Six years in IT and security, from help desk through systems engineering into security. That path shapes everything written here: frameworks and fixes that ignore how people and systems actually operate don’t last. The best remediation is the one that’s still in place six months later.
Every post is a real problem worked end to end: what was found, the commands and reasoning used to fix it, and how to confirm the fix held. Client names, environments, and identifying details are removed or changed.
Start here
- The Vendor Was the Phish. A full AiTM incident in Microsoft 365, from a trusted vendor's share link to scoping, cleanup, and the controls that stop it.
- Shutting Down Direct Send. Closing a spoofing path most tenants leave open, without breaking the printers and line-of-business apps that depend on it.
- The NetBIOS Finding That Wasn't About NetBIOS. Why a scan finding's title isn't the diagnosis, and how to find the gap the scanner was actually pointing at.
Or browse all posts, or by topic: Incident Response and Hardening.
What I work on
- Incident response and forensics. Leading detection, containment, eradication, and post-incident review, including live war-room response. Building the triage and artifact collection tooling that makes investigations faster and more repeatable.
- Compliance engineering. Translating CMMC Level 2, NIST SP 800-171, HIPAA, PCI DSS, and SOC 2 requirements into baselines, Group Policy and Intune configurations, and audit-ready evidence.
- Identity and access. Active Directory, Entra ID, conditional access, MFA, and least-privilege access through RBAC, just-in-time access, and PIM.
- Vulnerability management and hardening. Finding and fixing weaknesses across operating systems, authentication, SMB, TLS, and email security, then validating that the fix actually took.
- Automation. PowerShell and Microsoft Graph tooling for security analysis, alerting, and evidence collection.
Background
- Degrees in Cybersecurity and Networking from NSA/DHS-designated National Centers of Academic Excellence
- Certified Blue Team Level 1 (CBTL1)
- EC-Council Certified Threat Intelligence Analyst (CTIA)
- AccessData Certified Examiner (ACE)
Follow along
New posts land in the RSS feed. Only want one topic? Follow Incident Response or Hardening on their own.
Questions, corrections, or a problem you’d like to see covered: contact@secderr.tech. Reader requests help decide what gets written next.
To report a security issue with this site, see security.txt.