David Reavis Email & Phone Number

New York, Ny, Us

-Acting SME for any use cases related to Azure Sentinel.-Lead migration from Splunk to Sentinel-Plan, POC and implement SOAR (Playbooks, Workbooks, Notebooks)-Facilitate training and education on the benefits of MSFT Sentinel.-Demonstrate SME of KQL by utilizing functions, writing hunting queries and analytical queries.-Gather use cases on current processes that can be automated using MSFT Sentinel's SOAR capabilities.-Utilize Logic Apps for automating KQL reports, importing 3rd party data to Sentinel using the Sentinel API and completing other use cases.-Manage multiple Linux VMs for Syslog/CEF. Demonstrate advanced knowledge of Linux (Ubuntu) -Utilize CI/CD to manage multiple Sentinel instances, project management and change control.-Maintain up-to-date knowledge on changes coming to Sentinel and how those changes may impact the solution.-Secure all Sentinel instances utilizing tools such as RBAC.-Design Security Data Pipelines that eliminate false positives and create actionable data points.-Maintain reporting that utilizes Power BI for creating dashboards and enriching data. Make sure the data is clear, actionable and easily readable.-Make sure all customer requirements are met and customer satisfaction stays at 100%.-Assist with developing the company's AI strategy for quarter 4 implementation.

Redmond, Washington, Us

Have a customer obsessed attitude at all times and maintain a CSAT score of above 4.80 (Currently my CSAT score is 5)Acted as SME for Playbooks (Logic Apps)Acted as a consultant for advanced scenarios utilizing Azure Sentinel's SOAR capabilities. Those scenarios included but were not limited to:-Multitenant Scenarios where a MSSP needed logs for 10+ customers using 10+ different Sentinel Workstations; without using Azure Lighthouse-Scenarios such as automating Azure AD Incident management including on-boarding/offboarding users, hunting for inactive accounts, managing entitlement, automatically identifying and remediating malicious activity caught using Azure Identity Protection and hunting for Social Engineering.-Acted as a consultant for utilizing Microsoft Security Graph with Playbooks for creating tools that could further extend Azure Sentinel's SOAR capabilities.-Importing custom logs into Sentinel using custom connectors, Microsoft Security Graph and Azure Monitor Agent.-Advanced VM management in Microsoft Endpoint Protection using Policy and Microsoft Defender Antivirus.-Automated managing Keys, Secrets and Certificates using Key Vault and Microsoft Security Graph.-Utilize the Microsoft Security Graph without exposing traffic to the internet (Using a VNET and Private Endpoint with Standard Logic Apps)-Extending the capabilities of Playbooks beyond the OOTB Connectors by guiding customers through use cases and POCs for Microsoft Security Graph.-Guided Customers on using other security automation features for Playbooks such as the connectors for Microsoft Defender, Azure Identity Protection, Azure Active Directory, Azure AD with HTTP, using HTTP in environments with a Private Endpoint and VNET, Microsoft Graph Security and Azure AD App Registration.-Act as SME for helping customers design their SEIM/SOAR solutions in accordance with compliance and Microsoft's best practices/recommendations.-Acted as SME for all cases related to XDR.

Implemented company Governance Strategy for the IAM domain. This included but is not limited to:-Automated the provisioning and deprovisioning of a user's access to company resources by extending the capabilities of Azure AD across third party apps(Implemented SSO). Those resource include but are not limited to, Microsoft Office/365 Suite, Salesforce and Adobe.-Acted as SME for XDR.-Designed and implemented automating the provisioning and deprovisioning of laptops, desktops and phones while also tracking their usage by utilizing Microsoft Intune. Implemented SSO on all devices (except Apple devices) by moving from an architecture that was using Azure AD registered to using Azure AD Joined.-Designed and Implemented Conditional Access Policies that include but are not limited to: -Made it impossible to sign-in from anywhere outside the US. -Implemented Session control. -Automatically blocked a user that had not signed in in 3 days (High Turn Over Roles Only). -Automatically blocked a user that had an unusual travel pattern according to sign-ins.-Designed and Implemented Microsoft Sentinel for Advanced Threat Hunting scenarios. Identified Malicious IPs, Compromised Accounts, cut down on Superusers, Utilized SIEM for manual Incident Management while creating strategies to move processes to SOAR.-Utilized Microsoft's Bot framework as a way to manage documents and walk Helpdesk associates through advanced business processes.By implementing these processes, I eliminated 98 percent of the company's overall waste which saved the company over 1.2 million USD.Acted as POC and SME for setting up Windows Autopilot, Intune Enrollment, Apple Business Manager and Microsoft ATP.Used Intune for quickly pushing Policies to all devices including Mac OS, Linux, Windows, Apple Mobile Devices and Android.Acted as SME for automating Security events by writing advanced scripts in Azure Automation utilizing PowerShell and doing the same for Logic Apps.

Bentonville, Arkansas, Us

Assisted managers with onboarding and offboarding batches of users at once (100+)