
AtriCure
IT security and infrastructure co-op, Mason, OH · –
Worked phishing triage, identity auditing, and security automation on the IT security team at a medical device company.
I spent the summer on the IT security and infrastructure team. After about two weeks of onboarding, the daily phishing queue was mine to work. Alongside it I designed and built the Cloudflare-to-Sentinel ingestion as a production Azure Function, and did audit work in Entra and Defender for Cloud Apps, most of it careful, one-item-at-a-time review rather than a single report.
- Triaged 294 user-reported emails in Defender XDR and PhishER using SPF/DKIM/DMARC, header, sandbox, and KQL analysis; remediated with deletions, quarantine decisions, and blocks.
- Designed and built a production Python Azure Function that brings Cloudflare Security Insights notifications into Microsoft Sentinel through Azure Monitor data collection rules.
- Audited single sign-on configuration, SAML/OIDC protocols, and certificate status across the company's Entra enterprise applications, and reported the results to security leadership.
- Configured KnowBe4 executive phishing reports and presented phishing-trend data at SecOps meetings.
- Investigated unsanctioned cloud application use with Defender for Cloud Apps and KQL, and escalated findings to security leadership.
- Supported identity reviews in Entra ID, Microsoft Graph, and Purview, and investigated sign-in alerts.