Sarah Reddish Builds Timelines and Guides Huntress Partners Through Breach Containment
A Huntress SOC analyst details how she investigates breaches, builds timelines, and delivers clear containment guidance to security partners.
Key points
- Sarah Reddish works in Huntress’ Triage and Analysis team, investigating intrusions across global partner environments.
- She focuses on translating complex technical findings into clear, actionable remediation reports for partners.
- Reddish collaborates with a global SOC team to ensure continuity and consistent threat response across regions.
Sarah Reddish, a Security Operations Analyst at Huntress, investigates security incidents for the company’s global partners. Working within the Triage and Analysis division, she examines suspicious activity and intrusions to determine their scope and impact. According to Huntress, her role involves more than monitoring alerts; it requires deep investigation into how adversaries operate within partner environments.
What does the investigation process involve?
Reddish analyzes partner environments to understand what happened during an intrusion. She separates observed activity from confirmed facts, building attack timelines to map the adversary’s behavior. This process helps distinguish between initial lures and follow-on malicious actions. Her goal is to clarify the situation for partners, even when initial information is incomplete or ambiguous.
How are findings communicated to partners?
After completing an investigation, Reddish writes clear reports with practical remediation guidance. She translates complex technical data into outcomes that help partners understand the risk and respond confidently. According to Huntress, this includes providing specific containment and recovery steps. This approach turns confusing incidents into a practical path forward for system restoration and security improvement.
What supports this operational model?
Reddish works within a global SOC that supports cross-region handoffs for continuity. She collaborates with analysts from different regions, learning from their diverse experiences and perspectives. Chris Hecker, Manager of Security Operations, provides guidance on incident severity and operational escalations. This support structure allows Reddish to own her work while considering the broader impact of her analysis on partner security.
What is the impact on partner security?
The work aims to disrupt malicious activity and improve partner security postures. By providing clear containment steps, Reddish helps partners protect their data and systems. According to Huntress, seeing her work directly wreck adversaries and improve security is the most rewarding part. This focus on actionable protection ensures that investigations lead to tangible safety improvements for partners.
Questions to ask your suppliers
When reviewing third-party security services, organizations should ask how incidents are translated into actionable steps. Determine whether the supplier provides clear containment and recovery guidance rather than just alert data. Identify who inside the organization receives these reports and how they act on them. Ensure the supplier explains the scope and severity of findings in understandable terms.
Verify that their process includes building attack timelines to clarify adversary behavior. Confirm that their team communicates clearly with your internal security staff. Check whether they support cross-region collaboration for consistent response. Ask how they handle incomplete or ambiguous initial information. Ensure their remediation advice is practical and easy to follow.
What to do and how to stay safe: Huntress
- Review recent security reports to ensure they contain clear containment and recovery steps.
- Verify that your team understands the scope of any reported intrusions and attack timelines.
- Confirm that remediation guidance is actionable and tailored to your specific environment.
- Check that your security supplier communicates findings in terms your team can understand.
Step-by-step guide: Browser Security Settings for Small Business Teams
General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who is Sarah Reddish and what does she do?
Sarah Reddish is a Security Operations Analyst at Huntress who investigates intrusions and provides remediation guidance to partners.
How does Huntress handle incident investigations?
Huntress analysts investigate suspicious activity, build attack timelines, and translate findings into clear reports for partners.
What is the role of the global SOC?
The global SOC supports cross-region handoffs, allowing analysts to collaborate and ensure continuity in threat response.
