What I can do, and where I proved it.

Security Architecture & Cloud Posture

AZ-500 covers the whole Azure security surface, and that's the lens I work from. I review posture in Microsoft Defender for Cloud and investigate across workloads through Azure Monitor and Log Analytics. Most of the judgment is about resource scope, RBAC inheritance, and what's genuinely exposed.

• Defender for Cloud
• Azure Monitor
• Log Analytics
• Secure-by-design

Identity & Access

Identity is the control plane every other control inherits from. I investigate sign-in and identity activity in Microsoft Entra ID, think through RBAC scope and inheritance when something looks off, and keep automation identities down to least privilege.

• Microsoft Entra ID
• Azure RBAC
• Least privilege
• Identity investigation

Sentinel Engineering & Onboarding

I stand up Microsoft Sentinel workspaces from code rather than the portal, and bringing new log sources and data connectors online is routine work. External threat intelligence and automation get wired in over their APIs.

• Sentinel as code
• Log source onboarding
• Data connectors
• API integration

Detection Engineering

I write detections in KQL and map each one to an ATT&CK technique, so it stays clear what's covered and what isn't. The published library sits at 38 rules. Tuning an existing rule for signal matters as much as writing a new one.

• KQL
• Analytics rules
• Detection tuning
• MITRE ATT&CK

Threat Hunting

The hunting is hypothesis-driven and runs in KQL. I package each hunt so it can be re-run later and map it to the ATT&CK techniques it covers. What I go looking for comes out of threat intelligence and IOC enrichment.

• Hypothesis-driven
• KQL hunting
• Hunt packages
• MITRE ATT&CK

Security Automation & Incident Response

My playbooks and runbooks run on Logic Apps and Azure Automation, with Sentinel automation rules tying them to incidents. They authenticate through a Key Vault-backed managed identity, so no secrets sit in code. When a real incident comes in, I take the triage, get to root cause, watch the SLA clock, and pull people together on the high-severity ones.

• Logic Apps
• Automation rules
• Azure Automation
• Incident response

Manage a security operations environment

I run a personal Sentinel SOC with a small analyst team on the incident queue, and operate Google SecOps and LogRhythm alongside it.

Configure protections and detections in Defender for Cloud and Defender XDR

I use Defender for Cloud for posture review in the lab; tuning Defender XDR detections stayed at study level rather than something I've owned on a production tenant.

Configure and manage Microsoft Sentinel: workspace, data connectors, analytics rules, automation

This is the core of the lab. I deploy the workspace from code, onboard connectors and Data Collection Rules, and keep 38 analytics rules and their automation rules current.

Manage incident response across Sentinel and the Defender portal

I triage and investigate incidents in both portals, at work and in the lab, from first alert through root cause.

Hunt with KQL and manage threat intelligence

I run KQL hunts in the lab and feed them from a multi-feed threat-intel enrichment pipeline I built.

Implement and manage identities in Microsoft Entra ID: users, groups, external and hybrid identity

I manage users and groups in my lab tenant and have added external guests for the analyst team; hybrid identity I worked through in prep, not in production.

Implement authentication and access management: MFA, Conditional Access, Entra ID Protection

I investigate risky sign-ins in Entra ID Protection and reason about which Conditional Access policy did or didn't fire. I've written CA policies in the lab but not run them for a production user base.

Plan and implement workload identities: app registrations, service principals, managed identities

My playbooks and runbooks authenticate as managed identities, and I scope each one's RBAC down to what it actually needs.

Plan and implement identity governance: entitlement management, access reviews, PIM

I've set up access reviews and time-boxed admin grants in the lab. Entitlement management and PIM at organisational scale I've studied but not operated.

Manage identity and access: Entra ID, RBAC, PIM, Conditional Access

I scope RBAC for automation identities to least privilege and investigate Entra ID sign-in activity; PIM and Conditional Access I've configured in the lab.

Secure networking: NSGs, Azure Firewall, private and service endpoints, WAF, DDoS

I've built NSGs, private endpoints and firewall rules for the lab network, including the internet-facing honeypot segment. WAF and DDoS protection I covered in prep, not in anger.

Secure compute, storage and databases: VM baselines, Key Vault, storage and SQL protection, container security

Key Vault backs everything I automate, and I apply baseline hardening to the lab VMs and storage. SQL and container security stayed at study level.

Manage security operations: Defender for Cloud posture, security policy, Azure Monitor and Log Analytics, Sentinel

This overlaps with my day job: posture in Defender for Cloud, telemetry through Azure Monitor and Log Analytics, and detections in Sentinel.