Professional background
Experience beyond the job title.
What I worked on in enterprise healthcare IT, which tools I used and how that experience relates to security operations and identity management.
Service Desk Analyst (Level 1) / SonicIT
Supporting a large healthcare environment across identity, endpoints, Microsoft 365, network access and incident management. My role was Level 1 IT operations, with practical security-adjacent responsibilities—not dedicated SOC employment.
Identity & access management
Entra ID, Active Directory, MFA
- Investigated failed sign-ins, authentication methods, account state, registered devices, licence assignments and group membership in Microsoft Entra ID.
- Created, unlocked, disabled and moved accounts in Active Directory; supported onboarding/offboarding and group access changes.
- Validated requester authority and manager approval before changes; refused or escalated requests lacking permission.
Security-relevant investigation
Event Viewer, sign-in logs, mail traces
- Used Windows Event Viewer, application and device logs, Entra sign-in records, email message traces and available VPN/network diagnostic information to narrow issues.
- Assessed user-reported phishing indicators, guided safe handling and escalated concerns to the cybersecurity team.
- Documented checks, timestamps and observed results to support specialist escalations; this was IT incident work, not dedicated SOC operations.
Endpoint & Microsoft 365
Intune, Exchange Online, Teams
- Checked device enrolment, compliance and policies in Intune; actioned approved retire, wipe or synchronisation requests.
- Investigated shared mailboxes, Exchange permissions, distribution lists, forwarding, Teams, SharePoint, OneDrive and email delivery using tracing tools.
Network & remote connectivity
VPN, DNS, DHCP, certificates
- Troubleshot FortiClient/VPN, RDP, certificates, DNS, DHCP and connectivity faults using command-line and remote-support diagnostics.
- Distinguished account-specific configuration issues from broader connectivity/service incidents before recommending next steps.
Incident management & escalation
ServiceNow, prioritisation, on-call handover
- Handled tickets in a high-volume clinical and corporate support environment, documenting the relevant user/device context, troubleshooting and outcomes.
- Worked overnight as the sole Level 1 analyst alongside an L2 colleague, assessing severity, prioritising service impact and coordinating urgent on-call escalation.
- Applied business-impact criteria to a ward printing issue initially described as Priority 1, ensuring it was instead handled at an appropriate Priority 2 level.
How I work
Investigate before assuming a cause. Make authorised changes only. Capture useful technical evidence. Escalate when impact, access or uncertainty exceeds Level 1 responsibility. These habits matter in security teams as much as in support.
Read the incident investigation case study ↗