Defense across every layer.

Hands-on with the platforms that detect, investigate and stop attacks, grouped by the layer of defense each one protects.

  • Endpoint (EDR)

    Detecting, investigating and containing threats on servers and workstations.

    • CrowdStrike Falcon
    • Microsoft Defender for Endpoint

  • SIEM

    Collecting and correlating logs into alerts the team can act on.

    • CrowdStrike NG-SIEM
    • Microsoft Sentinel
    • Seceon
    • Wazuh

  • Identity protection

    Watching for credential abuse, risky sign-ins and lateral movement, and enforcing conditional access.

    • CrowdStrike Identity Threat Detection
    • Defender for Identity
    • Microsoft Entra ID

  • Web and zero trust access

    Securing internet traffic, SaaS use and private application access for users anywhere.

    • Zscaler ZIA
    • Zscaler ZPA
    • Dope Security SWG
    • Dope Security CASB

  • Cloud security

    Posture and threat monitoring for cloud workloads and accounts.

    • CrowdStrike Cloud Security
    • Defender for Cloud
    • Trend Micro Cloud Security
    • Prisma Cloud
    • AWS
    • Microsoft Azure

  • Email security

    Stopping phishing, spam and malicious attachments before they reach users.

    • Proofpoint
    • Trend Micro Email Security
    • Defender for Office 365

  • Data protection

    Finding sensitive data and stopping it from leaving the organization.

    • Forcepoint DLP
    • Microsoft Purview

  • Micro-segmentation

    Limiting how far an attacker can move inside the network once they get in.

    • ColorTokens

  • Vulnerability & patch management

    Finding vulnerable software across endpoints and rolling out patches before attackers can use them.

    • Action1
    • CrowdStrike
    • Microsoft Intune

Also experienced in

Operations, response and infrastructure skills I use alongside the platforms above.

  • SOAR and automation
  • Incident response and RCA
  • CrowdStrike AI Detection & Response (AIDR)
  • Penetration testing
  • Bash scripting
  • Hyper-V and Proxmox