Technical advisory for security teams

Security architecture and detection engineering.

Technical leadership across security architecture, threat detection and applied research. I design solutions, build them and prove they work.

From telemetry to a hardened environment Telemetry from endpoints, cloud and identity, and network and applications feeds detection engineering. Detections are validated through adversary emulation and purple teaming, which informs architecture and research, and results in a hardened, measurable environment. Endpoints Cloud & identity Network & apps Detection engineeringlogging · detections · triage Adversary validationemulation · purple team · tuning Architecture & researchdesign · prototypes · standards Hardened, measured environmentcoverage · resilience · evidence
Principal ArchitectCISSP certifiedIvey Emerging Leaders15+ years in IT & security · remote-friendly
Services

Help at the depth you need

I deliver practical outcomes and prove them in your own environment.

ProjectDefined scopeWe agree scope, deliverable and timeline.
EmbeddedTechnical leadershipI embed with your team, or lead it.
Advisory hoursTechnical sounding boardSenior technical input as decisions come up.

Security Architecture & Research

I design, prototype and test security architecture, so you know it works before you rely on it.

  • Threat modelling & design review
  • Reference architectures & prototypes
  • Technology & vendor evaluation

Threat Detection & Response Engineering

I build detection around how real adversaries operate, and validate it by testing, not by assuming it works.

  • Detection engineering & coverage mapping
  • Purple-team validation & tuning
  • Logging strategy & incident readiness

Infrastructure & Systems Architecture

I design architecture grounded in years of running production infrastructure.

  • Architecture, identity & hardening
  • Automation & platform builds
  • Technical team leadership
Approach

From problem to working solution

Understand

I learn your environment, threats and constraints first-hand, not from a slide deck.

Design

I architect a solution that fits your team, your stack and your real risks.

Build

I prototype, implement and integrate alongside your engineers.

Prove

I test it against real adversary behaviour and hand over something that works.

About

Still building.

Tim Vivian

I’m a Principal Architect who still builds. I started in infrastructure, moved through security programs and adversary emulation, and now lead threat detection, research and architecture for the teams I work with.

That background means I design defences by thinking like an attacker, and I can review an architecture or write the detection for it.

Background
Detection engineeringDetection-as-codeThreat huntingSecurity automationAdversary emulationPurple teamingTabletops
Certified Information Systems Security Professional (CISSP)ISC2Issued Jan 2019
Ivey Emerging Leaders ProgramIvey Business School Executive EducationIssued Jan 2023
Testimonials

What people I’ve worked with say

“His focus on supporting our clients is second to none and knowing that we can count on the infrastructure that he manages is reassuring.”
Jason MacKenzieSenior colleague, TGT Solutions
“Tim’s ability to investigate, analyze, monitor, troubleshoot and determine server or data network problems makes him a great attribute to any team.”
Maja KukoljFormer colleague

Recommendations from my LinkedIn profile Read them all

Not sure what you need?

That’s a normal place to start. Tell me about your security program and we’ll figure out whether a project, an embedded engagement or a few hours of advice fits.