Experience

At Inzo Technologies I administer Microsoft 365 and identity for a managed services provider with 44 client organizations, 21 of them on Microsoft 365. I onboarded the CSP component that GDAP and Microsoft 365 Lighthouse depend on, then replaced per-client admin accounts with one secured identity per technician across those 21 tenants. The case study covers the role design and the Graph automation behind it.

I led the company Duo rollout, enrolling all employees and configuring SSO for 8 internal services.

I built the initial Microsoft Intune and Entra Join configuration for the company's roughly 40 employees: compliance policies, a Windows security baseline, and Conditional Access. Device enrollment was validated in testing.

I deployed Keeper Enterprise Plus for one healthcare billing client. Users sign in with Google Workspace through SAML, and SCIM provisions the accounts. One Google group controls sign-in, just-in-time provisioning, and license use for 33 accounts. The vault replaced a shared spreadsheet: about 1,000 payer-portal credentials across 35 practice folders, with role-based access. Portal MFA moved to Keeper TOTP or the existing group mailbox where the portal allowed the change.

Windows Server and Active Directory have been daily work at both Keystone and Inzo. At Keystone I built Active Directory domains from the ground up for new clients. I hybrid-joined some of those domains to Entra ID and managed many more that already were. I wrote new Group Policy and supported what existed, ran file and print servers, and built the multi-session terminal server groups that Citrix delivered to users. On Citrix Cloud I built the machine catalogs and delivery groups and deployed FSLogix. For one client I repointed 30+ VDAs from NetScaler to Cloud Connectors.

At Inzo, client onboarding starts with taking over the existing domain. The standing work is domain controllers, DNS and DHCP, Group Policy, and the privileged-account cleanup an inherited domain needs.

I write PowerShell for day-to-day tasks. The Python and Bash in production were written by AI to my specification.

The public examples are the case studies: the SharePoint-to-IT Glue migration, the NinjaOne documentation pipeline, the security audit program, and the phishing platform on Azure. I moved my PowerShell and Python automation from AWS CodeCommit to GitHub, with gitleaks secret scanning on every push and pull request, and pre-commit hooks on the workstation.

At Keystone I designed a Windows 11 readiness inventory of 3,000+ workstations, pushing a PowerShell collector through N-Central into AWS DynamoDB (AI-assisted CloudFormation). It found about 90 devices that could not upgrade.

At Keystone Technologies, from 2020 to 2023, I was the only system administrator and the only L3 escalation for 25+ clients on AWS and Citrix Cloud. After 2023 I was the senior system administrator and trained the sysadmins hired from the largest client's IT department. The estate was 25+ client AWS accounts, 300+ Windows EC2 instances, and Citrix Cloud for 25+ clients and 1,000+ users, hosted in AWS. My AWS work there runs from late 2019 to July 2025.

I rolled out AWS Systems Manager across every client account. It had never been turned on. I built the service IAM roles by hand, before AWS automated that setup, and enabled Session Manager, Run Command, and Inventory account by account. New servers were configured through Systems Manager instead of RDP.

I led a 30+ server data center migration to AWS for a large elder-care organization with Application Migration Service.

I ran EC2 backup on N2WS and on-premises server backup on Cove Data Protection, and three times restored one client's 5 ransomware-hit servers, 2 of them domain controllers, from EBS snapshots.

I onboarded client accounts into the company's AWS Organization with cross-account roles, and built client VPCs from standard CloudFormation templates, plus site-to-site VPNs and AD Connector or AWS Managed Microsoft AD. Those templates were existing ones I adapted per client.

For the past year I have managed Inzo's client firewalls, SonicWall for most clients and UniFi for a few: firmware updates across the fleet, new deployments, and replacing units at end of life. For a senior-living site I put a TZ380 inline in place of a pfSense box, carrying the old firewall's WAN and LAN MAC addresses. The circuit, the admin, staff, and resident DHCP scopes, the nurse-call system, and the SSL VPN portal came up without re-addressing anything. For a manufacturer I deployed a SonicWall and converted the Netgear router it replaced to an access point. For a church on UniFi I am designing the move from one open network onto VLANs, with a device-to-VLAN map and a firewall allow matrix the church signs off on before cutover.

