Building an Agentic SOC with Jaime Guimera Coll

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

How do AI agents catch an attack that stays below every alert threshold? Jaime Guimera Coll, Microsoft Security MVP and security and AI architect at BlueVoyant, shares how he builds agentic SOC workflows that triage, investigate and correlate alerts across customer tenants.

In this episode

• How an agent correlated a low-severity brute force across tenants and found the one customer that was actually compromised
• Why the agent is "just the brain": tools live in an orchestrator with code-enforced guardrails, budgets and full transparency
• Where the human still decides, and why agents do not take response actions in production today
• Testing SOC agents against real analyst outcomes and comparing models on speed, cost and quality
• Surprising agent behaviour, including an agent that used the KQL externaldata operator to fetch internet data through Sentinel
• What data reaches the model, and why enterprise instances in Microsoft Foundry change the picture
• Security Copilot versus Project Perception, and Jaime's own Security Copilot MCP server
• What SOC managers should train their analysts on, and advice for analysts worried about their jobs

Chapters

00:00 Welcome and introductions

01:24 From developer to security founder

07:46 Agentic workflows in the SOC

11:48 Catching a slow cross-tenant brute force

16:29 Transparency and human decisions

20:11 Will AI replace SOC analysts?

25:11 Testing SOC agents for production

32:59 Model choice and data privacy

35:57 Security Copilot vs Project Perception

42:25 Daily AI use, rapid fire and advice

Guest: Jaime Guimera Coll – Security and AI Architect at BlueVoyant, Microsoft Security MVP

Hosts: Frans Oudendorp & Pouyan Khabazi

Watch on YouTube: https://youtu.be/flnWzcKx0D8

More episodes: https://talkingsecurity.nl