Demar Parkes

Cybersecurity and IT professional with proven experience securing hybrid cloud and on-premises environments. Skilled in endpoint protection, identity management, and incident response using tools such as SentinelOne, Datto EDR, and Microsoft 365 Security. Adept at managing Active Directory, Azure AD, and MFA integrations (Okta, Duo, JumpCloud) to enforce least-privilege access and reduce risk exposure. Experienced in vulnerability management, threat monitoring, and compliance frameworks including HIPAA and ITIL 4. Certified in CompTIA Security+, CySA+, (ISC)² SSCP, and ITIL 4, with a focus on proactive defense, system hardening, and continuous improvement of security operations.

• Comptia A+
• Comptia Network+
• Comptia Security +
• Pentest +
• CySA+
• SSCP
• ITIL 4

Windows Defender Deployment & Endpoint Hardening — SentinelOne/Defender, GPO, PowerShell

• Deployed and configured Microsoft Defender across workstation fleet; implemented real-time protection, centralized policy, and scheduled scans.
• Hardened endpoint configurations via GPO and PowerShell automation to reduce attack surface and enforce agent compliance.

Wazuh SIEM Implementation & Log Pipeline — Wazuh, Sysmon, Winlogbeat, ELK

• Built a Wazuh server for centralized log collection and detection; onboarded Windows devices via Wazuh agents.
• Configured Sysmon and Winlogbeat to forward rich telemetry (process creation, network connections, file events) to the SIEM for correlation and alerting.
• Tuned rules to reduce false positives and improve visibility into suspicious activity.

Malware Analysis Workflow with VirusTotal — VirusTotal, SHA256 hash analysis

• Integrated VirusTotal hash lookups into incident triage processes to quickly classify suspicious binaries and prioritize response.
• Used hash-based indicators to enrich alerts and inform containment/remediation decisions.

Adversary Emulation Lab: Kali → Windows VM — Kali Linux, Metasploit, Windows VM, Wazuh

• Performed controlled attack simulations against a sandbox Windows VM to validate detection coverage and log fidelity.
• Mapped attacker techniques to logged events, identifying gaps in telemetry and enhancing detection rules.

Honeypot Research & Network Reconnaissance — Cowrie/Dionaea (honeypot), network monitoring

• Developing a productionized honeypot to capture reconnaissance and lateral movement attempts; analyzing attacker behavior to refine IDS/SIEM signatures.
• Using collected TTPs to prioritize hardening tasks and update detection logic.

Software: Datto RMM, SentinelOne, JumpCloud, Zorus, Datto EDR, Mosyle, ConnectWise, ScreenConnect, Webroot, KnowBe4, MS Sentinel