Cyber Security Analyst
Bridgehead IT
San Antonio, TX
08.2024 - 02.2026
- Monitored and triaged an average of 50 security alerts per day in Microsoft Sentinel and XDR across ~350 client environments, ensuring timely detection, investigation, and escalation of high‑risk activity.
- Investigated and responded to 10–20 emergency security incidents daily, isolating impacted endpoints and accounts in customer environments ranging from 200 to 1,000+ users and devices.
- Executed endpoint isolation, forensic triage, and incident response support during phishing, malware, and account‑compromise events, reducing containment time and limiting lateral movement.
- Developed and refined KQL queries and detection logic to improve proactive threat hunting and reporting, increasing visibility into suspicious logins and risky endpoint behavior.
- Performed recurring access reviews and audit checks that reduced exposure to insider threats, excessive permissions, and compromised accounts.
- Partnered with client IT teams and senior analysts to remediate findings, harden SaaS-first environments, and document incident response actions in line with internal playbooks.
- Produced clear incident reports and post-remediation summaries for confirmed compromises, translating technical details into business‑focused remediation guidance.
- Participated in a 24/7 emergency on‑call rotation, providing continuous support for critical incidents and urgent client security events.