Detection & Corporate Security Engineer

I own Microsoft Sentinel detection engineering and security operations for a GDPR-regulated healthcare SaaS environment. I designed and shipped more than 15 MITRE ATT&CK-mapped KQL analytics rules, maintained Content Hub solutions, watchlists, automation rules, and Logic Apps playbooks, and reduced mean time to detect by approximately 62%.

I manage corporate endpoint, identity, incident-response, vulnerability-management, and compliance controls across Entra ID, Okta, Intune, Tenable, Qualys, and Python automation. I built Graph and Okta API workflows that reduced manual security effort by about 84%, cut audit preparation from 120 to 30 days, reduced CVE backlog by 78% in 60 days, and supported a zero-exception SOC 2 Type II outcome.

I operated Zero Trust identity and endpoint controls across a remote-first SaaS environment with more than 40 applications. My responsibilities included Defender/EDR, Entra ID Conditional Access, PIM, MFA, Okta SSO, risky-sign-in investigation, phishing-response support, and corporate endpoint hardening.

I assessed Azure and Kubernetes controls against CIS baselines, remediated 90% of 23 critical Kubernetes findings within six weeks, and implemented OPA/Rego policy-as-code to reduce standing privilege by about 68%. I also delivered SOC 2 Type I on the first attempt, authored 14 security policies and more than 20 operational runbooks.

I designed and implemented a production Elastic SIEM from the ground up, including Elasticsearch, Logstash, Beats, Kibana, ingest pipelines, lifecycle management, parsers, dashboards, and detection content for Windows, Linux, and Kubernetes audit telemetry.

I established the company's first in-house detection capability by building detection signals and runbooks end to end. I also reviewed security architecture across more than 100 servers and Kubernetes workloads, contributing to a 78% CVE reduction in 60 days through CIS Level 1 hardening and privileged-access improvements.

I worked in a 24/7 SOC environment managing a live queue of more than 500 daily alerts across SIEM, EDR, email security, identity, and endpoint systems. I scoped investigations, collected Microsoft 365, Entra, and endpoint evidence, classified alerts, and performed containment within SLA while sustaining an 85% true-positive rate.

I investigated phishing, malware, ransomware precursors, brute-force activity, password spraying, and impossible-travel events. I conducted Windows and Linux log forensics, timeline reconstruction, MITRE ATT&CK mapping, detection tuning, and response-runbook development, while improving device compliance from 65% to 97% in 45 days.

I implemented SAML 2.0 single sign-on across more than 15 SaaS applications and automated RBAC-based provisioning and de-provisioning. These changes reduced onboarding time from two weeks to two days, removed all orphaned accounts, and reduced standing privilege by approximately 68%.

I managed joiner, mover, and leaver processes, access tickets, AD and Entra synchronization, role hygiene, privileged-account checks, and service-account credential lifecycle controls. I maintained hybrid Active Directory and Entra ID availability of 99.98% with no identity outages over 24 months.

Master of Science in Computer & Information Systems.

Bachelor of Science in Computer Engineering.