Experience

Eighteen-plus years, most of it somewhere between "the systems" and "the security of the systems," and the last several focused on identity. Employers are described here rather than named. The full timeline, with names, is on LinkedIn.

Senior Security Engineer, Enterprise Identity and Access Management

A Fortune 100 company in a regulated industry (contract). Chicago and remote. January 2025 to September 2026.

• Built PowerShell and Microsoft Graph automation that inventories every administrator role, including the ones people can switch on when needed, and every Conditional Access policy, producing the evidence that privileged-access reviews run on.
• Designed a scoped pilot for phishing-resistant sign-in using passkeys (FIDO2) and authentication strengths, with documented emergency-access and service-account exclusions, validation criteria, and rollback steps.
• Partnered with application teams on SAML and OpenID Connect sign-on: custom claims, API permissions, and consent troubleshooting across test and production.
• Tracked down repeated-MFA and hybrid-device sign-in failures by correlating sign-in logs, device registration, and token state, and coordinated the fix with Microsoft support and internal teams.
• Prepared legacy single sign-on migration and application-onboarding guidance. See Projects.
• Wrote the runbooks for authentication troubleshooting, Conditional Access, account exclusions, and application administration, for on-call use and knowledge transfer.

Microsoft Security IAM Engineer

A global insurance brokerage (contract). Remote. January 2024 to June 2024.

• Joined ahead of a planned migration from CyberArk to Entra ID to assess the environment, map dependencies, and document the security and operational requirements.
• Assessed identity and privileged-access controls across Active Directory, Entra ID, CyberArk, and BeyondTrust, documenting gaps, risks, and remediation recommendations.
• Validated Entra PIM role assignments and removed unnecessary privileges. Rotated CyberArk credentials and removed hard-coded privileged passwords from scripts.
• Wrote certificate-authentication failover and single sign-on recovery runbooks.

Senior Microsoft Cloud Security Engineer

A life-sciences services company. Remote. June 2023 to December 2023.

• Managed identity, access, and security configuration across Azure, Entra ID, Active Directory, and Microsoft 365.
• Built PowerShell and Microsoft Graph reporting for user and group provisioning, and scripts that turn Entra audit logs into CSV that investigators and security teams can review and share.
• Ran cloud-security and Zero Trust control assessments and audited Azure subscription role assignments, turning the findings into prioritized remediation.
• Wrote step-by-step runbooks for Active Directory replication failures.

Senior Systems Engineer

A consumer fintech lender. Chicago and remote. August 2021 to June 2023.

• Led the migration of SaaS applications from CyberArk's identity provider to Azure AD (now Entra ID), working with application owners, senior leadership, DevOps, and security.
• Ran hybrid identity between on-premises Active Directory and Azure AD, including Azure AD Connect health checks and sync remediation.
• Configured and troubleshot single sign-on, federation, and OAuth across Azure, AWS, GCP, Google Workspace, and banking partners.
• Built certificate-rotation procedures for application service accounts, and supported SOX, NIST, SOC, and PCI audit work.
• Mentored help desk staff, junior administrators, and SOC analysts on identity systems and troubleshooting.

Senior Systems Support Analyst

A global precision-engineering manufacturer. Chicago area and remote. August 2014 to August 2021.

• Supported infrastructure, ERP, and manufacturing systems across US operations, with additional support to a global organization.
• Coordinated a Windows 10 migration across 400+ endpoints throughout the Americas.
• Replaced the shipping system and wrote 15+ business rules covering export controls, dangerous goods, and customer requirements. A carrier change helped reduce shipping costs by 37% for customers without their own carrier accounts.
• Delivered ERP migrations, upgrades, and site integrations, and administered the SQL Server environments behind ERP, CRM, and manufacturing applications.
• Helped expand secure remote access during the pandemic with VPN, hybrid Azure AD and Intune, and MFA.
• Wrote the PowerShell that kept it all running: a user-provisioning workflow engine, 31 scheduled jobs, and a service-desk console. Most of it is now public on GitHub, with company identifiers replaced.
• Started as IT Project Analyst (2014 to 2017): project reporting and SQL-based dashboards for IT and Finance initiatives.

Earlier

Help desk, systems support, and IT consulting roles from 2008 to 2014: Windows and Linux servers, Active Directory, VPN and remote access, monitoring, and the runbooks that went with them.

Certifications

• Microsoft Security, Compliance, and Identity Fundamentals (2021)
• Microsoft Azure Fundamentals (2021)
• Microsoft Azure Data Fundamentals (2022)
• Microsoft Dynamics 365 Fundamentals (2021)