Matthew DeFir
Dynamic cybersecurity leader with 13+ years of experience in incident response, detection engineering, and threat hunting
Hire this person
Send a job offer directly to this candidate
About
Dynamic cybersecurity leader with 13+ years of experience in incident response, detection engineering, and threat hunting across Fortune 500 and public sector environments. Proven track record managing large-scale investigations, developing high-impact detection logic across SIEM and EDR platforms, and aligning telemetry analysis to industry frameworks and business risk. Adept at bridging hands-on detection and response work with strategic security outcomes and cross-functional collaboration.
Experience
Detection Engineering Lead at Binary Defense (2025-05 – 2026-05)
Led detection engineering for MDR service delivery across Splunk, Microsoft Sentinel, Google SecOps, Sumo Logic, XSIAM, and Devo.
- Established data onboarding standards and configuration-as-code detection pipelines using GitLab CI/CD.
- Developed and tuned high-fidelity detection content aligned to industry frameworks.
- Mentored detection engineers and set team standards for detection documentation and validation.
Information Security Executive Advisor at Elevance Health (2024-02 – 2025-05)
Lead cross-functional cyber resiliency and business continuity initiatives aligned to strategic security objectives.
- Collaborate with engineering teams to improve telemetry quality, data normalization, and threat detection coverage.
Various roles held: Principal Consultant, NA IR Lead, Global IR Lead, R&D Lead, Executive Consultant at IBM Security – X-Force IR Team (2021-02 – 2024-02)
- Led and supported large-scale, cross-functional IR engagements for Fortune 500 clients with revenue up to 26 million dollars.
- Worked closely with IBM Security Services on business opportunities following X-Force IR engagement leading to signings of more than 65 million dollars.
- Built and refined detection capabilities by developing detection content across SIEM, EDR, and cloud platforms.
- Directed detection and response R&D projects, contributing to standardization, detection pipelines, and cross-platform telemetry mapping.
Senior IR Consultant at Mandiant (now part of Google Cloud) (2016-06 – 2017-12)
- Led and supported cross-functional IR engagements of varying size and scope, delivering high-quality reports for IR consulting services.
- Contributed to high-impact detection and response recommendations during major breach investigations.
Senior Malware Research & Digital Forensic Analyst at U.S. Navy (2012-08 – 2016-06)
- Conducted deep malware analysis and reverse engineering to support national security objectives.
- Contributed to R&D efforts in detection tooling, forensic analysis techniques, and IR program design.
- Trained analysts on malware behavior, detection signature creation, and incident response tactics.
