Treating identity as the control plane for everything else.
Scattered identity systems across the SaaS estate with no unified source of truth — nothing solid to anchor a zero-trust posture on.
Consolidated SSO and SCIM under Okta + Entra ID, anchored to Workday (HRaaS) as the lifecycle source of truth — 100+ integrations across the estate. Rolled out passwordless policies across both IdPs, paired with Okta Desktop MFA and Windows Hello for Business as the desktop strong-auth layer. Operate CATO SASE alongside Palo Alto (Panorama) for zero-trust network access.
100% automated joiner/leaver flows sourced from HRaaS, attribute-based application assignment, and just-in-time access — at firm scale.
Patching cadence ad-hoc; vulnerability data spread across tools with no executive view.
Built and ran an automated vulnerability management program — gathering data across tools, curating critical/high lists routed to the responsible patch teams, and surfacing KPI tracking for leadership.
Weekly executive summaries shipped on a fixed cadence; remediation prioritized against severity, not vibes.
Scattered detection tooling and ongoing tuning sprawl across XDR and SIEM platforms — too much noise, not enough signal, and a phishing queue eating analyst hours.
Led multiple endpoint XDR and SIEM platform transitions, owning detection tuning, integration work, and post-migration cleanup.
Separately, drove phishing-response automation across the email security stack — AI-augmented triage, auto-isolation, and clean analyst hand-offs for the cases that still needed eyes on them.
Lower mean-time-to-detect/respond and a phishing-response path that scales beyond headcount.