Work · Schneider Electric · May 2022 to date
Building a 24×7 OT security operations practice
I joined Schneider Electric's managed security practice when it served a single customer. I led its detection and response work, and since July 2025 I run it as General Manager.
- 1 → 9enterprise contracts
- 8 → 30people, zero attrition in the past year
- 95%+SLA compliance, sustained
The problem
Industrial customers in energy, manufacturing and utilities need someone watching their IT and OT networks around the clock, who understands that a plant cannot simply be switched off to contain an incident. The practice had to grow from one customer to many without losing that care, and without the cost of running it growing as fast as the contracts.
What I did
- Three service lines. Managed detection and response, asset visibility and vulnerability management, and cybersecurity controls management, each with its own service description, SLAs and governance with the customer.
- A delivery model. Delivery concentrated in India, with small in-region teams in France and the US only where data sovereignty or regulation requires them.
- The team. Grew it from seven or eight people to thirty, set the goal framework across all service lines, and built promotion paths that have moved several analysts into senior and lead roles.
- The operating baseline. Wrote the SOC playbooks, escalation procedures and documentation the practice still runs on, and brought ticketing and reporting onto one platform (ServiceNow ITSM and SecOps).
- Capacity and cost-to-serve. Built a model of the team's work in six buckets, with MDR demand by touch time and shift, that shows how many more customers the team can absorb and what each service line costs to run.
- Certification. Led ISO 27001:2022 certification for the Bangalore and Grenoble operations through Phase 1 and Phase 2 audits.
- Automation. Python-automated reporting, SOAR playbooks, and KPI dashboards that replace manual slide decks.
What it taught me
- Price is what the customer pays; cost-to-serve is what the team controls. Automation is how a practice grows its margin without raising its price.
- Every report to a customer should answer two questions: what risk did we close, and what visibility did we gain.
Described at the level of my public CV. No customer, commercial or confidential detail is published here.