{
  "$schema": "https://raw.githubusercontent.com/jsonresume/resume-schema/v1.0.0/schema.json",
  "basics": {
    "name": "Derik Callahan",
    "label": "Senior Manager, IT Security — Security Engineering & Operations",
    "url": "https://derikcallahan.com",
    "summary": "Player-coach security leader with 15 years in IT and cybersecurity, 7 of them managing security teams. I lead security engineering and operations for a publicly traded company. Our 24/7 SOC runs through an MDR partnership at a mean time to detect under 5 minutes and a mean time to respond under 1 hour. We got there through detection engineering and SOAR automation, not added headcount. I rebuilt that SOC around agentic AI. Production agents triage phishing, endpoint, and identity alerts, and an analyst reviews every incident with AI doing the enrichment and investigation legwork. I sit on our AI Center of Excellence and architecture committee and lead safe AI adoption: use-case risk review, AI/MCP gateways, agent runtime guardrails, non-human identity controls, and OpenTelemetry tracing so the SOC can detect and investigate agent misuse.",
    "location": {
      "region": "Arizona",
      "city": "Phoenix",
      "countryCode": "US"
    },
    "profiles": [
      {
        "network": "LinkedIn",
        "username": "derik-callahan",
        "url": "https://www.linkedin.com/in/derik-callahan"
      },
      {
        "network": "GitHub",
        "username": "dcallahan",
        "url": "https://github.com/dcallahan"
      }
    ]
  },
  "work": [
    {
      "name": "Meritage Homes Corporation",
      "location": "Scottsdale, AZ",
      "position": "Senior Manager, IT Security",
      "startDate": "2021",
      "summary": "Lead a team of security engineers and analysts across security operations, threat and exposure management, identity engineering, AI security, and compliance.",
      "highlights": [
        "Member of the AI Center of Excellence and architecture committee; set the governance model under which teams adopt AI and agents, and the risk review a use case clears before production.",
        "Govern agentic AI at runtime through AI/MCP gateways, destructive-action controls, approval gates on high-impact operations, and execution sandboxing with least-privilege tool scoping.",
        "Extended identity governance to non-human identities — machine, service, and agent identities scoped, guardrailed, and reviewed across credential and token lifecycle.",
        "Instrumented AI agent trace monitoring with OpenTelemetry so prompt, tool-call, and action telemetry is retained and reviewable, feeding agent activity into detection and response.",
        "Run 24/7 SOC operations through an MDR partnership at MTTD under 5 minutes, triage under 20 minutes, and MTTR under 1 hour.",
        "Put production AI agents in front of phishing, endpoint, and identity alert triage, with human review of every incident and AI handling enrichment, timeline reconstruction, and response recommendations.",
        "Built the incident response program — IR plans, escalation paths, SOPs — and lead high-severity incidents through to durable remediation of the systemic cause.",
        "Own ransomware protection, detection, and response: layered prevention, precursor detections, and isolation-to-recovery playbooks exercised through tabletops.",
        "Own the threat lifecycle end to end — threat intelligence, hunting, red team coordination, and attack simulation wired into SIEM and SOAR.",
        "Built a CTEM program unifying vulnerability management, SAST/DAST, CSPM, attack surface management, and penetration testing, prioritized by business risk rather than raw severity.",
        "Set and enforce control standards across cloud, identity, endpoint, and application — EPP/EDR/XDR, ZTNA, SASE/CASB, DLP, WAF — with standards enforced as code through cloud policy.",
        "Rolled out phishing-resistant, passwordless authentication to take passwords out of identity-based attack chains.",
        "Consolidated overlapping tooling into a unified, automation-first stack.",
        "Oversee NIST CSF alignment and partner with Finance on SOX IT controls.",
        "Grew interns into senior analysts and service desk staff into identity engineers."
      ]
    },
    {
      "name": "USLBM Holdings",
      "location": "Gilbert, AZ",
      "position": "Cybersecurity Manager / Lead",
      "startDate": "2019",
      "endDate": "2021",
      "highlights": [
        "Led security operations with a 24/7 SOC across enterprise and OT environments; wrote the IR plan and SOPs and led tabletop exercises.",
        "Led security architecture for a large-scale Azure cloud migration, and consolidated 40+ acquisitions into one identity environment with Azure AD, MFA, and Conditional Access across 11,000 employees."
      ]
    },
    {
      "name": "R&K Building Supplies (USLBM)",
      "location": "Gilbert, AZ",
      "position": "Systems Engineer",
      "startDate": "2015",
      "endDate": "2019",
      "highlights": [
        "Managed Windows network and server infrastructure (Active Directory, Exchange, Cisco, VMware) and automated operations with Python, Bash, and PowerShell."
