Ed T.

Incident Response Consultant @Sophos

Conduct identity security assessments for enterprise environments.• Advise customers on remediating poor identity hygiene and improving AD/Entra ID security posture.• Educate clients by demonstrating real-world AD attack techniques and defense strategies.• Serve as an AD/Entra ID SME during incident response investigations involving identity-based intrusions.• Lead recovery efforts for compromised AD environments, including eviction planning and hardening guidance.• Contribute to detection engineering efforts by advising on identity-related threat patterns and attack techniques.• Provide architectural recommendations for long-term identity resilience during active incidents.• Collaborate with internal teams to improve playbooks, detection capabilities, and client runbooks.• Share insights across the IR practice on emerging identity threats and TTPs.