home / roles / city-university
Technical Product Manager & Senior Systems Engineer · City University of Seattle
Continued part-time
Systems Engineering Consultant (part-time) · Jun 2022 – Jul 2023
Retained through the transition to Bloomberg to hand off the identity and infrastructure estate: knowledge transfer, access transitions, and escalation support for the successor team.
Eight years owning the university's technology estate end to end, from diagramming infrastructure inefficiencies that became a $2.8M modernization program to directing the migration to Microsoft Azure with secure hybrid connectivity and redundant failover, while running tenant-wide security and compliance across Microsoft 365 and passing every annual third-party audit.
Role & Responsibilities
- Diagrammed the infrastructure until the inefficiencies had nowhere to hide, then built the business case that became a one-year $2.8M program coordinating three vendors, five teams, and ten network products, the anchor of a two-year network infrastructure upgrade delivered through the first U.S.–China tariff war's hardware delays and cost escalations.
- Directed the migration to Microsoft Azure Cloud, delivering secure hybrid connectivity via a site-to-site VPN gateway and a redundant tertiary failover environment.
- Owned identity and access management for Azure resources and resource groups through Azure RBAC, scoping every role assignment to the least privilege possible.
- Built and ran the Azure network layer: virtual networks, VPN gateways, connections, and peerings, network security groups with inbound and outbound firewall rules, subnets, and DNS zones providing tertiary DNS redundancy.
- Deployed Azure Virtual Desktop (formerly Windows Virtual Desktop) workspaces for secure access to applications and resources, and gated server resources behind Just-in-Time access.
- Ran core network and infrastructure services — Active Directory, DNS, DHCP, switches, firewalls, and wireless — across a hybrid environment of over 100 servers with redundant failover.
- Deployed a collaboration platform on Azure DevOps with Terraform and PowerShell-scripted automation to improve repeatability and scalability, cutting time to deploy per infrastructure project by 80% — from 16 hours to just over 3.
- Cut annual datacenter and maintenance spend in half — $250K to $125K — by consolidating physical servers onto VMware vSphere/ESXi virtual machines with Nimble NAS/SAN storage, shrinking the footprint from seven full racks to two, and relocating colocation from a downtown datacenter to Sabey's facility 15 miles outside the city for cheaper monthly hosting.
- Implemented and administered Azure Active Directory (Entra ID) — SSO, conditional access, dynamic groups, and MFA including FIDO2/YubiKey policies — automating identity provisioning and enforcing security standards.
- Served on the university's security committee responsible for change management and the identity lifecycle: onboarding and offboarding users, and governing security groups whose membership auto-provisioned access to applications, file shares, and resources across the Microsoft environment.
- Ran hybrid identity across Entra ID, Office 365, and on-premises Active Directory, keeping directories synchronized across every domain controller, local and cloud, through Microsoft Entra Connect (then Azure AD Connect).
- Led vendor communications to stand up SAML single sign-on in Entra ID for third-party applications such as Zoom, Blackboard, and Brightspace: exchanging federation metadata and token-signing certificates, configuring sign-on and reply URLs and entity IDs, mapping identity claims such as name and email, and auto-provisioning users against available licenses through SCIM.
- Managed the Windows Server and SQL Server estates from Server 2012 through Server 2022, migrating and integrating workloads with Azure through Azure Migrate and System Center, and moving SQL services from on premises to the cloud with backups and restores.
- Ran SQL Server maintenance across full, differential, and transaction log backups, and configured networking and security access for instances and databases on least privilege, using group Managed Service Accounts and passwordless authentication.
- Owned annual third-party security audits of the Active Directory estate — assessed by McKinsey against ISO 27001, the NIST Cybersecurity Framework (NIST CSF), and SOC 2 — passing every audit, with year-round standards readiness as a core part of the role.
- Administered the Microsoft 365 estate end to end — tenant administration across Exchange, Teams, and SharePoint — migrating 65K email accounts to the cloud and owning Office 365 adoption.
