Rob Carson

IT Infrastructure Soc Specialist @DAC Beachcroft

The role contains two parts, implementing and maintaining security best practise and threat hunting: Security best practise:* Involved with 2012r2 decommission project.* Disabled Basic and other legacy authentications for cloud.* Implemented a secure Conditional Access for a complex environment, while maintaining an excellent user experience for authentication.* Heavily involved in Cyber Essentials Plus Accreditation (5 years) including MDM, SSO and Conditional Access.* Following Microsoft Security Score for best practise.* Implementing MFA number matching for everyone and everything, including 3FA for administrative accounts.* Compliance policies for mobiles including root/jail break detection and timely installation of updates.* Implemented Microsoft Defender for mobiles.* Strengthen Mimecast, Tessian and ZScaler policies.* Advising on Employment phishing training. Threat Hunting:* Utilising Microsoft Sentinel, Defender and Darktrace for threats alerted from our external SoC team.* Picking up on trends to either suppress alerting or take action to prevent reoccurrences.* Discussing alerts with customers as part of alert investigations I still play an active role with Messaging services such as Exchange, Teams and Intune as they are normally heavily involved with understanding threats.