Open to new roles

Patrick Ngenzi

I help you secure identity, cloud, endpoints, and networks without slowing operations.

I have spent 5+ years securing Microsoft identity, Azure, endpoints, networks, and production web platforms across public-sector, telecom, service-desk, and client environments. I focus on practical controls, measurable risk reduction, and clear handoff documentation so your team can keep operating confidently after implementation.

I got into security because I like solving hard puzzles that directly protect people, systems, and business continuity.

View Projects Contact Me Resume

Scroll

1,000+

Endpoints supported

Identity, endpoint, access, connectivity, and availability support in a multi-site public-sector environment.

150+

Monthly incidents mitigated

Malware and security events triaged through ESET, SolarWinds, Defender-style workflows, and clear escalation notes.

25%

Firewall exposure reduced

Policy cleanup and approved access-path validation while maintaining operational connectivity.

Years in IT and security

Hands-on across cybersecurity operations, IAM, cloud security, network support, and secure web platforms.

Practice

Security work focused on measurable risk reduction.

I design controls your team can operate, audit, and improve over time, from IAM and cloud hardening to network defense and secure delivery workflows.

Identity and Access

Entra ID, Active Directory, RBAC, MFA, Conditional Access, onboarding/offboarding, and access review discipline.

Cloud Security

Azure VM, VNet, NSG, VPN Gateway, Microsoft Sentinel, Defender, and Log Analytics hardening.

Network Defense

Fortinet and Palo Alto firewall cleanup, VLAN segmentation, WPA3, Aerohive WAPs, VPN, IDS/IPS concepts, and Wireshark validation.

DevSecOps and Server Operations

PowerShell and Python automation, secure deployments, DNS/SSL/hosting support, client platforms, and operational runbooks.

Project Deep Dives

Case studies you can quickly map to your security priorities.

Each case study shows the challenge, my execution approach, the tools used, and the measurable security outcome.

Security case study

Zero-Trust Access Hardening Program

Problem

The organization had inconsistent identity controls across Azure and Microsoft 365, which increased account takeover risk.

My role and actions

I mapped privileged and non-privileged access paths, then rebuilt role-based access around least privilege.
I implemented Conditional Access, MFA enforcement, and legacy-authentication blocking with staged rollout checkpoints.
I documented onboarding/offboarding and access-review playbooks so your team could sustain the controls after launch.

Tools used

Microsoft Entra ID (Azure AD)
Conditional Access
Microsoft Sentinel
PowerShell

Outcome: Reduced high-risk sign-in exposure by 32% and cut excessive permissions by 19% within one quarter.

Security case study

Firewall and Segmentation Modernization

Problem

Open and legacy firewall rules made it difficult to prove approved access paths and increased lateral-movement risk.

My role and actions

I analyzed traffic flows and rebuilt firewall policy around business-approved ports, services, and trust boundaries.
I implemented VLAN segmentation for staff, guest, IoT, and server zones, then validated packet flow with rollback plans.
I created a repeatable review cadence and change-control documentation for policy lifecycle management.

Tools used

Fortinet
Palo Alto
Wireshark
Network ACL and VLAN design

Outcome: Reduced external firewall exposure by 25% while preserving production connectivity and support SLAs.

Security case study

DevSecOps Platform Rollout and Monitoring

Problem

A multi-service platform needed safer deployments, stronger runtime observability, and clear incident-response workflows.

My role and actions

I implemented CI/CD quality gates, security checks, and controlled rollout sequencing for reliable releases.
I standardized containerized service deployment patterns, reverse-proxy security headers, and health/readiness checks.
I built operational runbooks so your team could triage incidents quickly with consistent evidence.

Tools used

Jenkins
Docker and Docker Compose
Nginx
SIEM and monitoring workflows
Terraform

Outcome: Improved release reliability by 40% and lowered mean time to detect critical runtime issues by 35%.

Selected Work

Projects aligned to your target security and DevSecOps roles.

I organize projects around outcomes so you can quickly evaluate architecture decisions, implementation quality, and operational discipline.

All projects

AI Security Operations / SOC Automation

Intelligent Security Alert Triage Engine

Built an intelligent security alert triage engine with Python 3.11 and Streamlit. The system ingests SIEM-style alerts, classifies true and false positives, assigns risk and severity, maps relevant events to MITRE ATT&CK techniques, and writes enriched audit records for analyst follow-through.

