Pascua Yaqui Tribe Arizona, USA
Cyber Security Administrator
Jan 2024- present
- Sole cybersecurity administrator for a 1,300+ user SOC environment, responsible for creating and maintaining comprehensive security protocols and protecting the organization against threats.
- End-to-End Incident Response: Led response to malware, phishing, unauthorized access, and data exfiltration events, driving containment, eradication, recovery, and post-incident reporting while coordinating stakeholders across IT and affected business units.
- Playbooks & Runbook Development: Created and maintained incident response playbooks, security operating procedures, and technical runbooks covering phishing, malware, account compromise, and data exfiltration, standardizing response across the organization.
- SIEM & XDR Operations: Administered Entra ID, Microsoft Defender XDR, and Microsoft Sentinel for log analysis and investigation, correlating response efforts across teams.
- Data Loss Prevention & Compliance: Developed and maintained DLP policies for Health, Finance, and other departments aligned to HIPAA, NIST frameworks, and department requirements, identifying and restricting the sharing of confidential information via email and other channels.
- Tier-One Enablement & Mentoring: Mentored IT helpdesk and system administration staff on security triage procedures, escalation criteria, and threat identification, building tier-one response capability across the department.
- Security Consulting & Advisory: Advised department leadership and project teams during technology evaluations and system deployments on access controls, data handling requirements, and compliance obligations prior to implementation.
- Digital Forensics & Root Cause Analysis: Performed forensic analysis of endpoints to determine incident root cause, attack vectors, and signs of data exfiltration.
- Security Risk Assessment & Hardening: Conducted risk assessments of Microsoft platforms, identified posture gaps, and implemented remediations such as application whitelisting.
- Proactive Threat Hunting: Hunted across Microsoft Defender XDR and Sentinel using MITRE ATT&CK techniques and OSINT-derived indicators, surfacing malicious activity ahead of alerting.
- Vulnerability & Patch Management: Ran vulnerability assessment scans across organizational devices using Syxsense, coordinated patching with system administration teams, managed third-party penetration testing, and implemented the security controls recommended in the results.
- Endpoint & Network Threat Investigation: Conducted in-depth investigations using Microsoft Defender XDR and Cisco Secure Endpoint to analyze and mitigate threats, review firewall rule changes, identify root causes, and implement remediation.
- Secure Collaboration & External Access: Engineered Entra ID cross-tenant access policies, guest user governance, and Conditional Access rules, enabling partner and vendor collaboration without exposing internal resources.
- Security Awareness & Phishing Simulation: Built and managed advanced simulated phishing campaigns using KnowBe4 and Adaptive Security, analyzed results to identify trends and repeat failures, and delivered tailored one-on-one training for employees needing additional awareness.
- Network Traffic Analysis: Analyzed PCAP files in Wireshark during IR operations, extracting file transfers and malware communication patterns.
- Email Security Operations: Monitored and maintained Microsoft Defender for Office 365 and Darktrace Email to detect and prevent email-based attacks, reducing spam by 30%.