Operational clarity without losing technical depth.
Company / project
Hackone
My role
UI/UX Designer
Duration
3 months
Responsibilities
Research, information organization and interface design.
SecurityOne is Hackone’s security operations platform. It brings together tools to detect, investigate and respond to incidents.
The challenge
Organize information from disconnected tools for analysts and leadership. With the product already defined, I focused on research, information hierarchy and interface design.
01 / The problem
The tools exist. The context is scattered.
Before
Separate tools. Context assembled by the analyst.
The analyst switches between tools to understand the alert, gather evidence and decide how to respond.
SIEMSignals and alerts
What happened?→
SOARPlaybooks and automation
How do we respond?→
DFIR / ITSMEvidence and incidents
What has been done?→
Manual context
The analyst has to connect the dots.Cross-check alerts. Gather evidence. Reconstruct the history.
In practice
01
Investigation meant switching tools.
Alerts and evidence were on different screens. Gathering context required manual work.
02
Incident response needed to continue across shifts.
Analysts needed shared access to evidence, tasks and next steps.
03
Leadership needed to see the value.
Leadership needed clear dashboards to follow risks and priorities.
After / With SecurityOne
One incident.The whole context.
Signals, evidence and actions connected in one shared experience to investigate, respond and monitor.
SIEM
SOAR
DFIR / ITSM
SecurityOne
Investigate
Respond
Monitor
02 / My contribution
From a defined model to a clearer experience.
01
Research
I researched security product references to guide information organization and screen design.
02
Information hierarchy
I organized indicators, filters and tables by task: monitor risk, investigate and inspect details.
03
Interface design
I designed a shared experience for different tools while preserving technical detail.
Wireframes
How information is organized on each screen.
03 / Interface decisions
Less effort to understand. More context to act.
01
Start with severity.
Risk level and alerts appear first to guide where analysis should begin.
02
Bring operations together without flattening information.
Monitoring, integrations and vulnerabilities have dedicated views within the same navigation.
03
Create a shared visual language.
Filters, severity and states follow shared patterns to support orientation across screens.
04 / Identity and system
Identity and hierarchy for security intelligence.
The symbol, risk indicators and components connect the visual identity to the platform experience.
05 / Operational views
Operations from different perspectives.
Management, monitoring and vulnerability views make it possible to inspect details while keeping the big picture.
06 / The product logic
A SOC connected to the tools the team uses.
The product connects detection, response and incident management. Evidence and tasks support operations; dashboards provide visibility for leadership.
SIEM
Detection and correlation
SOAR
Playbooks and automation
DFIR / ITSM
Evidence and continuity
Dashboards
Executive visibility
A ready foundation.
Modules, dashboards and initial playbooks support operations.
Room for each operation.
Integrations, filters and playbooks adapt to each client, supported by setup and training.
07 / What the design delivers
Connected context.
Dashboards and investigation screens bring together risk, incidents and vulnerabilities.
Visible priorities.
Severity, volume and status in focus to support triage.
A shared view.
Consistent components and states across modules and light and dark themes.
08 / Conclusion
Design makes complex operations easier to understand.
I turned a defined product model into interfaces for analysts and leadership. The next evaluation step would be testing real tasks and measuring triage and shift continuity.
SecurityOne
Investigate
Respond
Monitor
