MCP gateways, agent runtime guardrails, non-human identity controls, and OpenTelemetry tracing so the SOC can detect and investigate agent misuse.

Experience

  1. Senior Manager, IT Security

    2021 – Present

    Meritage Homes Corporation, Scottsdale, AZ · Security Engineering & Operations

    Lead a team of security engineers and analysts across security operations, threat and exposure management, identity engineering, AI security, and compliance.

    AI risk management & safe AI adoption

    • Member of the AI Center of Excellence and architecture committee; set the governance model under which teams adopt AI and agents, and the risk review a use case clears before production.
    • Govern agentic AI at runtime through AI/MCP gateways, destructive-action controls, approval gates on high-impact operations, and execution sandboxing with least-privilege tool scoping.
    • Extended identity governance to non-human identities — machine, service, and agent identities scoped, guardrailed, and reviewed across credential and token lifecycle.
    • Instrumented AI agent trace monitoring with OpenTelemetry so prompt, tool-call, and action telemetry is retained and reviewable, feeding agent activity into detection and response.

    AI-enabled security operations & response

    • Run 24/7 SOC operations through an MDR partnership at MTTD under 5 minutes, triage under 20 minutes, and MTTR under 1 hour.
    • Put production AI agents in front of phishing, endpoint, and identity alert triage, with human review of every incident and AI handling enrichment, timeline reconstruction, and response recommendations.
    • Built the incident response program — IR plans, escalation paths, SOPs — and lead high-severity incidents through to durable remediation of the systemic cause.
    • Own ransomware protection, detection, and response: layered prevention, precursor detections, and isolation-to-recovery playbooks exercised through tabletops.
    • Own the threat lifecycle end to end — threat intelligence, hunting, red team coordination, and attack simulation wired into SIEM and SOAR.

    Continuous exposure management

    • Built a CTEM program unifying vulnerability management, SAST/DAST, CSPM, attack surface management, and penetration testing, prioritized by business risk rather than raw severity.

    Zero Trust & platform modernization

    • Set and enforce control standards across cloud, identity, endpoint, and application — EPP/EDR/XDR, ZTNA, SASE/CASB, DLP, WAF — with standards enforced as code through cloud policy.
    • Rolled out phishing-resistant, passwordless authentication to take passwords out of identity-based attack chains.
    • Consolidated overlapping tooling into a unified, automation-first stack.

    Risk, metrics & team

    • Oversee NIST CSF alignment and partner with Finance on SOX IT controls.
    • Grew interns into senior analysts and service desk staff into identity engineers.

  2. Cybersecurity Manager / Lead

    2019 – 2021

    USLBM Holdings, Gilbert, AZ

    • Led security operations with a 24/7 SOC across enterprise and OT environments; wrote the IR plan and SOPs and led tabletop exercises.
    • Led security architecture for a large-scale Azure cloud migration, and consolidated 40+ acquisitions into one identity environment with Azure AD, MFA, and Conditional Access across 11,000 employees.

  3. Systems Engineer

    2015 – 2019

    R&K Building Supplies (USLBM), Gilbert, AZ

    • Managed Windows network and server infrastructure (Active Directory, Exchange, Cisco, VMware) and automated operations with Python, Bash, and PowerShell.

  4. Linux System Administrator

    2014 – 2015

    ServerHub, Tempe, AZ

    • Led a team of 5 running Linux datacenter and IaaS infrastructure with high-availability design.