Notes from the queue and from building JanriTech, written as they happen.
Most of the job isn't investigating threats, it's deciding what doesn't matter, quickly and correctly, so there's room to move fast on what does. A queue with three hundred alerts a day and one real incident is still a good day if the one real incident gets caught in twenty minutes instead of two hours. I think about triage speed more than almost anything else at work.
It would have been easy to make the volcano bulletin pipeline fully automatic, pull the data, summarize it, post it. I didn't, on purpose. Public safety information is one of the few categories where I want a person reading the summary before it goes anywhere, even if that person is me on my phone. Automation should remove the boring parts of a task, not the judgment.
Splitting time between SOC/IR work and building automations on the side sounds like context-switching chaos. In practice it's the same skill applied twice: look at a messy, repetitive process, find the signal, and build a system that handles the noise so a person only has to step in when it matters.
Started JanriTech Automations because I kept rebuilding the same kind of workflow for myself and my team, content pipelines, document generation, monitoring, and it seemed useful enough that other people would want it too. First real project was small: a Facebook page that never forgot to post. It taught me more about reliable automation than anything with higher stakes would have.
John Rey Gavilaga