I run a standing audit program across the 44 managed organizations: network documentation, DNS checks, EDR coverage, failover tests, and backup validation. The case study is the longer writeup. Inside that work I ran CISA ScubaGear secure-configuration audits across 9 client Microsoft 365 tenants in two days, and assessed 14 managed SonicWall firewalls through the vendor's cloud API. That pass found expired security licenses that had left threat protection off.

The phishing-simulation platform is self-hosted on Azure. It was provisioned with scripted Azure CLI: TLS, an SMTP relay, and secrets in Azure Key Vault.

At Inzo I onboard clients to Proofpoint Essentials end to end. That means creating the customer, verifying the domain, setting up the Entra user sync, and scripting the Exchange Online connector pair and bypass rule with Enhanced Filtering. Then SPF, the MX cutover, DKIM, and a trace of the first inbound message through the relay. The most recent, for a home-care client, took one morning. For a church client I built three content filters that quarantine display-name spoofs of the pastors and staff, and I run a standing review pass over what they catch: true positives logged, false-positive patterns excluded at the filter condition. Four passes between September and October 2026.

For SentinelOne, Inzo's EDR, I set up new client sites and the NinjaOne deployment that installs the agents. I also triage detections: read the storyline, decide whether it is a threat or a false positive, and restore whatever the automated remediation rolled back.

I led the technical onboarding of an acquired MSP, 20+ client organizations, onto Inzo's toolset, including its documentation out of SharePoint and into IT Glue. Each of about 1,300 source files became its own IT Glue document, with the content converted to IT Glue's HTML document format as the body and the original file attached. A content pre-screen pulled credentials out of runbooks and spreadsheets before anything was published. The run was checkpointed, so an interrupted pass resumed. The case study covers the pipeline. The onboarding also built about 370 IT Glue infrastructure assets and moved the acquired clients' credentials out of plaintext SharePoint spreadsheets into IT Glue password records.

I wrote the data team's 31-playbook library: client onboarding and offboarding, Microsoft 365 tenant operations, monitoring and incident response, and ticket handling. I onboarded 2 managed services clients end to end, from Microsoft 365 tenant and license migration and Active Directory takeover through RMM, EDR, email security, and MFA enrollment. I stood up PagerDuty with escalation policies and phone-system alerting, and Power Automate flows that publish the on-call schedule.

When I onboard a client at Inzo, I set up:

• NinjaOne: the organization, its locations, and the device policies that install SentinelOne and the backup agent.
• The SentinelOne site.
• DNSFilter on the domain controllers' forwarders and the guest network's DHCP.
• Duo MFA enrollment.
• Proofpoint.
• NinjaOne cloud backup for the servers, and SaaS backup for the Microsoft 365 tenant, authorized through a least-privilege service principal instead of a standing Global Admin.
• Auvik, with its collector and SNMP on the switches.
• The firewall, switches, and cellular failover.
• The IT Glue organization: configurations, passwords, and documents.

At Keystone I moved about 100 organizations' documentation from IT Glue to Confluence, and designed the Confluence space structure and page templates it landed in. I also moved thousands of credentials from IT Glue to LastPass, and then from LastPass to Keeper after LastPass disclosed its 2022 breach.

At REJIS, from March 2016 to September 2018, I administered Windows Server and Active Directory for municipal government clients across the St. Louis metropolitan area inside its managed IT services group, and ran WSUS patching, Dell KACE software deployment, and Citrix XenDesktop support for St. Louis County.

At BJC HealthCare, from September 2010 to February 2016, I did desktop support for clinical and administrative staff across a 15-hospital health system, a HIPAA-regulated environment. The work was workstation, laptop, and printer troubleshooting, device imaging, Active Directory user management, and application support. I was promoted from Customer Support Technician to Senior in 2012.

From February 2004 to March 2010 I was an AEGIS Computer Network Technician in the U.S. Navy, on USS Farragut (DDG-99), administering a 41-node HP-UNIX combat network.