David French — Director of Engineering

Your data is one of your most valuable assets — the better you protect it from attack, the better your reputation will be with discerning customers. I'm a leader in Detection Engineering with over a decade of experience defining, building, and scaling security operations capabilities I've developed APIs, tools, and AI-powered workflows for automating security operations tasks to detect & respond to threats to a company's brand and customers before any damage occurred. I’ve also shared best practices and knowledge on the implementation and principles of Detection-as-Code. I enjoy giving back to the community, sharing knowledge and best practices through public speaking, blogging, mentoring, and running Capture The Flag (CTF) events. I'm also a contributor to the MITRE ATT&CK knowledge base of adversary behavior. You can find some of my research, open-source tools, conference presentations, and technical publications here: https://github.com/threat-punter/security-publications I'm the creator of Dorothy — a tool to help security teams test their monitoring and detection capabilities for their Okta environment. I presented Dorothy at Black Hat USA. My recent focus areas for research and detection engineering are Google Cloud, GitHub, Windows, macOS, Okta, and AWS. I have extensive experience in various cybersecurity and IT domains including threat hunting, detection engineering, incident response, digital forensics, and malware analysis. Certifications: CISSP, GMON, GCIH, GREM, GCFE, CCNA Security, CCNA Routing & Switching, ITIL, Security+

Stackforce AI infers this person is a Cybersecurity expert specializing in Detection Engineering and Threat Hunting.

Location: Fort Collins, Colorado, United States

Experience: 20 yrs 2 mos

Skills

Threat Hunting
Detection Engineering
Malware Analysis
Threat Research
Behavior-based Detections
Incident Response

Career Highlights

Over a decade of experience in Detection Engineering.
Creator of Dorothy tool for security monitoring.
Contributed to MITRE ATT&CK knowledge base.

Work Experience

Docusign

Senior Manager of Detection Engineering (3 mos)

Google

Staff Security Engineer • Blue Team Advocate • Google SecOps (2 yrs 4 mos)

Twilio

Staff Security Engineer • Detection Engineering & Threat Hunting • Technical Lead (1 yr 6 mos)

Elastic

Senior Security Research Engineer (2 yrs 5 mos)

Endgame

Threat Researcher (11 mos)

Capital Group

Senior Information Security Analyst (6 yrs 6 mos)

Frontier Economics

Information Technology Specialist (1 yr 3 mos)

Capital Q High Security Services

IT Help Desk Manager (5 yrs)

Education

Bachelor of Science at Western Governors University

David French

Director of Engineering

Fort Collins, Colorado, United States20 yrs 2 mos experience

Key Highlights

Over a decade of experience in Detection Engineering.
Creator of Dorothy tool for security monitoring.
Contributed to MITRE ATT&CK knowledge base.

Stackforce AI infers this person is a Cybersecurity expert specializing in Detection Engineering and Threat Hunting.

Contact

Skills

Core Skills

Threat HuntingDetection EngineeringMalware AnalysisThreat ResearchBehavior-based DetectionsIncident Response

Other Skills

Automated WorkflowsThreat DetectionMachine LearningDetection StrategyInformation SecuritySecurityIncident ManagementDetection-as-CodePython (Programming Language)Amazon Web Services (AWS)PowershellPublic SpeakingDigital ForensicsSecurity Incident ResponseNetworking

About

Experience

Docusign

Senior Manager of Detection Engineering

Jan 2026 – Present · 3 mos · Colorado, United States

Google

Staff Security Engineer • Blue Team Advocate • Google SecOps

Sep 2023 – Jan 2026 · 2 yrs 4 mos · Colorado, United States

Twilio

Staff Security Engineer • Detection Engineering & Threat Hunting • Technical Lead

Mar 2022 – Sep 2023 · 1 yr 6 mos · Colorado, United States

Built and led the company's threat hunting capability in order to proactively identify threats that may evade existing security defenses before damage or loss occurs.
Researched and hunted for attacker tradecraft in order to improve detection coverage for the company's products and cloud, endpoint, messaging, and Identity & Access Management (IAM) systems.
Designed and built automated workflows to detect and respond to threats to the company’s products, customers, and network.
Trained others within the security organization in order to enable them to effectively triage, investigate, and respond to threats.

Threat HuntingDetection EngineeringIncident ResponseAutomated Workflows

Elastic

Senior Security Research Engineer

Oct 2019 – Mar 2022 · 2 yrs 5 mos · Colorado, United States

Researched attacker tradecraft to develop detections and preventions for Elastic's SIEM and Endpoint Security products. Platforms include Windows, macOS, Okta, Google Cloud Platform (GCP), Office 365, Google Workspace, and Azure.
Developed the Malicious Behavior Protection feature and accompanying rules for Elastic Endpoint Security. Behavior Protection rules can execute response actions to prevent malicious behavior in addition to detecting it.
Created and released Dorothy, a free tool for security teams to test their visibility and detections for their Okta Single Sign-On (SSO) environment. Presented Dorothy at Black Hat USA 2021.
Received the Outstanding Contribution Award for the company-wide Engineering team in 2020.
Contributed several references and techniques to the MITRE ATT&CK knowledge base of adversary behavior.
Published "The Elastic Guide to Threat Hunting" — a companion guide to help security teams learn methodologies and techniques to proactively hunt for malicious behavior in their organization’s network.
Developed a machine learning model to classify Windows shortcut (LNK) files as malicious or benign and presented research at BSides Salt Lake City.
Regularly shared information with the community via blogging, webinars, and conferences to help security practitioners with their understanding of attacker tactics, threat detection, threat hunting, and log analysis.
Designed and hosted capture the flag (CTF) events for the security community at BSides conferences.

Detection EngineeringMalware AnalysisIncident ResponseThreat Detection

Endgame

Threat Researcher

Nov 2018 – Oct 2019 · 11 mos · Colorado, United States

Endgame was acquired by Elastic in 2019.
Researched adversary tradecraft to develop behavior-based detections for the company’s Endpoint Detection & Response (EDR) solution.
Engineered features based on process events and collaborated with data scientists to build ProblemChild, a machine learning model to detect suspicious process relationships. Patent pending.
Developed automated workflows to triage alerts, address false positives, and improve efficacy of detection rules for customers.

Threat ResearchBehavior-based DetectionsMachine Learning

Capital group

Senior Information Security Analyst

May 2012 – Nov 2018 · 6 yrs 6 mos · San Antonio, Texas, United States

Developed, implemented, and trained analysts on the SOC’s threat hunting, detection, and incident response processes.
Led the effort to align the SOC’s detection strategy with the MITRE ATT&CK framework to focus resources on detecting attacker behavior in the organization’s network.
Developed a tool to automate the monitoring of over 2,000 typosquatting domains that posed a risk of phishing attacks or brand misuse. The custom-built tool helped thwart several attacks and saved 45 minutes of analyst time daily.
Hypothesized and executed hunt activities to identify use of adversary tactics, techniques, and procedures (TTPs), developed detection rules, and worked with the incident response team for remediation as needed.
Organized and led incident response identification, containment, eradication, and recovery activities.
Delivered a live cyber-attack and defense scenario to the fund board to raise security awareness and demonstrate the SOC’s ability to detect and respond to threats to the organization.
Presented at the annual FS-ISAC summit to share how passive reconnaissance techniques can be used to proactively defend a financial services organization from cyber attacks.
Designed and built forensics and malware analysis capability.

Incident ResponseThreat HuntingDetection Strategy