Tines' Matt Muller on AI-Assisted Security Operations and Modernizing the SOC

Matt Muller, Field CISO at Tines, knows all about revolutionizing security operations through strategic AI integration and intelligent automation. In his conversation with Jack, Matt explores how traditional SOC models create problematic feedback loops where junior analysts make critical decisions while senior practitioners handle escalations, limiting learning and growth opportunities.

Instead, Matt envisions AI-assisted workflows where senior expertise gets encoded into intelligent systems that teach junior team members while they work, transforming security operations from reactive alert-chasing to proactive strategic defense. He also emphasizes communication skills, relationship building, and moving beyond being perceived as the team of no to become strategic enablers.

Topics discussed:

• Evolution from banning ChatGPT to strategic AI integration in security operations, emphasizing augmentation over replacement strategies.

• Model Context Protocol implementation challenges and the importance of safe-by-default approaches when integrating emerging AI technologies into production.

• Traditional SOC tier models create problematic feedback loops where junior analysts make critical decisions but lack learning opportunities.

• AI-assisted workflows can transform security operations by encoding senior expertise into systems that teach while automating routine tasks.

• Practical approaches to AI adoption including demystification techniques, validation methods, and breaking complex problems into manageable components.

• Strategic implementation of AI agents in security workflows, particularly for non-deterministic tasks like phishing investigation and alert triage.

• Importance of maintaining human oversight and guardrails when deploying AI systems in critical security operations and incident response.

• Communication skills and relationship building as fundamental competencies for security practitioners working with both AI systems and human stakeholders.

• Safe experimentation with AI technologies through controlled environments and understanding system limitations before production deployment.