One design system across three security products

Exabeam's traction came from Advanced Analytics, a machine-learning behavioral analytics tool. The logs product was in its infancy and Incident Response hadn't shipped. Together the three formed a SIEM platform — and they didn't look or behave like one product.

I joined as the first product design lead, as the team began introducing a scalable pattern library and platform-wide journey maps to close the gaps. The goal was a design system consistent across every product and flow, and extensible according to the principles we'd set.

RoleFirst product design lead

ProductsAdvanced Analytics, logs, Incident Response

UsersSecurity analysts and incident responders

What I shippedFour workstreams

Research Customer interviews, solution research, and an audit of the existing platform against accumulated user feedback.

Planning User stories mapped per roadmap initiative — asset timelines, for instance, letting analysts monitor risky assets and not only risky users.

Playbook builder A UI system for Incident Response's logic-driven playbook builder, so automation could take remediation work off analysts — and so developers could customize the visual framework they built on.

Style guide Master style guides and searchable component libraries, so the team could assemble high-fidelity work fast without drifting apart across products.

Original — asset activity header, lo-fi

Redesigned activity header

Lo-fi component map

Playbook builder

Chart system

Style guide and component library

Takeaway

The most transferable work here was the chart system. Deciding how to label axes, when a legend earns its space, what a tooltip owes the reader, and how a view holds up at different zoom levels over time — that is where a security product either becomes readable under pressure or doesn't.

← All work Next — About →

Click anywhere or press Esc to close