About Brex
Brex is a financial technology company that operates in a highly regulated environment. It helps businesses move faster with corporate cards, spend management, travel, and financial operations solutions. Their globally distributed workforce depends on a secure and reliable environment supported by teams responsible for onboarding, identity and access management, and incident response.
Executive summary
Brex adopted Tines to cut alert noise, improve triage accuracy and speed, and enhance reliability across Security and IT. We spoke with Jessica Rozhin, who leads Brex’s security engineering team, and Lloyd Cilliers, who leads their IT function. Before Tines, both teams struggled to support a global workforce while keeping operations consistent and secure.
Tines now suppresses up to 90% percent of weekly alerts so analysts only see what matters. It also runs Brex’s time-sensitive onboarding across global time zones. Both teams rely on one platform to operate their most important workflows without adding overhead. As Lloyd explained, “Tines helps us spend less time on manual work and more time serving the business.”
The challenge
Before Tines, Brex’s security engineering team relied on what they described as “Slack-ops.” Alerts from multiple systems were funneled into a single Slack channel without context or prioritization. Analysts had to manually open several tools to validate alerts, search logs, and trigger incidents. The process was slow, noisy, and inconsistent. The team wanted a system that could provide a predictable, accurate way of working every alert while reducing repetitive triage work.
IT faced similar challenges. Workflow logic lived inside individual tools like Okta and Google Workspace. A limited number of team members had the access and skills to automate key steps. As Brex grew, this approach became difficult to maintain. This challenge became especially visible during onboarding with Brex’s onboarding specialist needing to login at 5 a.m. to ensure new hires in specific time zones were in the correct calendar groups before their first meetings.
Brex also has a strict privacy posture around the use of AI, including a “bring your own key” model. Any platform the team adopted needed to work within those guidelines. Both teams ultimately needed a platform where they could build, reuse, and scale workflows together.
Why Tines
Brex needed a workflow platform that could orchestrate complex alert pipelines, automate operational tasks safely, and align with their strict security and privacy requirements. Their CISO previously used Tines and strongly advocated for adopting it again, knowing it would give the security engineering team the flexibility and control they needed without increasing operational risk.
Tines also aligned with Brex’s internal standards for automation and AI. The ability to bring their own API key and keep sensitive data within their own environment was essential for both compliance and day-to-day operational confidence.
Once Security established Tines, IT saw the benefit of using the same platform to support their own workflows. Using one system made it easier to build with consistent logic, apply shared patterns, and design workflows that spanned multiple tools across their environment. “Choosing a shared platform set the foundation for stronger collaboration and made it easier for both teams to build and run their most important workflows in a consistent way.”
The Impact
Tines gave Brex a faster, more reliable way to manage alerts, onboard employees, and support a global workforce while reducing manual effort. These improvements helped both teams operate more predictably, focus on higher-impact work, and increase end user satisfaction.
Faster alert triage with less noise
Tines transformed Brex’s alert management process by validating, enriching, and routing incoming alerts. Analysts who once had to pivot across several tools now receive Slack notifications only for the alerts that need their attention. Jessica shared that they saw “an incredible increase in the speed of our ability to triage alerts once Tines began handling the repetitive work.” Today, the workflow analyzes and suppresses up to 90% of weekly alerts, which she described as “hidden work that happens transparently,” allowing the team to focus on the alerts that truly matter.
Consistent and reliable cross-team collaboration
The security and IT teams previously relied on fragmented, tool-specific workflows that were difficult to maintain and impossible to standardize. With Tines, both teams now build and run workflows in the same environment using shared patterns and logic. This has made their processes more predictable and less dependent on small groups of specialists. Lloyd noted “Using the same technology brought IT and security closer together and made knowledge sharing much easier.”
Faster, more reliable onboarding for a global workforce
Before Tines, onboarding required a series of manual and time-sensitive tasks that required daily early morning logins to support new hires in different time zones. After orchestrating these steps with Tines, new hires are onboarded automatically at the right time with everything they need to start. Jessica noted “people get provisioned and deprovisioned on time, and the user experience is better across the board.”
Scaling efficiently without increasing headcount
One of the most important goals for Brex was gaining the ability to scale their security and IT operations without added headcount. Jessica shared that “Tines very quietly does a lot of operational work” and that because so much of the repetitive work is now automated, they “haven’t needed to hire as many people because of it.” This lets both teams focus their time on strategic initiatives rather than routine tasks.
Top workflows
Alert management
Brex’s security engineering team built a workflow that enriches alerts, correlates signals, and routes them to the right place. This eliminated the manual pivoting between tools that once slowed analysts down and made alert handling inconsistent. As Jessica explained, “Tines is the glue for our detections and alert processes. Every alert becomes a Tines case, and the workflows tie all our detection systems together so the right information reaches the right people in a clean, consistent way.”
The Brex team’s blog gives a behind-the-scenes view of how this workflow became possible with Tines. Instead of handling signals individually and stitching context together by hand, the team designed a system that “deduplicates and enriches alerts at scale” and moves automatically into case management, giving analysts the clarity they need to make confident decisions.
Flexible incident response
Tines powers incident response in the tools where Brex teams already work. Security practitioners can start an incident directly from Slack, and Tines handles the follow-up steps, including containment. Practitioners can take containment actions right from the incident channel or through a Tines Page if they prefer a guided interface. Jessica noted that these workflows created “lots of efficiency in alert triage and incident response,” and that the team gains these benefits “without having to actually run the system or have operational ownership for the system that gave us those efficiencies.”
Employee onboarding and identity workflows
For IT, one of the most impactful workflows is the automated onboarding process. Tines provisions accounts, access groups, calendar placements, and training assignments so new hires are set up correctly without the manual steps once required. Lloyd explained how meaningful this shift was for the team, saying “Before Tines, someone had to log in at 5 a.m. to put new hires in the right groups. Now the workflow assigns accounts, access, and training automatically based on location. It made a noticeable difference for the person doing that work.”
Before Tines, someone had to log in at 5 a.m. to put new hires in the right groups. Now the workflow assigns accounts, access, and training automatically based on location. It made a noticeable difference for the person doing that work.
Lloyd Cilliers, Head of IT at Brex
These workflows also power smaller behind-the-scenes actions, such as updates triggered when an account is activated or employee data changes, helping IT maintain consistency across systems without managing disconnected automation inside individual tools.
Favorite Tines features
Brex highlighted both Pages and AI Agents as features that make a meaningful difference in their work. Pages give stakeholders a simple, pleasant interface for quick checks or requests, which helps make the work in Tines more accessible. Lloyd was especially excited about AI Agents, particularly the ability to use Brex’s own API keys. He sees AI Agents as a flexible way to process data inline, avoid rigid tooling, and explore AI safely while staying aligned with their privacy posture.
What’s next
Brex is expanding Tines into business systems and expects to build even more shared workflows across teams as the company grows. They also plan to deepen their use of Tines as the company continues to adopt AI. Both teams are exploring AI-driven agents that use MCPs to take on more complex, multi-system analysis tasks.
Brex is already using Glean to improve knowledge discovery. As that work expands, Tines acts as the orchestration layer that can connect Glean’s intelligence to Brex’s internal systems and workflows. Together, they envision a future where AI, human review, and deterministic logic work in concert to guide employees and resolve operational work more effectively.