IT security manager, security architect, cloud transformation manager

Developed and implemented a comprehensive Patching and Vulnerability Strategy that reduced the
organization's vulnerability to cyber threats by 40% within 5 months.

Designed and implemented automation of third-party patching and reduced Java Vulnerabilities by 80%.

Build the internal SOC to improve defensive capabilities.

Build and trained the internal offensive capabilities to automate penetration testing to gain a better overview of
internal attack surface and exploitability of Vulnerabilities.

Implemented Escalation processes for unpatched Systems.

Working as an Incident Responder, helping clients to restore their working ability. Gaining and applying
knowledge in vulnerability management, incident response life-cycle, forensic analysis, reverse engineering, and
lessons learned training to improve the incident response capabilities of the customer.

In April, my senior manager and I received a call that one of our clients had an acute ransomware attack
where some systems were infected and encrypted. We arrived Friday evening and managed the incident with the
customer through the incident response life cycle. Unfortunately, the customer had no playbooks prepared, and
due to a lack of EDR/XDR solutions, we only had Fortinet Firewall logs. We worked side by side with seven
other IT service providers to help recover and maintain the critical incident as fast as possible. After making sure
a triage was too late, we helped restructure resources, migrating the AD and exchange servers into the cloud and
creating three different VLANS for server restoration and security zones. Finally, by rolling out Defender for
endpoints and Servers and an XDR, we mitigated the chance of reinfection, helped create group policies, patch
management rules, and password policies, restructured the IAM, and eliminated on-premise password safes.

While collecting more logs, we tried to look into encrypted servers with the Bootstick version of Paladin, and I
learned to collect logs from Proxmox distributions using FTKImager, SIFT Workstation, X-Ways and got my
first insights in Autopsy.

We enabled the client to start production after only ten days of downtime.