Consulting & Advisory
Threat Intelligence That Works for Your Team
Engagements are kept selective and scoped to what I can do well. I run an independent practice alongside active security operations work — quality and fit take priority over volume. If it's a fit, you'll get the same depth that goes into the research on this site applied directly to your environment. Above all else, the goal is to help defenders protect their organizations.
Services
Retainer Advisory
Standing access to the services listed here — malware analysis, IR advisory, detection reviews, threat model work, and more — without the overhead of scoping a new engagement each time. When something comes up, your team has a resource to call on rather than starting from scratch. Structured around your cadence with flexibility for what the work requires. Retainer slots are kept small.
Malware Analysis & Reverse Engineering
Full technical breakdown of what a sample actually does — static and dynamic analysis, behavioral mapping, IOC extraction, and detection development. Useful when your SOC flags something suspicious, your IR team pulls a sample from a compromised host, or you need to understand a threat before it shows up. Can extend into campaign investigation or infrastructure pivoting when it adds value.
AI & Automation in Security Operations
Advisory on applying AI and automation to security operations — threat hunting, detection engineering, intelligence production, and analyst tooling. Drawing on hands-on experience building multi-agent systems for real SOC workflows, with a focus on what actually works and where AI adds genuine value versus noise.
Incident Response Advisory
Remote advisory for teams working through an incident or building out IR capabilities — scoping, planning, program development, and malware analysis support. Focus is on helping you think through what you're seeing rather than on-site forensic work; works well alongside an active investigation or as a program-building engagement once things settle.
SOC Program Advisory
Advisory for teams standing up or maturing a SOC — structure, processes, tooling, analyst workflows, and detection strategy. Drawing on experience leading threat detection across large enterprise environments; a sounding board to think through decisions and pressure-test your approach.
Detection Engineering Advisory
Targeted review and improvement of detection coverage for a specific threat, technique, or gap — grounded in real malware analysis and attacker tradecraft, scoped to your SIEM or EDR. Works best with a concrete problem to anchor the work rather than a broad audit.
Threat Model Review
A focused review of the threats that actually matter to your organization based on your industry, environment, and what adversaries are actively doing. Output: what to track, what to deprioritize, and where your detection and response gaps are against the most likely threats.
Threat Intelligence Utilization
Help operationalizing the threat intelligence your team already has — hunting plans, translating intel into detection logic, and briefings on relevant threats and campaigns. Typically a focused engagement around a specific threat or use case rather than an open-ended commitment.
Training & Knowledge Transfer
Focused sessions for analyst teams on threat hunting, applying malware reports, translating TI into detections, or understanding specific threat actors. Best as a single session or short series around a defined topic your team is working to get better at.
Background
SOC Operations Lead at EY with experience leading threat detection and response across large enterprise managed security accounts. GIAC Certified Forensic Analyst (GCFA). SANS FOR508 and FOR608. The research published on this site comes from the same work I do professionally — original malware analysis, hunting, and detection engineering done at depth.
Full background and credentials →
Full background and credentials →
Get in Touch
What to include in your message
- What you're working through — a rough sense of the problem or situation, even if it's not fully scoped yet
- Your environment — industry, org size, and any relevant tooling if it's useful context
- What you're thinking — whether this feels like a one-time thing, something ongoing, or you're still figuring that out
intel@the-hunters-ledger.com
I'll respond within a few business days. If the scope needs some shaping to get there, that's part of the partnership.