DON PEO MLB

Manager

• Lead MLB's threat intelligence and incident response programs across the League office, the 30 Clubs, and their affiliates
• Own the vulnerability intelligence program and assess real-world risk from vulnerabilities, exploit code, proof-of-concepts, and threat actor weaponization
• Set remediation priorities using severity, exploit intelligence, asset context, and active targeting
• Direct research across OSINT, social media, deep and dark web sources, commercial intelligence platforms, and industry information-sharing groups
• Track threat actors, campaigns, indicators of compromise, and tactics, techniques, and procedures
• Build automation for vulnerability research, intelligence enrichment, alert correlation, investigation support, and reporting
• Convert intelligence into detection content, alert logic, hunt hypotheses, and tuning recommendations using Sigma, YARA, SIEM queries, EDR logic, and detection-as-code practices
• Develop and lead hypothesis-driven threat hunts across endpoint, identity, cloud, network, email, and application telemetry
• Support the incident response lifecycle from triage through closure, including containment, eradication, recovery, and escalation
• Serve as incident commander when on-call and lead incident bridges involving the vSOC, Clubs, Legal, Privacy, Communications, Technology, and other stakeholders
• Lead post-incident reviews, update playbooks and controls, and track corrective actions
• Lead analysts, contractors, vSOC partners, and external security providers
• Own security awareness training, education, and phishing simulation programs
• Plan and lead League-wide, Club, and internal tabletop exercises
• Develop and maintain incident response plans, escalation paths, procedures, and playbooks

Manager, Cyber Threat Intelligence – Response