Christian Carrasco
Security & IT Operations Strategist
christiancarrasco.dev · linkedin.com/in/cybercc · github.com/SudoSaute
Keeping systems resilient. Keeping threats out.
Ten plus years in enterprise IT, split between keeping production running and keeping it secure. I’ve led major incident management for Toyota Motor North America’s production applications, run the SIEM in TelevisaUnivision’s security operations center, and administered identity and access across Microsoft environments: Entra ID, Conditional Access, Active Directory, Exchange and Microsoft 365.
Compliance has been part of that work from the IT side. I’ve supported audits and control testing, supplied access records and audit evidence, and helped see findings through to remediation across HIPAA, PCI DSS, ISO 27001 and NIST CSF. It’s an area I enjoy and want to go deeper in, so I’m studying for it: the SSCP in November and the CISSP in December.
In my homelab I’m building out Defender XDR, Microsoft Sentinel and Purview, with a compliance project on the roadmap.
- Experience
- Ten Plus Years in Enterprise IT
- Focus
- Security, Identity and IT Operations
- Languages
- English and Spanish - Fluent
- Studying
- SSCP and CISSP · Nov and Dec 2026
I tailor my resume to each role. Message me on LinkedIn with the position and I'll send the right version.
Microsoft Stack
Used in production
- Microsoft Entra ID
- Conditional Access and MFA
- Active Directory
- Group Policy
- Exchange
- Microsoft 365
- Defender for Cloud Apps
- Office 365 Security and Compliance
Lab roadmap
- Defender XDR
- Microsoft Sentinel
- Microsoft Purview
- Entra ID Protection and PIM
Certified
- Microsoft Certified: Azure AI Fundamentals (AI-900)
Production means I ran it at work. The lab roadmap lives on my Homelab page, with a writeup as each piece lands.
Experience
Beyondsoft Consulting
2021 to 2026Operations Manager, promoted in 2023
2023 to 2026- Commanded high-impact production major incidents end to end: set severity against business impact, coordinated the response across teams, drove restoration, and briefed stakeholders.
- Led a five-person engineering team, owning hiring, performance, and development with minimal turnover, along with the Dynatrace and PagerDuty vendor contracts and budget.
- Owned SLA performance and incident metrics including MTTR, backlog, and repeat-incident rate, investigating breaches and driving corrective action plans to closure.
- Led post-incident reviews and root cause analysis, turning recurring failures into runbook improvements, preventive controls, and problem records.
- Supported the annual ISO 27001 compliance review, giving feedback on remediation plans and residual risk.
Senior/Lead Technical Systems Analyst
2021 to 2023- Administered Microsoft Entra ID across client environments: users and groups, Conditional Access, MFA and password policies, and license audits and reviews, with authentication log reviews as part of access checks.
- Audited client AWS accounts for technical debt and exploitable misconfigurations across IAM policies and security groups, tracking remediation to closure with application teams.
- Responded to AWS Shield DDoS detections by tuning WAF rules and CloudFront configurations to mitigate attack traffic.
- Owned DNS and SSL/TLS certificates across client domains, security-validating record changes before execution to prevent spoofing or hijacking.
- Commanded high-impact production incidents from severity assignment through restoration and client communication.
TelevisaUnivision
2019 to 2020Information Security Analyst
- Triaged SIEM alerts across networks, endpoints, and servers, correlating events to reconstruct incident timelines.
- Investigated spear-phishing campaigns aimed at senior staff and delivered end user security awareness training.
- Lead LogRhythm administrator: built correlation rules, wrote custom parsers for malformed log sources, and mapped detection coverage to MITRE ATT&CK.
- Planned and executed the SIEM migration onto a restructured server architecture, then validated coverage so monitoring did not silently degrade.
- Worked in Microsoft Defender for Cloud Apps (then Cloud App Security) and the Office 365 Security and Compliance Center, whose compliance tools are now Microsoft Purview.
