Professional Experience

Technical Security

• Penetration Testing: lead and support authorized testing engagements, findings analysis, reporting, and client communication.
• Vulnerability Management: vulnerability scanning, asset context, prioritization, remediation planning, and ongoing tracking.
• IT Audits: walkthroughs, control testing, evidence review, reporting, and technology-control assessment.
• Microsoft Security: Entra ID, Intune, Defender, endpoint controls, identity, device management, and security modernization.
• Security Programs: asset inventories, access reviews, contingency planning, data protection, policy controls, and security operations improvement.

Advisory & Governance

• vCISO / vCIO Support: analyst support for strategic security and technology planning, initiatives, and executive reporting.
• Risk Management: risk assessments, remediation roadmaps, governance processes, and management reporting.
• Vendor Risk: third-party risk reviews, due diligence, and oversight processes.
• Policy & Program Development: security policies, standards, workflows, and program documentation.
• Service Delivery: improve repeatability, communication, reporting, and internal workflows across engagements.

• Tenable / Nessus — vulnerability scanning and assessment.
• Cavelo — asset, vulnerability, and sensitive-data visibility.
• Cynomi — vCISO program management, initiatives, and executive reporting.
• KnowBe4 — security-awareness training and phishing simulation.

• Microsoft Entra ID — identity and access management.
• Microsoft Intune — endpoint and device management.
• Microsoft Defender for Endpoint — endpoint security and investigation.
• GRC & Operations: Hyperproof, Monday.com, Snipe-IT, NinjaOne, PDQ, ManageEngine Endpoint Central, and related workflow tools.