I began with a comprehensive audit of the existing platform, identifying redundancies in navigation, filtering, and system structure. This revealed that much of the friction came not from the data itself, but from how it was organized and accessed. From there, I restructured the information architecture to support multi-tenant workflows under a single system. Instead of organizing around legacy structures, the experience was aligned to key workflows and information types, such as environment and threat source, making it easier for analysts to move between accounts and investigations without losing context. In parallel, I focused on how to present complex security information to non-technical users without overwhelming them. This involved prioritizing key signals, simplifying language, and designing role-based dashboards that surfaced only the most relevant information for each audience. Instead of exposing raw data, the experience emphasized clarity — helping users quickly understand what was happening, what required attention, and how to interpret system activity without needing deep domain expertise. To support scale, I introduced interaction patterns that allowed actions to be applied across multiple accounts at once. One of the most impactful features was the ability to bulk apply rules across hundreds of customer environments, significantly improving efficiency and reducing the risk of user error. Throughout the process, I used a mix of rapid, low-fidelity, and high-fidelity prototypes and detailed interaction documentation to communicate system behavior clearly to engineering, ensuring that complex workflows could be implemented accurately.