Syed Dayaan Shah

Jan 2026 — Present

Remote

• Triage roughly 25–40 SIEM, endpoint, and identity alerts per shift across Microsoft Sentinel and Defender XDR, closing about 85% at my level with a documented determination.
• Investigate Entra ID account-takeover attempts — risky sign-ins, MFA fatigue, token replay — and contain confirmed compromise the same shift, cutting alert-to-containment from hours to under 45 minutes.
• Analyze 50–70 phishing and BEC reports a month with Defender for Office 365, Mimecast, message trace, VirusTotal, and urlscan.io; purge campaigns tenant-wide and tune transport rules.
• Maintain EDR coverage across ~1,500 endpoints (Defender for Endpoint, SentinelOne) and run PowerShell + Microsoft Graph sweeps for bulk sign-in and mailbox-rule audits.
• Map findings to MITRE ATT&CK and document incidents against NIST 800-61 so scope, root cause, and containment are defensible in client review.

Aug 2025 — Jan 2026

Remote

• Delivered security-focused Tier 1–2 support across SMB and enterprise Microsoft 365 hybrid tenants — identity, endpoint, access control, and network incidents.
• Administered Microsoft 365 and Entra ID: MFA enforcement, Conditional Access, provisioning, mailbox security, and authentication troubleshooting.
• Escalated suspicious sign-ins and account-compromise events to the security team with clean evidence timelines, which led to the move into the security operations seat.

Jan 2025 — Aug 2025

Houston, TX

• Worked a live queue of 25–40 endpoint and email alerts per shift, escalating confirmed incidents with full timeline, IOCs, and containment recommendation.
• Analyzed 30–40 phishing messages a month using VirusTotal, urlscan.io, and AbuseIPDB; blocked sender infrastructure and pulled matching mail across tenants.
• Hunted beaconing and DNS anomalies in Wireshark and firewall logs; added detections for repeat offenders.
• Ran Nessus and OpenVAS cycles with CVSS-based prioritization, driving critical and high findings down across client sites and verifying with re-scans.

Aug 2024 — Jan 2025

Houston, TX

• Conducted wireless site surveys; optimized AP placement, VLAN/SSID design, and interference minimization.
• Deployed and hardened WAPs across client campuses, tightening 802.1X/WPA2-Enterprise auth and hunting rogue APs.
• Implemented proactive monitoring and configuration audits to keep networks compliant and performant.

Jan 2024 — Aug 2024

Houston, TX

• Provided Tier 1–2 support for 15+ SMB clients, resolving 20–30 tickets a day via RMM tooling.
• Managed Active Directory, DNS, DHCP, and Microsoft 365 (user creation, MFA setup) to maintain 99% uptime.
• Collaborated with network engineers on secure infrastructure across multi-tenant environments.

Mar 2023 — Jan 2024

Houston, TX

• Supported 10–15 security investigations a week across firewall, endpoint, and email telemetry.
• Assisted with firewall administration, detection tuning, and real-time threat monitoring.
• Ran vulnerability assessments with CVE triage and tracked patch remediation to completion on Windows and Linux endpoints.