Robert Drysdale
Enterprise cyber defense at Dow, in Michigan. I work on the detections, controls, and automation a security operations center runs on — and take incident command when something gets through.
Currently
Where this is heading is security engineering and architecture — the design side rather than the operating side. Two strands right now: operational technology, and cloud, since that is where most of what I would be designing already lives.
On the OT side the pull is less the technology than the people. I want to understand a manufacturing environment well enough to be useful to the people who run one. Dow is sponsoring the coursework, and I have written up some of what I am unlearning.
- GICSP — GIAC’s industrial control systems credential. Exam planned November 2026.
- CCSP — ISC2’s cloud security credential. Exam planned February 2027.
Selected work
A few things I have built, written up with the reasoning left in. A resume can tell you the outcome; this is the part that shows the work.
- A forensics and research lab, off the corporate network
Why a SOC needs somewhere to work that isn't the enterprise network, what I built, and the three things I would do differently if I built it again.
Writing
Shorter and less settled than the writeups above: detection engineering, incident response, notes from the move toward operational technology, and occasionally something that is not about work at all.