Raymond Depalma

WORK HISTORY

EDUCATION

SKILLS

ABOUT RAYMOND DEPALMA

I build AI-driven tools for incident response and run an open-source AI/ML security training program for practitioners who want to build their own tools. Currently on Unit 42\'s Engineering Team at Palo Alto Networks, where I design and deploy scalable solutions that empower consultants and clients during critical cybersecurity incidents. Using LLMs, multi-agent architectures (Google ADK), automation, and data science to accelerate investigations, enhance threat hunting, and strengthen cyber resilience across cloud, endpoint, SASE, and enterprise environments. My work spans detection engineering, AI/ML security analytics, and big-data analysis of zero-day threats — including case leadership and digital forensics for edge-device zero-day incidents.I also teach.\"AI for the Win,\" my open-source AI/ML security training program, offers 50+ hands-on labs and CTF challenges for security practitioners learning to build AI/ML tools for threat detection and IR: github.com/depalmar/ai_for_the_win. I\'m a featured speaker on the SANS \"Stay Ahead of Ransomware\" series hosted by Ryan Chapman.I also build and release open-source tools — including an AI-Powered Ransomware Intelligence Agent that automates threat research and reporting using LLMs and multi-agent workflows: github.com/depalmar/AI-Powered-Ransomware-Intelligence-Agent\"A lot of talented responders are sitting on the sidelines of AI because nobody showed them the on-ramp. If you can write a detection rule, you can learn to work with an LLM. The gap is smaller than people think.\"13+ years — starting at MIT Lincoln Laboratory with a DoD Top Secret clearance, then Liberty Mutual (founding SOC member), IBM, Rapid7, and nearly 5 years at Palo Alto Networks across four roles: Cortex Systems Engineer → XDR Solutions Architect → Principal DFIR Consultant → Principal DFIR Technical Architect. Current focus:AI agents for autonomous security operationsLLM + MCP integration for DFIR workflowsBig data analysis of zero-day threatsDetection-as-Code at enterprise scaleMaking AI/ML accessible to the security communityDM me if you\'re building AI for security, working in DFIR, or want to compare notes on zero-day threat analysis.