John Schoonover
Director of Engineering
Visionary Director of Engineering, named inventor on a published U.S. patent application and a second in-flight filing, with 8+ years in cybersecurity and 4+ years leading high-performing engineering teams across enterprise-scale environments. Recognized for designing scalable architectural patterns that support rapid adaptation in fast-evolving threat landscapes. Adept at aligning security engineering initiatives with organizational detection, response, and risk reduction objectives. Proven track record of building resilient platforms, empowering talent, and evolving infrastructure to accelerate cyber agility and operational excellence across the Cyber Fusion Center (CFC).
Based in Minnesota, USA. Hosting theschoonover.net from a hybrid infrastructure of multiple self-hosted servers and cloud-native providers.
This site is AI-built and human-reviewed.
You'll also find active prototypes and instrumentation tooling on GitHub — including SecurityOnion & Wazuh configs, Forgejo workflows, and IaC automations.
Current focus area
Security telemetry platform: ingestion, enrichment, storage, and access.
Current focus area
Scalable architectural patterns for fast-changing threat landscapes.
Current focus area
Alignment of detection, response, and risk reduction objectives.
Current focus area
Integrated workflows with incident response, detection engineering, and threat intel.
Current focus area
Infrastructure modernization across cloud and on-prem environments.
Current focus area
Mentorship that raises standards and eliminates single points of failure.
Strategic programs delivered end-to-end.
Case Studies Guardrails
Internal contributor instructions for managing the case studies content collection.
Explore →SIEM at Planetary Scale
Transformed a fragmented monitoring estate into a unified observability fabric with sub-second insights.
Explore →Multi-SIEM Migration Safeguards
Replaced fragmented legacy SIEMs with a unified, automated ingestion framework, reducing onboarding time by 99%.
Explore →Operating at the intersection of platform engineering and cyber command.
Platform rigor, actionable telemetry, and clear storytelling keep teams aligned on the work that matters.
Current focus
Key themes include Lead a multidisciplinary engineering team delivering the core security telemetry platform end to end. and Architect scalable patterns that adapt to evolving threats while aligning detection, response, and risk objectives..
-
Present
Director of Engineering - Cybersecurity - SIEM
Current remit
- • Security telemetry platform: ingestion, enrichment, storage, and access.
- • Scalable architectural patterns for fast-changing threat landscapes.
- • Alignment of detection, response, and risk reduction objectives.
-
Looking ahead
Where the work is heading
Objectives
- • Broaden scope across Cyber Fusion Center (CFC) engineering
- • Mentor teams to uphold high standards and ship resilient security outcomes
Latest thinking on security platforms.
Defeating the Sieve Part 2: The Mod 3 Trap
In Part 1, we discovered that prime sums have 'Shields'—mathematical armor that blocks divisibility. But when I stress-tested the theory against 100 Billion primes, I found the opposite of a shield. I found a trap.
Read →Defeating the Sieve: The Mathematics of the "Shielded" Prime
We are taught that prime numbers are the noise of the number line—unpredictable, chaotic, and governed only by probabilistic density. But if you stop looking at individual primes and start looking at their sums, a rigid structure emerges from the chaos.
Read →Protecting resilient SIEM coverage and signal fidelity.
Published Application · US 2026/0277770 A1
Systems and Methods for Anomaly Alerting for Data Feeds
Checks every event log in a data feed against its expected schema, stores the field errors alongside the event, and alerts when a feed's compliance drifts from its own historical baseline, so detections don't quietly lose the fields they depend on.
Patent In-Flight
Criticality-Aware Drop Control for High-Throughput SIEM Pipelines
Maintains propagation of rare, high-value security events while managing volume through context-aware drop controls.
Ready to compare notes on SIEM strategy?
Let's align on outcomes, cut through operational noise, and deliver measurable resilience.
Prefer to review build logs first? Visit the GitHub profile for prototypes covering telemetry automation, lab infrastructure, and AI-assisted investigations.