Raymond DePalma

Raymond's career in cybersecurity began at MIT Lincoln Laboratory, where he completed three rotations over a year and a half, progressing from the Security Service Department to the Forensic Analysis Center and ultimately to IT Security Threat Assessment, all while holding a Department of Defense Top Secret security clearance. Those early rotations immersed him in digital forensic acquisition, open-source threat research, and compliance auditing against NISPOM and NIST standards, setting the trajectory for everything that followed.

After earning his Bachelor of Science from Northeastern University, Raymond joined Liberty Mutual Insurance, where he spent nearly four years rising through three progressively senior roles on the SOC Tier III team. Starting as an IT Analyst, he advanced to Information Security Analyst, then to Senior Information Security Analyst, and ultimately served as a Lead Responder on the company's global LSERT. He drove cyber threat-hunting initiatives, delivered incident response demonstrations to C-level executives, and developed training sessions and threat exercises for SOC analysts. He eventually moved into the role of Principal SIEM Security Engineer, serving as tech lead of a five-person SIEM detection engineering team and driving the adoption and scaling of Splunk Enterprise Security across the organization.

"I've always been drawn to the engineering side of security, not just detecting threats, but building the systems that make detection faster, smarter, and more scalable," Raymond explains. "That mindset has shaped my entire career: the most effective security organizations are the ones that build resilient infrastructure and tooling, invest in their people, and focus not just on putting out fires, but preventing them."

After a stint at IBM as a Security Delivery Project Executive managing multiple workstreams for Managed Security Services, Raymond joined Rapid7 as a Senior Security Solutions Engineer, serving as a technical advisor across SIEM, SOAR, and MDR platforms while developing SOAR training material for the broader engineering organization.

Raymond joined Palo Alto Networks in 2021 and has spent nearly five years advancing through four increasingly impactful roles. He began as a Cortex Systems Engineer focused on healthcare, leading hands-on XSOAR workshops for over 60 attendees and delivering enablement briefings on Log Management and SIEM solutions. As an XDR Solutions Architect, he worked directly with Unit 42 to develop XQL queries, conducted adversary emulation using MITRE Caldera and breach assessment and attack simulation (BAS) platforms, and provided field training in incident response, threat hunting, and threat emulation. Moving to Unit 42 as a Principal DFIR Consultant, he led incident response and security posture assessments for Fortune 500 and Global 2000 companies across finance, technology, healthcare, and aerospace while simultaneously developing innovative data analysis dashboards, driving detection engineering and big data assessments, and hosting regular product office hours covering XSIAM and XDR. He then transitioned to the role of Principal DFIR Technical Architect, where he now focuses full-time on designing AI-integrated solutions, including multi-agent architectures and tooling built on frameworks like Google's Agent Development Kit, that accelerate investigations and strengthen cyber resilience at scale.

With Raymond, it's always been about building, not just using the tools, but making them better for everyone around him. His current passion sits squarely at the intersection of artificial intelligence and incident response. He is developing "AI for the Win," an open-source cybersecurity training repository featuring comprehensive labs and Capture the Flag challenges designed to help security practitioners integrate AI and machine learning into their daily work.

"A lot of talented responders are sitting on the sidelines of AI because nobody showed them the on-ramp," he says. "My goal is to demystify it. If you can write a detection rule, you can learn to work with an LLM. The gap is smaller than people think."

Raymond's thought leadership extends beyond Palo Alto Networks. He is a featured guest on the SANS Stay Ahead of Ransomware livestream series hosted by SANS instructor andFOR528 author Ryan Chapman, where he discusses how organizations can leverage AI to defend against evolving ransomware and cyber-extortion threats. His appearance on the series underscores his growing reputation as a practitioner who bridges the gap between cutting-edge AI capabilities and the operational realities of incident response.

"AI doesn't replace expertise, it amplifies it," Raymond explains. "The knowledge was always there; AI just compresses the time it takes to apply it at scale."

When he's not building AI-driven security tooling, Raymond can be found in New Hampshire with his red golden retriever, Cooper, and an ever-evolving home lab that keeps him just as busy as his day job.

Qualifications Summary

• 13+ years of experience spanning digital forensics, SOC operations, SIEM engineering, incident response, solutions architecture, and DFIR innovation
• Principal DFIR Technical Architect with Unit 42's Engineering Team at Palo Alto Networks
• Nearly 5 years at Palo Alto Networks, advancing through four roles from Cortex Systems Engineer to Principal DFIR Technical Architect
• Led incident response and security posture assessments for Fortune 500 and Global2000 companies across finance, technology, healthcare, and aerospace
• Featured guest on the SANS Stay Ahead of Ransomware livestream series, discussing AI-driven defense strategies against ransomware and cyber extortion
• Specializes in LLM integration, multi-agent system architectures, and AI-driven automation for DFIR workflows
• Developer of innovative data analysis dashboards, detection engineering initiatives, and AI-integrated investigation tooling leveraging Palo Alto XSIAM, XDR, XSOAR, and NGFW platforms
• Creator of "AI for the Win," an open-source cybersecurity training repository with labs and CTF challenges for AI/ML integration in security operations
• Hands-on expertise across 15+ security platforms, including CrowdStrike Falcon, Splunk Enterprise Security, Microsoft Defender XDR, Sentinel, and Google Chronicle
• Former Department of Defense Top Secret security clearance holder (MIT Lincoln Laboratory)
• GIAC Certified Penetration Tester (GPEN), 2022-GIAC Certified Incident Handler (GCIH), 2014
• Northeastern University, Bachelor of Science, Criminal Justice, 2014-Committed to continuous professional development through advanced training in attack emulation, cloud security, forensics, threat hunting, and SIEM/SOAR platforms