Implemented LLM-assisted triage with structured JSON validation, retry handling for malformed output, and deterministic fallback classification when AI services are unavailable.

Python 3.11
Cybersecurity Automation
SIEM Alert Triage
MITRE ATT&CK

Cloud Security / IAM / Sentinel

Azure Hybrid Network and IAM Security Architecture

Enterprise-style hybrid security architecture for an education environment. The project combines segmented Azure VNets, simulated on-prem connectivity, Entra ID governance, Conditional Access, RBAC, MFA, and Microsoft Sentinel detections.

Designed two VNets, eight subnets, VPN Gateway connectivity, and 15+ NSG rules to separate Staff, Students, Servers, and gateway traffic.

Microsoft Azure
Microsoft Entra ID
Conditional Access
MFA

Network Security / Segmentation

Enterprise Network Segmentation and Security Lab

Network-defense case study focused on segmentation, firewall policy design, and validation. It models how staff, student, guest, IoT, VoIP, and server traffic should be isolated and tested in an enterprise environment.

Mapped topology, trust boundaries, and approved flows so firewall rules are tied to business purpose instead of open-ended access.

Cisco
Fortinet
VLAN
Site-to-Site VPN

DevSecOps / Full-Stack / Operations

Neotha - Owner-Led Platform, Client Support, and Server Operations

Owner-led technology platform and client-service work where I build frontend and backend systems, support customers, manage hosting/server environments, and apply secure deployment habits to live business platforms.

Deliver production websites and client systems with React/Next.js, TypeScript, backend integration, SEO metadata, responsive UI, and accessibility-aware interfaces.

Next.js
TypeScript
React
Tailwind CSS

Security Operations / Automation

Network Monitoring and Security Automation Initiative

Monitoring and automation initiative shaped around real support work: availability signals, security follow-up, stale-account review, event-log collection, and repeatable documentation for faster troubleshooting.

Used SolarWinds/PRTG-style monitoring patterns to centralize availability and operational security signals.

SolarWinds
PRTG
PowerShell
Event Logs

Technical Skills

Technical strengths organized around business impact.

I use these capabilities to improve your security posture, accelerate incident response, and keep production operations stable.

Full skills map

AI Security Triage Engineering

I design AI-assisted SOC workflows that classify alerts, score risk, and produce auditable analyst guidance with deterministic fallback behavior.

Local LLM integration
SIEM alert normalization and triage
MITRE ATT&CK event mapping
Risk scoring and response recommendation generation

Identity and Access Security

I protect accounts and privileges so your users can work securely without unnecessary friction.

Microsoft Entra ID (Azure AD)
Conditional Access
MFA enforcement
RBAC and access reviews

Cloud Detection and Hardening

I combine cloud hardening with operational detections so your team can respond before issues escalate.

Azure NSG and VM hardening
Microsoft Sentinel
Log Analytics
GCP IAM and Cloud Security Command Center

Endpoint and Device Governance

I secure endpoints with policy, visibility, and follow-through that your support teams can sustain.

MaaS360 inventory and endpoint management
Defender for Endpoint
ESET response workflows
Patch and vulnerability coordination

Network and Infrastructure Security

I reduce attack surface while preserving availability across firewall, segmentation, and proxy layers.

Fortinet and Palo Alto firewalls
VLAN segmentation and VPN controls
Nginx reverse proxy hardening
Wireshark traffic validation

DevSecOps and Reliability

I embed security checks into delivery pipelines so your releases stay fast, controlled, and auditable.

Jenkins and GitHub Actions
Docker and Compose
Security gates and env validation
Health-check and rollback workflow design

Client Platform Engineering

I deliver production-ready web platforms with measurable quality, security-minded operations, and clear communication.

Next.js and React
TypeScript and API integration
DNS and SSL/TLS operations
Server management and client support

Credentials

Credentials and certifications.

I pair formal credential progress with field execution across IAM, cloud security, endpoint operations, and network defense.

About and resume

01Certified

CompTIA Security+

CompTIA

Last updated: May 2026

Threat, attack, and vulnerability identification
Risk management and risk mitigation techniques
Threat management operations
Intrusion detection practices
Core cybersecurity function readiness

View credential

02Certified

Google Cybersecurity Certificate

Google / Coursera

Last updated: May 2026

03In Progress

Microsoft SC-300: Identity and Access Administrator

Microsoft

Last updated: May 2026

Contact

If you need practical security outcomes, I can help you move from ideas to verified implementation.

Contact Me