Security operations and incident response

I built and operate the company's security posture: incident response with a real caseload behind it, a recurring audit discipline, and a platform-level control stack that replaced a sprawl of point tools. The practice has run continuously since the ITSM platform went live in December 2022.

Account compromise response

A sustained compromised-account caseload, and one of the higher-volume security categories in the operation. Every case runs the same documented procedure rather than an improvised response:

• Detection through suspicious sign-in monitoring (location anomalies, impossible travel, anomalous feature use), Unified Audit Log review, or a user or manager report.
• Containment: revoke active sessions, force a password reset, remove malicious inbox rules (the standard attacker pattern is auto-forward to an external address paired with delete-from-sent-items), and revoke unfamiliar OAuth grants.
• Forensics: Unified Audit Log analysis to establish the access window and determine what mailboxes, files, and chats were actually reached, and what was sent from the account.
• Remediation: restore MFA enforcement if it was bypassed, validate Conditional Access posture, return mail-flow rules to a known-good state.
• Communication to the user, their manager, and the affected business unit, extending externally if customer data may have been reached.

A companion procedure covers email bomb attacks, where an account is buried in subscription confirmations to hide a fraudulent transaction confirmation somewhere in the noise.

Audit and activity review

Formal security activity audits processed as a standing discipline over the same window: structured reviews of sign-in activity, mail-flow rule changes, app registration changes, external sharing, license assignment, and group membership. These are the recurring passes that keep the tenant aligned to its documented baseline.

Audit work feeds the documentation pipeline. PowerShell and Microsoft Graph scripts pull the audit-relevant inventories (app registrations, enterprise apps, Conditional Access policies, mail-flow rules, stale guest accounts) and write readable Markdown into the documentation library, so the posture is reproducible instead of living in transient admin-portal views.

Platform-level controls

Bundled the Enterprise Mobility + Security E5 add-on onto the existing E3 baseline as part of a board-approved licensing modernization. That unlocked the full platform security layer:

• Defender for Endpoint for detection and response across the Windows fleet.
• Defender for Identity for Active Directory threat detection.
• Defender for Cloud Apps for SaaS visibility and shadow-IT discovery.
• Entra ID P2, unlocking Identity Protection and risk-based Conditional Access.
• Privileged Identity Management for just-in-time elevation with periodic access reviews.

The architectural judgment here is bundle over point tools: one platform layer with coherent signal sharing, rather than several vendors each covering a slice and none of them talking to each other.

Conditional Access design

• Geolocation: sign-in is geofenced by default. Travel outside the permitted scope runs through a service-catalog request that provisions a time-bounded exception with explicit approval routing, rather than an ad-hoc allowance.
• Device compliance layered on Intune signals, so unmanaged devices cannot reach corporate resources.
• Risk-based sign-in policies driven by Identity Protection.
• Per-application controls for higher-sensitivity targets such as admin portals and finance applications.
• MFA enforcement with a managed exception workflow and documented emergency-access procedures.

Privileged access

• Windows LAPS on the Entra-joined-device variant, managing local administrator credentials across the fleet.
• Admin by Request, so users request just-in-time rights for a specific action instead of holding standing local-admin membership.
• Privileged Identity Management for just-in-time elevation to directory roles.
• Separate admin accounts under a documented naming convention.

Tooling

• AdminDroid as the primary Microsoft 365 monitoring tool: suspicious sign-in detection, malicious mail-rule detection, app-registration change tracking, stale guest detection.
• Action1 for third-party patch management, complementing first-party Windows update delivery through Intune.
• Purple Knight run as an Active Directory and Entra ID posture scan, surfacing misconfigurations across identity, GPO, AD CS, and Entra.
• CISA ScubaGear running ongoing Microsoft 365 Secure Configuration Baseline assessments, with results committed into the documentation pipeline.
• Bitdefender for endpoint security, layered with Defender for Endpoint coverage.
• Bitwarden for shared-credential vaulting, and Microsoft Purview DLP for information protection.

Vendor decisions made on evidence

Renewal and purchase decisions are argued from the incident record rather than from a vendor's pitch. A standalone subscription came up for renewal and was allowed to lapse after its completion metrics were compared against the compromised-account trend, with that spend reallocated toward platform-level controls. A separate point tool was evaluated and not selected on the same reasoning: the platform layer already covered the ground.

Awareness program

Run the enterprise cybersecurity awareness program with Power BI dashboards tracking completion rates, phishing-simulation click rates, and risk by department, presented at executive forums. Authored the end-user security advisories and rollout communications distributed through Teams and the employee SMS broadcast platform.

What this demonstrates

• A real incident-response record with documented procedure behind it, not a theoretical posture.
• Forensics discipline: establishing scope of access and communicating it, rather than resetting a password and calling it closed.
• Architecture judgment backed by numbers, including a vendor non-renewal argued from incident data.
• Privileged access managed as a system: LAPS, just-in-time elevation, and separated admin identities, all in production.