October 14, 2026
Webinar
How to ship SecOps changes like software
CLEAR’s John Port shares how his team went from taking weeks to ship a detection to shipping one in under an hour.
Gal Shafir, Fig’s Co-Founder and CEO, sat down with John Port, Senior Detection Engineer at Clear, to talk about what it really takes to run SecOps as code, and why detection as code alone was never enough.
What this webinar covers
John Port, Senior Detection Engineer at CLEAR, joins Fig Co-founder and CEO Gal Shafir to talk about adopting SecOps as code. He covers why his team made the move, what changed in their day-to-day work, and where to start if you’re doing it yourself.
- Version more than your detections. Detections themselves don’t need to change to break. That can also happen when a vendor changes its log schema or your SIEM changes a parser field. SecOps as code extends versioning and rollback to parsers, dashboards and response playbooks.
- Let AI write, then check with code. AI is at its best when the work has a right and a wrong answer. CLEAR runs automated checks like linting on every change, and that’s how they ship a detection to production in under an hour instead of weeks.
- Start with a repo and an API. Ask a software engineer which tools your org already uses. Then set up a repository and pull your rules through your SIEM’s API. Once you have a solid base, then progressively layer in more functionality, automation and dedicated tooling.