- Supported PCI DSS audit and control testing.
Cigna HealthCare
2014 to 2019Technical Support Analyst
- Administered Active Directory and Azure AD (now Microsoft Entra ID), Exchange permissions, Group Policy, and MFA, applying least privilege at provisioning and treating revocation at termination as a controlled step.
- Level 3 escalation point for a support team of four serving roughly 350 employees in a HIPAA-regulated environment.
- Built the standard PXE images and SOPs behind onboarding and offboarding, and deployed endpoint detection and antivirus agents.
- Supplied access records and audit evidence through HIPAA audit cycles to business owners and internal auditors.
Commonwealth-Altadis
2013 to 2014IT Support Specialist
- Imaged and deployed more than 300 machines supporting a sales force of over 1,500 agents.
- Provisioned Active Directory accounts and OU changes, and kept ServiceNow asset and user records accurate.
Certifications
Active
- Microsoft Certified: Azure AI Fundamentals2024 (active)
- LPI Linux EssentialsLifetime (active)
- CompTIA Project+Lifetime (active)
- CompTIA Cloud Essentials+Lifetime (active)
In progress
- ISC2 SSCPTarget Nov 2026 (in progress)
- ISC2 CISSPTarget Dec 2026 (in progress)
Previously held
- Cisco CCNA Routing & Switching2020 to 2023 (previously held)
- CompTIA Security+2019 to 2022 (previously held)
- EC-Council Certified Ethical Hacker (CEH)2019 to 2022 (previously held)
- AWS Certified Cloud Practitioner2019 to 2022 (previously held)
- CompTIA A+2018 to 2022 (previously held)
- ITIL 4 Foundation2019 to 2023 (previously held)
Compliance and Frameworks
Regulatory
- CMS
- HIPAA
- ISO 27001
- PCI DSS
Frameworks
- ITIL v4
- MITRE ATT&CK
- NIST CSF
Hands-on support
- Control testing
- User access reviews
- Risk acceptance on exceptions
- Findings tracked to closure in ServiceNow
- Audit evidence
Tools and Platforms
Microsoft
- Microsoft Entra ID
- Conditional Access
- Active Directory
- Group Policy
- Exchange
- Microsoft 365
- Microsoft Defender for Cloud Apps
- Office 365 Security and Compliance (now Purview)
- Windows Server
- Hyper-V
- Microsoft Azure
Security
- LogRhythm
- Sophos
- Cylance
- Check Point
- Cisco Umbrella
- Imperva
- Vulnerability Management
- Wireshark
Cloud
- Amazon CloudFront
- Amazon Route 53
- AWS Shield and WAF
Operations
- ServiceNow
- Dynatrace
- PagerDuty
- Jenkins
- KACE
- Password Safe
- FACETS
Infrastructure
- Linux
- PXE imaging
- VMware
Education and Competitions
Western Governors University
2017 to 2021- B.S. Network Operations and Security
- Competency-based degree covering network design, network operations, and network and cloud security, with industry certifications built into the program. Completed while working full time.
National Cyber League
2020- Individual Game, Cyber Skyline
- Hands-on skills assessment scored on accuracy and completion across nine challenge modules. Spring 2020 season, climbing from the top 11.2% in Fall 2019 to the top 6.3% and adding 285 points.
- Spring 2020: ranked 338th of 5,356 players (top 6.3%) with 1,755 of 3,000 points at 79.5% accuracy and 74.8% completion. Strongest in OSINT, wireless access exploitation, network traffic analysis, password cracking, cryptography, and log analysis.
National Cyber League
2019- Individual Game, Cyber Skyline
- Hands-on skills assessment scored on accuracy and completion across nine challenge modules. Fall 2019 season.
- Fall 2019: ranked 463rd of 4,147 players (top 11.2%) with 1,470 of 3,000 points at 72.9% accuracy and 65.3% completion. Strongest in OSINT, cryptography, wireless access exploitation, network traffic analysis, and password cracking.