About

Jeremy Wiley

Cybersecurity architect and data scientist focused on security data architecture and emerging-tech research. The opinions on this site come from operating these platforms in production, and from a research portfolio where I keep the contradictions on the record whenever new evidence overturned a position I held.

Why this practice exists.

Most security data programs trust their vendors, their schemas, and their own past assumptions. I think the data platform should have to earn that trust empirically, source by source, claim by claim, query by query, and keep earning it after the procurement decision, too. That is why this is a single-practitioner fair-broker practice instead of a reseller or a staff-aug shop, with no reseller margins, no vendor-paid placements, open methodology, and an outside review of the benchmark results once a reviewer is confirmed. The disclosures below are the structural commitments that hold me to those words, and the longer argument is on the thesis page.

I built the practice around the fair-broker constraint because a senior practitioner billed by the hour to extend a vendor's services arm can't give a vendor-neutral recommendation, since the incentive is to keep the engagement running. So when the practice took paid work it was fixed-price, scoped, and evidence-gated.

I'm not taking engagements while I work full-time, so for now Security Data Works is research and publications only. The research notebook, the lab, the Capability Matrix, the essays and the book carry on, and they're free to use. The engagements page stays up as a record of how that work was scoped.

Practitioner depth.

Twenty-five years across military service, intelligence-community analytics, and security data engineering. Since August 2026 I've worked full-time at Newell Brands on security architecture for enterprise AI adoption. Before that came an embedded resident-engineer assignment with a Tier-1 financial-services security-data team, via Corelight, doing production reference-architecture work for a regulated environment.

• Newell Brands. Senior Cyber Security Specialist, AI Security Engineer (Architect), since August 2026, working on security architecture and governance for how a large enterprise adopts AI assistants and agents.
• Corelight. Professional Services Engineer, building international customer reference architectures. This is where the Data Health Check and Data Health Enablement methodologies behind the data-health work on this site were shipped.
• Southern Company. Senior Security Architect and Security Data Scientist on a regulated OT environment.
• Accenture. SIEM migrations in regulated environments.

The pattern across Corelight, Southern Company and Accenture is the same: large, regulated, multi-source security data, where the cost of a wrong architecture decision compounds quietly for years before anyone names it.

Contributor to OCSF (the open schema standard) and MITRE D3FEND (ATLAS-technique mappings, two merged upstream in 2026 and more under review), both of which show up directly in the recommendations this practice makes. When new data overturned a position I'd published, the contradiction stays documented, and that update history is public on the research page.

U.S. Marine Corps veteran. Atlanta Metro.

I wrote Modular Open Architecture (MOAR) for Cybersecurity Data; the manuscript is complete and in production for Amazon KDP.