Experience
What I built and what it changed. I keep employers' internal details off this site, so this is about outcomes, not anyone's network.
Regional bank, 14 sites
Promoted after six months, and most of what follows was built before the promotion. I'm the sole owner of 25+ tools and programs, about 60,000 lines of PowerShell in production.
Compliance and audit automation
- Built a five-module audit engine that turns raw exports and live API data into monthly FFIEC evidence packages covering CIS Controls 1 to 10. Every rule and threshold lives in versioned config, evidence is sealed with SHA-256 hashes, and the trend history is append-only.
- Built the dashboard that turns CIS benchmark results into a per-rule, per-device remediation guide. The team worked from it during the baseline Group Policy rollout, which brought workstations, servers and domain controllers to 88.32% compliance within three months.
- Built an executive dashboard of 30+ live charts from the audit history, presented to leadership several times.
Identity and Active Directory
- Led the rollout of passwordless MFA across every server and workstation.
- Flagged the domain's expiring certificate authority to management and helped build its replacement.
- Reviewed all of the domain's Group Policy, about 180 objects, and refactored it toward a CIS baseline.
- Built a known-good baseline of groups, OUs and printer mappings ahead of a company-wide OU migration, so policy coverage carried over intact.
- Wrote a 5,000-line, read-only Active Directory health diagnostic: replication and SYSVOL, DNS consistency between servers, rogue DHCP, time and FSMO, site coverage, USN rollback, lingering objects and duplicate SPNs.
Security operations
- Expanded vulnerability scanning to fully credentialed scans at all 14 sites, with an additional scan engine and SNMPv3 coverage for network gear and printers.
- Ran controlled endpoint and data-loss validation tests using synthetic data, and made security-tool blocks show up as real failures in deployment reporting instead of false successes.
- Handle endpoint and phishing alerts end to end, including after-hours triage.
Deployment and infrastructure
- Built a deployment framework of 15 PowerShell templates behind 162 packages, with protected logging and argument masking, certificate and registry injection, process-tree completion watching and post-install verification. Every package has a tested removal path; one fleet-wide removal finished in under six minutes.
- Rolling out a new endpoint and network security stack through that framework.
- Led a 10-site core banking application server migration after hours, with backups and snapshots before every step, pausing any site whose backups weren't healthy.
- Built asset discovery that fuses six data sources on MAC address into one inventory and per-site topology diagrams, keeping every raw value for auditors.
- Built an imaging pipeline that provisions a laptop in under 30 minutes, and retired 13 servers.
Documentation
- Wrote 32 SOPs and a coding standard for my tools, and built an AES-256 encrypted secrets vault so no tool keeps credentials in plain text. If only one person can run it, it isn't finished.
Community bank
Cleared 232 tickets in my first 45 days, automated recurring tasks with PowerShell, and built a knowledge base the team still uses.
Before IT
Nine years running a regional furniture distribution hub: staffing, logistics and the daily operation. It taught me most of what I know about running things that can't stop.