      ]
    },
    {
      "name": "ServerHub",
      "location": "Tempe, AZ",
      "position": "Linux System Administrator",
      "startDate": "2014",
      "endDate": "2015",
      "highlights": [
        "Led a team of 5 running Linux datacenter and IaaS infrastructure with high-availability design."
      ]
    }
  ],
  "education": [
    {
      "institution": "University of Arizona",
      "studyType": "M.S.",
      "area": "Management of Information Systems",
      "courses": [
        "Graduate Certificate, Enterprise Cyber Security"
      ]
    },
    {
      "institution": "Northern Arizona University",
      "studyType": "B.S.",
      "area": "Management of Information Systems",
      "courses": [
        "Summa Cum Laude"
      ]
    }
  ],
  "certificates": [
    {
      "name": "CISSP",
      "issuer": "ISC2"
    },
    {
      "name": "CISM",
      "issuer": "ISACA"
    },
    {
      "name": "AAISM — Advanced in AI Security Management",
      "issuer": "ISACA"
    },
    {
      "name": "Cybersecurity Architect Expert",
      "issuer": "Microsoft"
    },
    {
      "name": "Azure Administrator Associate",
      "issuer": "Microsoft"
    },
    {
      "name": "Security Operations Analyst Associate",
      "issuer": "Microsoft"
    },
    {
      "name": "Security+",
      "issuer": "CompTIA"
    },
    {
      "name": "CCNA",
      "issuer": "Cisco"
    }
  ],
  "skills": [
    {
      "name": "AI & agentic security",
      "keywords": [
        "AI use-case risk review",
        "AI / MCP gateways",
        "Agent runtime guardrails",
        "Approval gates",
        "Execution sandboxing",
        "OpenTelemetry agent tracing",
        "Non-human identity",
        "Prompt-injection & data-leakage controls",
        "Azure AI Foundry"
      ]
    },
    {
      "name": "Security operations",
      "keywords": [
        "Agentic AI SOC",
        "Detection engineering",
        "SIEM / SOAR",
        "Microsoft Defender XDR",
        "Incident command",
        "Threat hunting",
        "Threat intelligence",
        "Ransomware response",
        "Tabletop exercises"
      ]
    },
    {
      "name": "Exposure management",
      "keywords": [
        "CTEM",
        "Vulnerability management",
        "SAST / DAST",
        "CSPM",
        "Attack surface management",
        "Penetration testing"
      ]
    },
    {
      "name": "Identity & Zero Trust",
      "keywords": [
        "Entra ID & ID Governance",
        "Saviynt",
        "Okta",
        "Conditional Access",
        "SAML / OIDC",
        "FIDO2 / passkeys",
        "ZTNA",
        "SASE / SSE",
        "CASB",
        "DLP",
        "Microsoft Purview",
        "Azure Policy"
      ]
    },
    {
      "name": "Engineering",
      "keywords": [
        "Python",
        "PowerShell",
        "Bash",
        "TypeScript",
        "Azure",
        "Azure Logic Apps",
        "CI/CD",
        "Git",
        "Linux",
        "Windows Server"
      ]
    },
    {
      "name": "Risk & leadership",
      "keywords": [
        "NIST CSF",
        "KPI / KRI reporting",
        "SOX IT controls",
        "Vendor & MDR management",
        "Team development"
      ]
    }
  ],
  "projects": [
    {
      "name": "HackerOne MCP server",
      "description": "An MCP server covering the full HackerOne REST API (Customer and Hacker, 174 tools), over stdio or hosted Streamable HTTP, wrapped in a gated bug bounty operations pipeline where nothing leaves the machine without a recorded human approval.",
      "url": "https://derikcallahan.com/writing/three-gates-for-an-offensive-agent"
    },
    {
      "name": "Identity governance browser agent",
      "description": "A Python orchestrator that lets a model drive a browser through provisioning and deprovisioning in applications with no API, with Teams approval cards before every write and a SHA-256 hashed screenshot audit trail.",
      "url": "https://derikcallahan.com/writing/an-agent-for-apps-without-apis"
    },
    {
      "name": "This site",
      "description": "A static Astro site where every page has a Markdown twin, plus llms.txt, JSON Resume, content negotiation, and a read-only MCP endpoint — built so an AI agent can read it as easily as a person.",
      "url": "https://derikcallahan.com/writing/a-resume-for-two-audiences"
    }
  ],
  "meta": {
    "canonical": "https://derikcallahan.com/resume.json",
    "lastModified": "2026-10-16T16:46:05.871Z"
  }
}