Cybersecurity Engineer. What I have done before.
A decade of practical security engineering behind the Microsoft 365 consultancy: vulnerability management, identity hardening, zero-trust policy design and incident response.
Areas of capability
Cybersecurity delivery experience behind Magrathean: vulnerability management, identity hardening, endpoint protection, incident response and CE+ readiness.
- Vulnerability management and remediation prioritisation
- Endpoint security with Intune and Microsoft Defender for Endpoint
- Identity and access management with Entra ID, MFA and Conditional Access
- Zero-trust policy design and enforcement
- Firewall and IDS/IPS configuration on 1 Gb–10 Gb networks
- Encryption, key management and certificate-based authentication
- Incident response, forensics and post-incident control review
- Compliance work covering Cyber Essentials Plus, ISO 27001 and GDPR
- Secure scripting in PowerShell and Python for automation
- Risk assessment and threat modelling for SME contexts
Results from the role
Device compliance lifted and phishing and data-exposure incidents halved, with the controls documented for the team that runs them.
- Before72%
- After96%
- Before25–30
- After12
The attacks this work answers
Phishing leads UK breaches by a wide margin, which is why identity and mail controls come first.
- Phishing38%
- Impersonation in emails or online12%
- Malware on devices7%
- Online bank account hacking3%
- Denial of service3%
- Account takeovers2%
- Ransomware1%
See the broader practice
The same control-first approach spans identity, endpoint, tenant security, readiness and AI adoption.
Selected experience
What changed, how it was checked and who could keep it running.
- 01
As an in-house IT Manager I hardened a Microsoft 365 estate end-to-end: Intune device compliance lifted from 72% to 96%, Defender for Endpoint rolled out across the fleet, Conditional Access and MFA reshaped to remove legacy auth, and break-glass exceptions tightened to a documented standard.
- 02
Led first-time Cyber Essentials Plus certification from inside the business and aligned the wider control set with ISO 27001 expectations, including evidence preservation, change-control and access-review cadences.
- 03
Cut phishing and data-exposure incidents from 25–30 a day to 12 by tightening Defender for Office 365 policies, auditing inbox rules and forwarding, restricting OAuth app consent and rolling out sensitivity labels on collaboration surfaces.
- 04
Ran vulnerability management with Qualys and Microsoft Defender Vulnerability Management, prioritising remediation by exploit availability and business impact rather than raw CVSS, with named owners for each remediation track.
- 05
Hands-on penetration testing and network segmentation work to validate firewall rules, VLAN design and remote-access exposure rather than relying on assumed control posture.
Questions teams ask first
Why does this matter to me?
I have run these systems myself, so the fixes I make are ones your IT team or provider can keep running.
Do I need to prepare anything?
No. A 30-minute call is enough to see whether I can help. No logins or screen sharing are needed.
Other backgrounds
