David Wolf · Portfolio Use Case

AI SECURITY · PRODUCT SECURITY · DISNEY

Disney

IAM SIEM Alert Debugging & Executive Dashboard

A Splunk-based IAM monitoring and executive reporting project across Disney access-control and identity systems for campuses and offices.

Delivered Splunk-focused IAM and SIEM work for Disney, debugging identity and access-control alerts, building a custom Splunk app, and creating executive dashboards across access-control and identity solutions spanning Disney campuses and offices.

Client

Disney

Engagement Type

Role or consulting; exact classification requires confirmation

Period

Career Role; exact dates require confirmation

Role

Splunk / IAM / SIEM / Security Analytics Contributor; exact title requires confirmation

Focus Areas

IAM Alert Debugging, SIEM Alert Debugging, Splunk App Development

The Context

Disney's access-control and identity environment spanned campuses and offices. Security teams needed Splunk-based visibility into IAM and access-control alerts that were operationally meaningful and explainable to leadership.

The Challenge

IAM and access-control alerts are only useful when the signal is trustworthy. Noisy, duplicated, broken, or poorly contextualized alerts create confusion. The work required debugging alert behavior and turning telemetry into clear security views.

What I Did

•Debugged IAM and SIEM alerts across Disney identity and access-control environments
•Analyzed alert behavior from access-control and identity systems spanning Disney campuses and offices
•Identified noisy, broken, misfiring, duplicated, unclear, or low-signal alert conditions
•Built or contributed to a custom Splunk app focused on IAM/security monitoring workflows
•Created Splunk dashboards that translated identity and access-control telemetry into usable operational and executive views
•Helped normalize and organize IAM/security events so teams could understand trends, alert quality, and access-control posture
•Connected low-level SIEM alert debugging to higher-level reporting for security stakeholders and leadership
•Focused on practical security analytics: what is firing, why it is firing, where it is happening, whether the signal is trustworthy, and what leaders need to see
•Worked with security-sensitive access-control data while preserving confidentiality around internal systems, campus details, facilities, and identity infrastructure
•Built experience that later connects directly to Splunk product-security work, Devo SIEM research, Forescout Device Cloud analytics, and AI-driven security evidence systems

The Outcome

This work became an early security-analytics bridge into David's later Splunk, Forescout, and Devo trajectory: normalize telemetry, debug signal quality, build dashboards, and turn security data into operational evidence.

Across

Disney access-control and identity solutions spanning campuses and offices

IAM

And SIEM alert behavior

Contributed to a custom Splunk app for IAM/security monitoring workflows

Executive

Dashboards for identity and access-control security visibility

Key Deliverables

•IAM SIEM alert debugging
•Access-control alert analysis
•Identity-system telemetry review
•Custom Splunk app or Splunk workflow
•Executive security dashboard
•Operational IAM/security dashboard views
•Alert-quality and signal debugging support
•Access-control reporting narrative
•Public-safe portfolio case-study JSON

Collaboration

Worked in a Disney security analytics context where IAM, access-control, SIEM, Splunk, security operations, and executive reporting concerns intersected. Exact stakeholder teams and system names should remain private unless later approved.

At a Glance

Company: Disney
Industry: Media / Entertainment / Enterprise Security / IAM / SIEM
Engagement Type: Role or consulting; exact classification requires confirmation
Role: Splunk / IAM / SIEM / Security Analytics Contributor; exact title requires confirmation
Period: Career Role; exact dates require confirmation
Location: Disney campuses and offices; exact locations intentionally omitted
Asset Type: Company-specific security analytics portfolio use case
Primary Achievement: Debugged IAM/SIEM alerts, built a custom Splunk app, and created executive dashboards across Disney access-control and identity systems
Primary Purpose: Show Splunk engineering, IAM security analytics, SIEM alert debugging, access-control telemetry, and executive security reporting
Public Handling: Public-safe with caveat

Focus Areas

•IAM Alert Debugging
•SIEM Alert Debugging
•Splunk App Development
•Executive Dashboards
•Identity Security
•Access-Control Monitoring
•Physical Access Control
•Campus and Office Security Telemetry
•Security Analytics
•Alert Quality
•Operational Security Reporting
•Enterprise Security Monitoring

Tools & Technologies

•Splunk
•SIEM
•IAM
•Identity and Access Management
•Access Control
•Physical Access Control
•Security Analytics
•Alert Debugging
•Executive Dashboards
•Security Dashboards
•Splunk Apps
•Correlation Searches
•Operational Reporting
•Security Monitoring
•Enterprise Security
•Identity Telemetry

Evidence & Artifacts

•User-provided Disney project clarification
•Splunk/IAM alert debugging narrative
•Custom Splunk app narrative
•Executive dashboard narrative
•Public-safe portfolio summary

Public-Safe Caveat

This case study is based on user-provided project clarification. It intentionally avoids facility details, internal system names, alert logic, source names, campus/office specifics, screenshots, event volumes, and sensitive identity/access-control telemetry.

David Wolf · Portfolio Use CaseAI SECURITY · PRODUCT SECURITY · DISNEY

Disney

IAM SIEM Alert Debugging & Executive Dashboard

A Splunk-based IAM monitoring and executive reporting project across Disney access-control and identity systems for campuses and offices.

