Cloud Security Intelligence
and Remediation Platform

Cloud security findings were being generated across multiple environments, but identifying and acting on them wasn't straightforward.

In GCP, Security Command Center provided extensive security findings, but those findings largely remained within the cloud environment. Teams needed a consolidated way to understand their security posture, identify affected resources, establish ownership and determine who was responsible for remediation.

Ownership information was another challenge. Project ownership, application responsibility, SRE teams and business classifications weren't consistently available. For approximately 900 existing GCP projects, ownership had to be investigated and reconstructed by working with SRE teams and relevant stakeholders.

I architected and built a multi-cloud security intelligence and remediation platform, bringing together security findings, ownership information, dashboards, alerting and incident management.

The solution provided a common operational view of security issues while accommodating the different security data sources and integration mechanisms across cloud providers.

Before security findings could be routed to the right people, we needed reliable ownership information. I established an ownership model integrated with the existing cloud governance process.

This established a reusable ownership foundation that could support security operations and other governance integrations.

The platform supported different ingestion mechanisms depending on the cloud provider.

For GCP, I used Security Command Center's native export to make findings available in BigQuery. I configured BigQuery as a Grafana data source, authenticated through a dedicated service account, and developed SQL queries to report on the findings.

That path was Security Command Center, then BigQuery, Grafana, alerts and PagerDuty. It gave direct access to the findings for reporting and alerting without a separate ingestion service for GCP.

For the other cloud environments, I developed Python-based processing to collect security notification data and prepare it for reporting. The application populated the reporting data source consumed by Grafana, and separately handled the operational alerting and incident-management workflow.

This allowed the platform to accommodate different cloud security integrations without forcing every provider into the same ingestion architecture.

I built Grafana dashboards to provide a consolidated view of security findings and their organizational context.

Rather than limiting the dashboards to total finding counts, I designed multiple panels to help teams understand where security issues existed and who was responsible for addressing them.

The detailed findings view was particularly important. Users could move from a high-level security overview to an individual finding and understand both the affected resource and the team responsible for it.

A major design consideration was avoiding alert fatigue.

Automatically creating an incident for every security finding would have generated unnecessary noise and overwhelmed operational teams. Instead, I introduced a prioritization approach.

We initially generated reports to understand the findings, evaluate their impact and determine appropriate grouping and severity-based handling rules. The resulting approach distinguished between findings that required governance visibility and those that needed direct remediation.

For GCP, Grafana alert rules were integrated directly with PagerDuty, allowing relevant security alerts to reach operational teams.

For the other cloud providers, I built a Python application layer responsible for alerting, notifications and ServiceNow incident creation. The application performed daily scans, applied filtering and prioritization rules, and routed incidents according to the responsible ownership and assignment groups.

Observation-level findings were communicated to the governance team. Critical and High findings were routed to the responsible owner teams for remediation.

I also implemented duplicate-incident prevention. When an existing finding resurfaced during a subsequent scan, the system updated the existing incident's notes rather than creating another incident. This preserved recurrence information while preventing unnecessary ticket duplication.

I architected and built the platform, taking responsibility for the solution design and implementation.

The platform connected security findings with the organizational information required to act on them.

Instead of security findings remaining isolated within individual cloud environments, teams gained a consolidated view of security issues, resource ownership and remediation responsibility.

It also introduced a more deliberate approach to security operations: prioritizing findings, routing them to the right teams, reducing duplicate incidents and making recurring issues visible.

The central idea was simple: identifying a security problem is only the beginning. The real value comes from knowing who owns it and making sure it gets addressed.