title:
Shane McCausland
status: production
level: high
description: >
Lead technical engineer for an insider threat program, based in Dublin. I build the detection, risk-scoring and triage systems that help analysts find the few people who need their attention each day.
author: The Paranoids, Yahoo (since 2022)
logsource: [endpoint, identity, cloud, email, saas]
detection:
detections_authored: 200+
alert_noise_cut: ~85%
condition: all of them
falsepositives:
- fewer every week
Coverage
What I work on, mapped the way a detection team maps its own coverage.
Data
Databricks and Delta Lake PySpark and SQL Schema normalisation (ECS) AWS serverless pipelinesDetect
Detection-as-code Testing rules on live data Evidence-based tuning MITRE ATT&CK and threat huntingInsider risk
Behavioural analytics User risk scoring Triage and case management AI-assisted triageShip
CI/CD with GitHub Actions AI-assisted engineering Python, FastAPI and React TerraformDaily work Regular use
How I build detections
Breadth beats volume
Several different unusual behaviours say more than one behaviour repeated a thousand times.
Every rule earns its place
Rules get reviewed against real evidence. The ones that don't pay their way get fixed or switched off.
Noise is a bug
A noisy rule costs analysts time and trust, so it's tracked and fixed like any other defect.
Test against reality
Every change runs against real data before it ships, not just against the examples it was written for.
Write it down
An analyst should be able to see why something fired without asking the engineer who wrote it.
Work
-
Lead Technical Engineer, Insider Threat, Yahoo
I lead engineering for the insider threat program in the Paranoids, Yahoo's security team. I designed and built the program's detection, risk-scoring and triage platform from scratch, and it's in daily use. I also brought AI into the team's work, from AI-assisted triage to how we write and review code.
-
Detection Engineer, Yahoo
I became the largest single author of new detections on the team, across endpoint, identity, cloud and email. I built the CI that tests every rule change against real data before it ships.
-
Security Data Engineer, Yahoo
Main engineer on the pipeline that brings security telemetry into one normalised data lake. Much of the team's detection work still runs on that data.
-
Freelance developer
Websites and IT for small Irish businesses, including running the whole IT stack for a phone-repair retailer.
Research and speaking
Hardening IoT devices against Mirai-style botnets
For my M.Sc. in Cybersecurity at Munster Technological University (First Class Honours, 2021), I took factory-configured IoT devices and compromised them with Mirai-style attacks, then built a Python tool that scans a network for vulnerable devices and hardens them.
I also give careers talks to students thinking about a path into security.
B.Sc. Computer Games Development, University of Limerick, 2017.
Get in touch
Or find me on LinkedIn. Found a problem with this site? The disclosure contact is in security.txt.