Micheal Hayes

Security-focused Systems Engineer with 6+ years in enterprise IT, specializing in identity security, endpoint protection, cloud security, and incident response across Microsoft, Google, and AWS environments.

At Movember

Foundation, leads security operations spanning Microsoft Sentinel SIEM, Defender for Endpoint, JAMF Protect, and Entra ID - building detection pipelines, automating threat response, and securing a globally distributed workforce. Proven track record implementing zero-trust architecture, hardening identity and access controls, and driving security maturity across complex multi-cloud environments. Strong scripting capability in PowerShell, Bash, and API-driven automation.

Systems Engineer (Security & Infrastructure) at Movember Foundation Australia (2022-06 – Present)

• Operate Microsoft Sentinel SIEM: build analytics rules, KQL detection queries, and automated playbooks for threat detection and incident response across Azure, AWS, and M365 environments
• Investigated and remediated high-volume CloudTrail ingestion anomaly (78% of daily volume from KMS Decrypt events); implemented Advanced Event Selectors to suppress noise and reduce cost.
• Lead incident response investigations for identity-based threats including account lockouts, Smart Lockout triggers (error 50053), and suspicious access patterns across Entra ID
• Deploy and operate Microsoft Defender for Endpoint and JAMF Protect for real-time endpoint threat detection, behavioral monitoring, and forensic investigation across macOS and Windows fleets
• Conducted org-wide GCP API key security audit across 16 projects following Truffle Security disclosure; identified and immediately rotated unrestricted Vertex AI key with no exploitation evidence confirmed
• Author post-mortems and improvement actions following security incidents; coordinate with Microsoft Support and vendor security teams for critical issue resolution
• Administer Entra ID (Azure AD) for 300+ global users: design and enforce Conditional Access policies, MFA requirements, SSPR, and Privileged Identity Management controls
• Lead SCIM provisioning architecture and troubleshooting - resolved critical deprovisioning gap (JIT vs SCIM mode conflict) preventing timely account removal for departed staff
• Implement and maintain SAML/SSO integrations for enterprise SaaS platforms (Sanity.io, Tableau Cloud, Atlassian, Box, Parkable, Collate) via Entra ID; troubleshoot federation errors and sign-on URL misconfigurations
• Deploy JAMF Connect with Platform SSO extension for zero-touch Mac authentication against Entra ID, eliminating local account sprawl and enforcing identity-bound endpoint access
• Manage Salesforce–Microsoft Graph integration security; audited and remediated permission scopes ahead of EWS retirement, ensuring least-privilege OAuth access
• Bulk-remediated ~295 offboarded user accounts; implemented dynamic group rules and extension attribute controls to enforce access boundaries
• Own DNS infrastructure and email authentication (SPF, DKIM, DMARC) for Movember's domains; enforce reject-level DMARC policy and manage DNS records across Azure and external registrars for SaaS integrations and anti-spoofing controls
• Manage security configuration of macOS fleet (JAMF Pro, JAMF Protect) and Windows fleet (Microsoft Intune, Defender for Endpoint) - 300+ devices across global offices
• Deploy and enforce browser security policies via JAMF Pro (macOS) and Intune (Windows): extension allowlists/blocklists, certificate pinning, and enterprise SSO enforcement
• Implement Zscaler zero-trust network access including auto-authentication on boot; migrated corporate traffic filtering from perimeter to identity-aware proxy model
• Built PKI infrastructure (OpenSSL root CA + Windows Server Subordinate CA) for SCEP-based certificate enrollment, targeting 802.1X network authentication via JAMF Pro
• Deploy and manage CrowdStrike-equivalent tooling (Defender for Endpoint + JAMF Protect) for behavioral threat detection, EDR, and endpoint compliance enforcement
• Secure and monitor Azure, AWS, and GCP environments; own Sentinel data connectors including AWS CloudTrail S3 via SQS-driven pipeline and Microsoft 365 audit logs
• Develop security automation in PowerShell, Bash, and REST API: automated Jira ticket creation for endpoint compliance failures, offboarding scripts, and Graph API-driven access remediation
• Manage network security infrastructure via Cisco Meraki MX250 firewalls and SD-WAN; investigated and resolved WAN outages with upstream ISP coordination
• Lead Tableau–Snowflake OAuth migration: retired password-based authentication for 64 data sources, enforcing MFA and OAuth 2.0 for service account access

Lead Technical Operations Engineer at Ilume (2020-10 – 2022-06)

• Built and maintained Microsoft Azure environment, administered identity management, access controls, and security monitoring
• Owned end-to-end security checks: network, backups, databases, antivirus, and CCTV/physical security systems
• Managed L1–L3 service desk with escalation ownership; onboarded and offboarded team members with access provisioning and machine builds
• Administered Google Workspace (super admin), Dynamics 365, and software license/asset inventory

IT Support Analyst at Sleeping Duck (2019-05 – 2020-09)

• Provided technical support for network, connectivity, and endpoint issues; managed onboarding/offboarding lifecycle

Technical Officer at RMIT University (2019-01 – 2020-05)

• Face-to-face technical support for staff and students; hardware/software installation and fault resolution

Higher Diploma in Software Design & Development – National University of Ireland Galway

Bachelor of Arts in Economics & Irish – University College Cork (UCC)