Experience

Endpoint Security & Fleet Rollouts

• ▸ Led the WDAC application-control rollout across tens of thousands of Windows endpoints — authored policies at the XML level with browser-deny enforcement, validated through staged pilot rings, and shipped to production with zero P0/P1 incidents; delivered in-house after external vendor engagements had stalled.
• ▸ Rolled out cross-platform endpoint tooling across the Windows and macOS fleet — Microsoft Defender for Endpoint, Chrome Enterprise, and OSQuery telemetry — establishing SOPs, lifecycle automation, and monitoring where none existed.
• ▸ Manage the macOS fleet on Jamf Pro and delivered Scalefusion MDM across the managed-device estate, standing up operations and lifecycle automation from scratch.

Security Automation & Engineering

• ▸ Built an autonomous-but-advisory SOC analysis engine from scratch — integrating Microsoft Defender for Endpoint APIs, Azure CLI, and Slack to automate alert and incident investigation, device context, fleet-wide CVE scans, and sensor-health audits, cutting average investigation time from roughly 20 minutes to under a minute.
• ▸ Engineered a suite of internal security tools — from guardrailed fleet remediation to Netskope investigation and log-analysis agents and an insider-threat SIEM agent (see Projects).

Enterprise Security Platforms — Netskope

• ▸ Own Netskope (SSE / CASB / DLP / DEM) end-to-end across the full endpoint fleet — deployment, policy engineering, daily operations, incident investigation, and monthly audits; authored SOPs and built an internal L1 support and escalation capability through engineer training.
• ▸ Built two Netskope automation tools — an API-driven incident-investigation agent over the live tenant, and an offline client-log analyzer that root-causes device connectivity failures from client log bundles.

SecOps, Detection & Incident Response

• ▸ Run threat hunting and detection engineering in Microsoft Defender Advanced Hunting and Microsoft Sentinel — authoring and tuning custom KQL detections that surface additional compromised devices across the fleet.
• ▸ Run daily macOS security operations on Jamf Protect and established fleet-wide vulnerability visibility via automated CVE-discovery workflows that correlate the Windows estate against thousands of CVEs and feed prioritized remediation.
• ▸ Led investigations across supply-chain compromise, malicious browser-extension token theft, insider data theft, and credential phishing — including a full RCA on thousands of devices that Microsoft and Netskope support could not diagnose, with PowerShell detection and remediation tooling.

Leadership & Process

• ▸ Established the security quick-response (QRT) investigation process where none existed — SOPs, an internal knowledge base, engineer training, and tooling. Coordinate vendors (Microsoft, Netskope, Jamf, Google, Scalefusion) and partner with the GRC team on IT-risk and compliance governance.

• ▸ Led product deployments and proof-of-concepts end-to-end — implementation, integration, and customer enablement — alongside RFP / RFI management and technical workshops.
• ▸ Ran security-architecture and networking discussions with prospects, accelerating purchase decisions; administered Linux environments with shell scripting for deployment and automation.

• ▸ Managed RFPs, RFIs, and proof-of-concept projects end-to-end, increasing client engagement and conversions.
• ▸ Partnered with sales, engineering, and support to shape technical solutions and delivered training that streamlined POC cycles.