Jacques Reynaud

Security teams are hitting the limits of traditional SIEM architecture. Rising ingestion costs, fragmented telemetry and brittle detections force tradeoffs between visibility and budget. This session outlines a practical, phased path from SIEM-centric operations to lakehouse-driven security analytics. We will explain how SOC teams have cut costs and boosted performance by offloading telemetry from legacy SIEMs to Databricks, without breaking detections. We’ll also show how security teams run and correlate detections natively across their data sources, and use AI agents to automate detection engineering, tuning, and triage while reducing noise and vendor lock-in. Attendees will leave with a clear roadmap to building a modern, AI-driven SOC on Databricks, and how they can unlock broader detection coverage, lower costs at scale, improved triage efficiency and a realistic path to full SIEM replacement.