- Managed the endpoint fleet through Intune (MDM/MAM) and Autopilot provisioning across Windows, macOS, and mobile devices, enforcing device security and compliance policies.
- Ran a two-year enterprise application sunset and migration as solutions architect and technical product manager — modernizing legacy ERP and re-architecting structured data stores.
- Oversaw managed service providers and vendors — scoping, escalation, and delivery oversight — while providing direct support to executives and end users.
Microsoft 365 Security & Compliance Operations
Detection, prevention, and remediation across the tenant, 2014–2022. Operated under the product names of the time; listed with their current Microsoft names.
- Ran email threat protection across the tenant through Exchange Online Protection and Microsoft Defender for Office 365 (then Office 365 ATP) — tuning spam and phishing filter policies and thresholds, managing quarantine and release, and using zero-hour auto purge to retract spam and phishing mail already delivered.
- Maintained tenant allow and block lists for sender domains and IP ranges, and blocked sign-ins by country and IP range through Entra Conditional Access named locations.
- Wrote Microsoft Purview DLP policies (then Office 365 DLP) on sensitive-information types such as Social Security numbers, credit card numbers, dates of birth, and other PII, auto-encrypting outbound email containing them, and enforced tenant-wide compliance policies.
- Built anomaly detection and automated remediation in Microsoft Sentinel (then Azure Sentinel) and Entra ID Protection — alerting on unusual-IP and unusual-location sign-ins and auto-blocking risky accounts.
- Ran compromised-account investigation and response from the Microsoft Defender portal (then the Office 365 Security & Compliance Center): auditing sign-in activity, inbox rules, and user risk state on suspect accounts, confirming compromise in Entra ID Protection, remediating with forced password resets and revoked sign-in sessions to log out every device, and containing threats through quarantine policies, litigation holds on mailboxes under investigation, and automated investigation and response (AIR) playbooks.
- Rolled out two-step verification (MFA) tenant-wide, alongside the FIDO2/YubiKey policies above, and owned the tenant's security settings baseline.
Skills built & sharpened
Solutions architectureAzure cloud migrationCost optimizationVendor managementAzure DevOps & CI/CDPowerShell automationIdentity & access managementAzure RBAC & networkingAzure Virtual DesktopERP modernizationMicrosoft 365 administrationIntune & AutopilotSecurity audits (ISO 27001 · NIST CSF · SOC 2)Data governanceStakeholder alignmentDefender for Office 365Microsoft SentinelPurview DLPConditional AccessIncident response & remediationSAML SSO & SCIM provisioningSQL Server administrationTerraformVMware vSphere & ESXiNimble NAS/SAN storage
Outcomes, plotted
Annual infrastructure spend — halved
Consolidated physical servers onto VMware vSphere/ESXi VMs with Nimble NAS/SAN storage — seven full racks down to two — and moved colocation from a downtown datacenter to Sabey's facility 15 miles out for cheaper monthly hosting. Annual datacenter and maintenance spend fell from $250K to $125K.
Infrastructure project time — cut 80%
Repeatability, automation, and scale — Terraform and PowerShell pipelines on Azure DevOps cut the time to deploy per infrastructure project from 16 hrs to 3.2 hrs.
The $2.8M program: coordination surface
A two-year network infrastructure upgrade, diagrammed, diagnosed, and led end to end
What began as his own infrastructure diagramming became the $2.8M core of a two-year network infrastructure upgrade, the largest project he had led to that point, coordinating three vendors, five teams, and ten network products in one motion.
Hardware was procured straight through the first U.S.–China tariff war: shipment delays and cost escalations absorbed and managed across vendors, teams, legal, and executive stakeholders, a multimillion-dollar overhead process communicated up and delivered on.
3
5
10
Vendors & Partners Coordinated
Vendor and partner relations managed across eight years of operations — procurement, managed services, consulting, and audit engagements, twenty relationships in all. A separate, broader surface than the three-vendor $2.8M program above.
GFI LanGuardDocImage
