About

I’m a security engineer at a managed service provider. About 150 small and mid-sized businesses run on the stack I look after: EDR and ITDR response, Microsoft 365 and Entra hardening, SIEM, syslog collection, vulnerability scanning and DNS filtering. Rewst automation ties it together. The compliance and client advisory work comes with the job.

Most of what I build is automation. A standard that lives in a PDF is a wish. If a machine can’t enforce it and keep checking it, I don’t trust it to hold across 150 environments. That is how DNS enforcement went from about 50% to 95% and how every client ended up on the CIS baseline.

This year I became our primary AI engineer. I build the agents our techs use to search logs across every client, manage M365 tenants and work tickets. I also wrote the governance that decides who can use what, and with which data. An agent is a privileged account. It gets scoped access, an audit trail and documentation before it ships.

Outside work

I run a Proxmox cluster that copies enterprise SOC architecture at small scale. It breaks on purpose and on accident, and both teach me something. I have a soft spot for ethical hacking and malware analysis. I’m building a microtonal guitar because twelve notes was never enough. I’m also the unofficial IT department for my mom’s small practice.

How this site works

It follows the same rules I use at work. No analytics, no cookies and no third-party requests. Everything is served from this origin. If I can’t see inside something, I don’t run it. /colophon has the details and /ai says how AI helped build it.

I split my time between Moline and Chicago. Email is the fastest way to reach me: mike@dobroski.net.