ECHO

Iron Link Intel's OSINT operator terminal, rebuilt around one diagnosis. The data was never missing. The analyst was doing the reading. A federal operator then cleared a hard target in 11 minutes.

Role
Lead Product Designer · Brand & Product
Year
2025-2026
Duration
Ongoing
Tools
Figma · Cursor · Next.js

The Brand

  • Before: a contractor homepage. Gold emblem, defense stock, a demo button.
  • After: black hero, display headline, one claim.

Three days, four tools, one answer.

42B+records indexed across 200+ cross-referenced data sources.Iron Link Intel platform (public)
  • Twelve tabs per analystContext rebuilt by hand at every switch.
  • The outward faceACI Agility, gold seal, Forged by Defense. Then Architecture of Certainty.

The Audit

47 → 86

I scored whether an operator could see what mattered. Same method before and after.

The rebuilt overview: grayscale at rest, labelled navigation, a focal threat trend and tier-badged feed rows.

Why 47Before → after

  • Analytics3584

    Help users recognize, diagnose, and recover from errors

    Dead-end charts. An operator could see a spike but never reach the incidents behind it.

    Every chart links to the incidents behind it.

  • High-risk personnel4287

    Flexibility and efficiency of use

    A dense, undifferentiated table that was slow to scan under time pressure.

    Triage stack with Critical / Elevated / Guarded badges, pinned rows, and facet filters.

  • Dashboard navigation5590

    Recognition rather than recall

    Twelve top-level tabs with unlabeled icons forced operators to recall where each surface lived.

    Collapsible icon-plus-label sidebar with status badges. Destinations are recognized, not memorized.

Nielsen heuristic evaluation on seven operator surfaces.

Monochrome

The board stays grey until a human is needed. Red is that decision.

  • Live Overview.

The Terminal

"Geospatial Reconnaissance" agents instantly detected the threat and auto-routed the live feed.

  • Live feed.
  • Threat map.

Investigations and Reports live in the terminal, not as tabs inside Overview.

  • Pinned case file. Records open beside it.
  • Draft, in review, published.

The Outcome.

An identity used to take three days and four apps. I moved correlation into the agents and the recon apps onto one surface. A federal operator then cleared a hard target in 11 minutes. Copilot stays grey until a threshold needs a human.

The System

1,028 → 0raw hex in product CSS.

echo-lint fails the build when a raw hex reappears.

Shipped engagement: audit, design system, operator terminal. I rebuilt this runnable case, the token migration, and the responsive range on synthetic data.

  1. BRAND & INVESTIGATION TERMINAL

    The "Architecture of Certainty" identity and the unified operator terminal: overview, identity finder, SOCMINT, threat monitor, dark web index, and evidence reports on one surface.

    A single operational cycle (ingest, correlate, report) replacing a fragmented twelve-tab analyst stack.

    View presentation