Mike Cyze

Built an agentic threat-hunting prototype for real analyst workflows: retrieval, self-reflection loops, DuckDB, Neo4j, and a Bun API layer. The goal was practical: learn where AI helps an analyst and where product design still has to do the work.

Built MCP integrations that connect Claude, ChatGPT, and Microsoft Security Copilot to Core TDR security telemetry. The same foundation powers alert summaries that tie detections to MITRE ATT&CK and make AI feel native to the product.

Shaped OpenText Core TDR around analyst workflow: behavioural detections, evidence, and LLM summaries as one investigation experience instead of stacked features. Worked from product concept through Figma and implementation detail.

Designed the extensibility model for customer-built AI apps on Core TDR: skills, plugins, and API boundaries for workflows we could not predict. Product strategy, platform design, and developer experience in one problem.

Designed an investigation UI for following relationships between users, machines, and accounts instead of triaging a flat alert queue. The interface became a granted U.S. design patent.

Built Figma plugins that pulled real product data into the design canvas. Teams used them to generate test variants, validate designs against realistic volumes, and get analyst feedback faster.

Co-invented a serverless search platform for billions of security records. It was narrower than the Elasticsearch system it replaced, roughly 90% cheaper to run, and better matched to the product problem. Now deployed in OpenText Core TDR.

Redesigned ArcSight Intelligence around how SOC analysts investigate: ingest, search, evidence, and visualization. A workflow reset, not a cosmetic reskin.

Invented Stories at Interset: threat narratives that grouped related anomalies into one investigation instead of a list of alerts. That framing later carried into ArcSight Intelligence and OpenText Core TDR.

Patents: USD1118634S1 (GUI), US20250126144A1 and US20250124136A1 (entity-and-risk model).

Invented a visual language for UEBA risk: a heatmap view that also worked as a filter. Analysts could triage thousands of users, drill into anomalies, and understand ML findings without staring at a score.

Designed and built the front-end architecture for Interset’s UEBA product while the analyst workflow was still being invented. The UI paired ML risk scores with the evidence analysts needed to trust them. The product later became ArcSight Intelligence.

Rebuilt IBM ManyEyes as a product reset: new codebase, new UI, and a cleaner model for publishing and exploring charts in the browser. Designed the experience and wrote front-end and back-end code.

Built mobile Cognos reporting across Symbian, BlackBerry, Windows Mobile, and mobile Safari before enterprise mobile had a playbook. Designed the UX end to end; the work earned IBM’s Outstanding Technical Achievement award.

Built the platform layer for the next generation of Cognos products: provisioning, software management, and live OSGi services. Also prototyped two administration consoles, one Ajax and one Eclipse RCP.

Built front-end product flows for Hemera’s stock-imagery storefront: browse, preview, license, buy.

Implemented HP Bluestone container-managed persistence inside TopLink, WebGain’s J2EE persistence product.

Owned internationalization for Nortel’s J2EE application platform, including Traditional Chinese support for Taiwan.

Built a browser GIS tool for remote mining sites over a radio link. ESRI ArcIMS mapped the data, Oracle stored it, Java ran the back end, JavaScript ran the browser, and Perl filled the gaps.

Ran airborne and ground geophysical surveys for diamond exploration across northern Canada, then processed the data. Wrote enough C and Perl to keep the field tooling moving.