I build hands-on labs around how organizations control who gets access to what — single sign-on, federation, MFA, least privilege, and the identity lifecycle. My foundation is in security operations (threat hunting, vulnerability management, and STIG/CIS hardening), which shapes how I approach IAM: every access decision is also a security decision.
🎯 Goal: A long-term career in Identity & Access Management
🔨 Currently: Building IAM labs across Microsoft Entra ID, SAML, OIDC, LDAP, and access governance, and studying for Microsoft SC-300 (Identity and Access Administrator)
| Lab | What I Built |
|---|---|
| Microsoft Entra ID Identity Administration | Secured a self-built Entra ID tenant across six labs: user and B2B guest lifecycle, bulk CSV provisioning, dynamic groups and group-based licensing, PIM role assignments, smart lockout and banned passwords, SSPR, MFA, and Conditional Access tested in Report-only with What If |
| SAML 2.0 SSO with Auth0 | End-to-end SAML federation between an IdP and SP: metadata trust exchange, SP-initiated SSO, assertion and attribute analysis in SAML-tracer, brokered Google login, and Single Logout troubleshooting |
| Keycloak SSO & Access Control | A full identity realm with OIDC, group-based RBAC, TOTP MFA for privileged users, JWT and token introspection, brute-force detection, and joiner-mover-leaver lifecycle with live token revocation |
| CIS Compliance Assessment — IAM Focus | Raised a payroll server from 59.82% to 99.99% CIS compliance by hardening SSH, PAM, and sudo, mapping findings to NIST 800-53 AC/IA controls, and documenting a risk exception and POA&M |
| LLDAP Least-Privilege Groups | A role-based least-privilege model in LDAP with a read-only SOC role, validated as a non-admin user and confirmed with a privileged-group access review |
| Lab | What I Built |
|---|---|
| JadePuffer — Agentic Ransomware Threat Hunt | Microsoft Sentinel (KQL) investigation of an LLM-agent-driven ransomware attack, from RCE through credential theft, privilege escalation, and impact |
| STIG Remediation | Remediated 10 Windows 11 STIG findings with PowerShell and Group Policy on an Azure VM |
| Vulnerability Management Program | End-to-end vulnerability scanning, prioritization, and remediation workflow |
| Threat Hunt — RDP Compromise | Incident response and threat hunt for a simulated RDP compromise |
| Threat Hunt — TOR Browser | Investigated unauthorized TOR browser use on a corporate network |
Microsoft Identity: Entra ID · Conditional Access · Privileged Identity Management (PIM) · SSPR · MFA · Password Protection · B2B Guest Access · Dynamic Groups · Group-Based Licensing · Bulk User Provisioning
Identity & Federation: SAML 2.0 · OpenID Connect / OAuth 2.0 · SSO · RBAC · LDAP · Joiner-Mover-Leaver · Access Reviews · Zero Trust
Platforms & Tools: Microsoft 365 Admin Center · Keycloak · Auth0 · LLDAP · Microsoft Sentinel · OpenSCAP · Azure · SAML-tracer
Frameworks: NIST SP 800-53 (AC/IA) · NIST SP 800-63B · CIS Benchmarks · DISA STIG
Scripting & Query: KQL · PowerShell · Bash · curl / jq
-C8202F?style=flat){kind=icon}
-0078D4?style=flat){kind=icon}
Always learning. Always building.