Security Operations Engineer specializing in Microsoft E5. I detect threats, automate responses, and engineer resilience across enterprise environments.
Security Operations Engineer focused on the parts of blue-team work that hold up under pressure — durable detections, tight response workflows, and data-protection policies that actually fit how people work.
Microsoft E5 stack: Sentinel, Defender XDR, Defender for Endpoint, Identity, Cloud Apps, Purview DLP and Insider Risk. Three years of frontline SOC work — triage, KQL detection engineering, vulnerability management, and the patch cycles that keep an attack surface honest.
Most interested in detection engineering at the cloud edge, identity-centric threat models, and using automation to shorten the gap between alert and decision.
// identifiers redacted until coordinated disclosure windows close. full list lives on /cves.