SOAR platforms and how ML can help is a good topic for you. (Check out siemplify and demisto). No FOSS solutions to date for SOAR! Cheap and good cross-platfor

SOAR platforms and how ML can help is a good topic for you. (Check out siemplify and demisto). No FOSS solutions to date for SOAR! Cheap and good cross-platform endpoint security,reducing and simplifying the overhead of managing endpoint security is also another. Email security is also big but not as popular of a topic (again,no cheap or foss solutions other than a DIY mess you hope management will accept). I am personally interested and working around the area of methodical approaches to blue teaming. MITRE's ATT&CK techniques have laid some basic foundations. Different people or companies basically throw money on an expensive solution(s) and even more expensive staff and basically put forth a best effort use of tools and skills,which isn't bad but even with good threat modelling,attackers will still find a way and typically you just throw darts in the dark or use buest guess (or popular trends). Methodically defining attacker techniques against your specific environment,threat hunting based on attacker techniques,continually updating your tools+skills+processes will allow for measurable increase in maturity and actual ability to find and respond to attacks. Like it or not,the biggest gaps in security are architectural,process and managerial in nature. But I hope the more technical ideas I mentioned helps, there are also other trendy things like "zero trust". As a dev and admin you should definetly look at SOAR and challenges around collecting and storing very high volume of logs efficiently and cheaply.