# Derik Callahan — Resume

Senior Manager, IT Security — Security Engineering & Operations
AI risk & agentic security | Cyber operations & threat management | Zero Trust, identity & SSE modernization

- Contact form: https://derikcallahan.com/contact
- LinkedIn: https://www.linkedin.com/in/derik-callahan
- GitHub: https://github.com/dcallahan
- Location: Phoenix Metro, Arizona

## Summary

Player-coach security leader with 15 years in IT and cybersecurity, 7 of them managing security teams. I lead security engineering and operations for a publicly traded company. Our 24/7 SOC runs through an MDR partnership at a mean time to detect under 5 minutes and a mean time to respond under 1 hour. We got there through detection engineering and SOAR automation, not added headcount. I rebuilt that SOC around agentic AI. Production agents triage phishing, endpoint, and identity alerts, and an analyst reviews every incident with AI doing the enrichment and investigation legwork. I sit on our AI Center of Excellence and architecture committee and lead safe AI adoption: use-case risk review, AI/MCP gateways, agent runtime guardrails, non-human identity controls, and OpenTelemetry tracing so the SOC can detect and investigate agent misuse.

## Experience

### Senior Manager, IT Security, Meritage Homes Corporation

Scottsdale, AZ · 2021 – Present · Security Engineering & Operations

Lead a team of security engineers and analysts across security operations, threat and exposure management, identity engineering, AI security, and compliance.

**AI risk management & safe AI adoption**

- Member of the AI Center of Excellence and architecture committee; set the governance model under which teams adopt AI and agents, and the risk review a use case clears before production.
- Govern agentic AI at runtime through AI/MCP gateways, destructive-action controls, approval gates on high-impact operations, and execution sandboxing with least-privilege tool scoping.
- Extended identity governance to non-human identities — machine, service, and agent identities scoped, guardrailed, and reviewed across credential and token lifecycle.
- Instrumented AI agent trace monitoring with OpenTelemetry so prompt, tool-call, and action telemetry is retained and reviewable, feeding agent activity into detection and response.

**AI-enabled security operations & response**

- Run 24/7 SOC operations through an MDR partnership at MTTD under 5 minutes, triage under 20 minutes, and MTTR under 1 hour.
- Put production AI agents in front of phishing, endpoint, and identity alert triage, with human review of every incident and AI handling enrichment, timeline reconstruction, and response recommendations.
- Built the incident response program — IR plans, escalation paths, SOPs — and lead high-severity incidents through to durable remediation of the systemic cause.
- Own ransomware protection, detection, and response: layered prevention, precursor detections, and isolation-to-recovery playbooks exercised through tabletops.
- Own the threat lifecycle end to end — threat intelligence, hunting, red team coordination, and attack simulation wired into SIEM and SOAR.

**Continuous exposure management**

- Built a CTEM program unifying vulnerability management, SAST/DAST, CSPM, attack surface management, and penetration testing, prioritized by business risk rather than raw severity.

**Zero Trust & platform modernization**

- Set and enforce control standards across cloud, identity, endpoint, and application — EPP/EDR/XDR, ZTNA, SASE/CASB, DLP, WAF — with standards enforced as code through cloud policy.
- Rolled out phishing-resistant, passwordless authentication to take passwords out of identity-based attack chains.
- Consolidated overlapping tooling into a unified, automation-first stack.

**Risk, metrics & team**

- Oversee NIST CSF alignment and partner with Finance on SOX IT controls.
- Grew interns into senior analysts and service desk staff into identity engineers.

### Cybersecurity Manager / Lead, USLBM Holdings

Gilbert, AZ · 2019 – 2021


- Led security operations with a 24/7 SOC across enterprise and OT environments; wrote the IR plan and SOPs and led tabletop exercises.
- Led security architecture for a large-scale Azure cloud migration, and consolidated 40+ acquisitions into one identity environment with Azure AD, MFA, and Conditional Access across 11,000 employees.

### Systems Engineer, R&K Building Supplies (USLBM)

Gilbert, AZ · 2015 – 2019


- Managed Windows network and server infrastructure (Active Directory, Exchange, Cisco, VMware) and automated operations with Python, Bash, and PowerShell.

### Linux System Administrator, ServerHub

Tempe, AZ · 2014 – 2015


- Led a team of 5 running Linux datacenter and IaaS infrastructure with high-availability design.

## Certifications

- CISSP (ISC2)
- CISM (ISACA)
- AAISM — Advanced in AI Security Management (ISACA)
- Cybersecurity Architect Expert (Microsoft)
- Azure Administrator Associate (Microsoft)
- Security Operations Analyst Associate (Microsoft)
- Security+ (CompTIA)
- CCNA (Cisco)

## Education

- M.S., Management of Information Systems, University of Arizona — Graduate Certificate, Enterprise Cyber Security
- B.S., Management of Information Systems, Northern Arizona University — Summa Cum Laude

## Skills

- **AI & agentic security**: AI use-case risk review, AI / MCP gateways, Agent runtime guardrails, Approval gates, Execution sandboxing, OpenTelemetry agent tracing, Non-human identity, Prompt-injection & data-leakage controls, Azure AI Foundry
- **Security operations**: Agentic AI SOC, Detection engineering, SIEM / SOAR, Microsoft Defender XDR, Incident command, Threat hunting, Threat intelligence, Ransomware response, Tabletop exercises
- **Exposure management**: CTEM, Vulnerability management, SAST / DAST, CSPM, Attack surface management, Penetration testing
- **Identity & Zero Trust**: Entra ID & ID Governance, Saviynt, Okta, Conditional Access, SAML / OIDC, FIDO2 / passkeys, ZTNA, SASE / SSE, CASB, DLP, Microsoft Purview, Azure Policy
- **Engineering**: Python, PowerShell, Bash, TypeScript, Azure, Azure Logic Apps, CI/CD, Git, Linux, Windows Server
- **Risk & leadership**: NIST CSF, KPI / KRI reporting, SOX IT controls, Vendor & MDR management, Team development