Client

Disney

Engagement Type

Role or consulting; exact classification requires confirmation

Period

Career Role; exact dates require confirmation

Role

Splunk / IAM / SIEM / Security Analytics Contributor; exact title requires confirmation

Focus Areas

IAM Alert Debugging, SIEM Alert Debugging, Splunk App Development

The Context

The Challenge

What I Did

•Debugged IAM and SIEM alerts across Disney identity and access-control environments

•Analyzed alert behavior from access-control and identity systems spanning Disney campuses and offices

•Identified noisy, broken, misfiring, duplicated, unclear, or low-signal alert conditions

•Built or contributed to a custom Splunk app focused on IAM/security monitoring workflows

•Created Splunk dashboards that translated identity and access-control telemetry into usable operational and executive views

•Helped normalize and organize IAM/security events so teams could understand trends, alert quality, and access-control posture

•Connected low-level SIEM alert debugging to higher-level reporting for security stakeholders and leadership

•Focused on practical security analytics: what is firing, why it is firing, where it is happening, whether the signal is trustworthy, and what leaders need to see

•Worked with security-sensitive access-control data while preserving confidentiality around internal systems, campus details, facilities, and identity infrastructure

•Built experience that later connects directly to Splunk product-security work, Devo SIEM research, Forescout Device Cloud analytics, and AI-driven security evidence systems

The Outcome

Across

Disney access-control and identity solutions spanning campuses and offices

IAM

And SIEM alert behavior

Contributed to a custom Splunk app for IAM/security monitoring workflows

Executive

Dashboards for identity and access-control security visibility

Key Deliverables

•IAM SIEM alert debugging

•Access-control alert analysis

•Identity-system telemetry review

•Custom Splunk app or Splunk workflow

•Executive security dashboard

•Operational IAM/security dashboard views

•Alert-quality and signal debugging support

•Access-control reporting narrative

•Public-safe portfolio case-study JSON

Collaboration

At a Glance

CompanyDisneyIndustryMedia / Entertainment / Enterprise Security / IAM / SIEMEngagement TypeRole or consulting; exact classification requires confirmationRoleSplunk / IAM / SIEM / Security Analytics Contributor; exact title requires confirmationPeriodCareer Role; exact dates require confirmationLocationDisney campuses and offices; exact locations intentionally omittedAsset TypeCompany-specific security analytics portfolio use casePrimary AchievementDebugged IAM/SIEM alerts, built a custom Splunk app, and created executive dashboards across Disney access-control and identity systemsPrimary PurposeShow Splunk engineering, IAM security analytics, SIEM alert debugging, access-control telemetry, and executive security reportingPublic HandlingPublic-safe with caveat

Focus Areas

•IAM Alert Debugging

•SIEM Alert Debugging

•Splunk App Development

•Executive Dashboards

•Identity Security

•Access-Control Monitoring

•Physical Access Control

•Campus and Office Security Telemetry

•Security Analytics

•Alert Quality

•Operational Security Reporting

•Enterprise Security Monitoring

Tools & Technologies

•Splunk

•SIEM

•IAM

•Identity and Access Management

•Access Control

•Physical Access Control

•Security Analytics

•Alert Debugging

•Executive Dashboards

•Security Dashboards

•Splunk Apps

•Correlation Searches

•Operational Reporting

•Security Monitoring

•Enterprise Security

•Identity Telemetry

Evidence & Artifacts

•User-provided Disney project clarification

•Splunk/IAM alert debugging narrative

•Custom Splunk app narrative

•Executive dashboard narrative

•Public-safe portfolio summary

Public-Safe Caveat

David Wolf

AI Security · Product Security · Security Leadership

davidwolf.com/resumelinkedin.com/in/davidrwolfdavid@aisecurity.llc

Based on analyzed public signals, not proof of any individual's or company's internal state.

IAM SIEM Alert Debugging & Executive Dashboard

A Splunk-based IAM monitoring and executive reporting project across Disney access-control and identity systems for campuses and offices.

The Context

The Challenge

What I Did

•Debugged IAM and SIEM alerts across Disney identity and access-control environments
•Analyzed alert behavior from access-control and identity systems spanning Disney campuses and offices
•Identified noisy, broken, misfiring, duplicated, unclear, or low-signal alert conditions
•Built or contributed to a custom Splunk app focused on IAM/security monitoring workflows
•Created Splunk dashboards that translated identity and access-control telemetry into usable operational and executive views
•Helped normalize and organize IAM/security events so teams could understand trends, alert quality, and access-control posture
•Connected low-level SIEM alert debugging to higher-level reporting for security stakeholders and leadership
•Focused on practical security analytics: what is firing, why it is firing, where it is happening, whether the signal is trustworthy, and what leaders need to see
•Worked with security-sensitive access-control data while preserving confidentiality around internal systems, campus details, facilities, and identity infrastructure
•Built experience that later connects directly to Splunk product-security work, Devo SIEM research, Forescout Device Cloud analytics, and AI-driven security evidence systems

The Outcome

Across

Disney access-control and identity solutions spanning campuses and offices

IAM

And SIEM alert behavior

Contributed to a custom Splunk app for IAM/security monitoring workflows

Executive

Dashboards for identity and access-control security visibility

Key Deliverables

•IAM SIEM alert debugging
•Access-control alert analysis
•Identity-system telemetry review
•Custom Splunk app or Splunk workflow
•Executive security dashboard
•Operational IAM/security dashboard views
•Alert-quality and signal debugging support
•Access-control reporting narrative
•Public-safe portfolio case-study JSON

Collaboration

IAM SIEM Alert Debugging & Executive Dashboard

A Splunk-based IAM monitoring and executive reporting project across Disney access-control and identity systems for campuses and offices.