{
  "$schema": "https://raw.githubusercontent.com/jsonresume/resume-schema/v1.0.0/schema.json",
  "basics": {
    "name": "Mike Dobroski",
    "label": "Security Engineer | Security Automation, Detection & Response, Microsoft 365 Security",
    "email": "mike@dobroski.net",
    "url": "https://dobroski.net",
    "summary": "Security engineer protecting 150+ Microsoft 365 environments at a managed service provider. Builds security automation end to end: alert pipelines, API integrations, and response workflows in Rewst, PowerShell, and Python. Hands-on with EDR/ITDR triage, Entra ID and Intune baselines, DNS and email security, and log management. Every workflow ships least-privilege, auditable, and documented.",
    "location": {
      "city": "Chicago",
      "region": "IL",
      "countryCode": "US"
    },
    "profiles": [
      {
        "network": "LinkedIn",
        "username": "mike-dob",
        "url": "https://www.linkedin.com/in/mike-dob"
      }
    ]
  },
  "work": [
    {
      "name": "Rouse Consulting Group",
      "position": "Cybersecurity Engineer",
      "location": "Moline, IL",
      "startDate": "2025-10",
      "highlights": [
        "Built and tuned a multi-tenant Microsoft 365 alerting pipeline in CIPP across 150+ tenants, routing enriched alerts for triage alongside the Huntress managed SOC.",
        "Led a Cisco Umbrella DNS security revitalization: policy baselining, standardized resolver configuration (firewalls, DHCP, domain controllers), and enforcement validation with Liongard, raising workstation enforcement from ~50% to 95%+ in 60 days; built Rewst-ImmyBot API automation and runbooks to sustain it.",
        "Engineered a quarterly typosquatting detection pipeline for premium clients: DNSTwist permutations of every client domain, automated reports, and Rewst tickets to block malicious registrations before they are used.",
        "Built automated reporting to audit SPF, DKIM, and DMARC across all Microsoft 365 tenants; drove remediation with account managers and clients, taking enforced DMARC (no p=none) from 65% to 100% of domains.",
        "Triages ~10 critical and ~50 non-critical EDR/ITDR alerts monthly with sub-30-minute response on criticals; coordinates containment and post-incident analysis with the Huntress SOC.",
        "Rebuilt Graylog into a multi-tenant syslog collector with per-client attribution across ~150 environments, queryable by staff through an MCP-connected AI agent.",
        "Ships every security policy change through a standard process: pilot group, per-client alert visibility, and a documented rollback plan. Used it for CIS-aligned Entra ID and Intune baselines (Inforcer), Huntress ISPM controls, and a Defender for Office 365 overhaul across 150+ tenants.",
        "Primary AI engineer: designed, secured, and deployed six Microsoft Copilot Studio agents (SOC, multi-tenant M365 admin, Graylog, Liongard, Hudu, ConnectWise PSA) with MCP integrations, used by 20 technical staff; authored the governing AI security framework.",
        "Runs compliance reviews and client advisory sessions about twice weekly; works with auditors, forensic investigators, and legal firms on active investigations; supports a CMMC 2.0 Level 2 (NIST SP 800-171) program for a defense contract client."
      ]
    },
    {
      "name": "Rouse Consulting Group",
      "position": "Network Administrator",
      "location": "Moline, IL",
      "startDate": "2024-07",
      "endDate": "2025-10",
      "highlights": [
        "Administered Microsoft 365, Entra ID, and Active Directory across SMB clients: provisioning, licensing, group and OU design, Group Policy, Conditional Access and MFA enforcement, and user lifecycle.",
        "Supported SonicWall, FortiGate, Meraki, and UniFi firewalls: access rules, geo-IP exclusions, client and site-to-site VPN troubleshooting; resolved authentication failures and lockouts through log analysis."
      ]
    }
  ],
  "education": [
    {
      "institution": "University of Iowa",
      "area": "Computer Science & Engineering (Computer Networks)",
      "studyType": "B.S.E.",
      "endDate": "2022-05",
      "score": "GPA 3.5"
    },
    {
      "institution": "Johns Hopkins University",
      "area": "M.S. Computer Science (Cybersecurity)",
      "studyType": "Graduate coursework",
      "startDate": "2023",
      "endDate": "2024",
      "score": "12 credits, 4.0 GPA"
    }
  ],
  "certificates": [
    {
      "name": "CompTIA Security+"
    },
    {
      "name": "CompTIA Network+"
    },
    {
      "name": "ISC2 Certified in Cybersecurity (CC)"
    },
    {
      "name": "ConnectSecure Certified Administrator"
    }
  ],
  "skills": [
    {
      "name": "Security Operations",
      "keywords": [
        "Huntress (EDR, ITDR, SIEM, ISPM)",
        "CIPP",
        "Graylog",
        "Wazuh",
        "ConnectSecure",
        "Nessus",
        "Cisco Umbrella",
        "Liongard"
      ]
    },
    {
      "name": "Automation & Code",
      "keywords": [
        "Rewst",
        "PowerShell",
        "Python",
        "Bash",
        "Jinja2",
        "REST APIs",
        "MCP servers",
        "Microsoft Copilot Studio",
        "n8n"
      ]
    },
    {
      "name": "Identity & Email",
      "keywords": [
        "Entra ID",
        "Conditional Access",
        "Intune",
        "Active Directory",
        "Defender for Office 365",
        "SPF/DKIM/DMARC",
        "Inforcer"
      ]
    },
    {
      "name": "Network Security",
      "keywords": [
        "SonicWall",
        "FortiGate",
        "Meraki",
        "UniFi",
        "pfSense",
        "Snort IDS/IPS",
        "VLAN segmentation",
        "VPN",
        "HAProxy",
        "nginx"
      ]
    },
    {
      "name": "Frameworks",
      "keywords": [
        "CIS Controls and Benchmarks",
        "CMMC 2.0",
        "NIST SP 800-171",
        "HIPAA",
        "PCI-DSS"
      ]
    }
  ],
  "projects": [
    {
      "name": "Homelab: Security Operations Lab",
      "url": "https://dobroski.net",
      "highlights": [
        "Proxmox lab mirroring a small SOC: Wazuh SIEM/XDR on all hosts, Graylog, Nessus Essentials, Grafana over OpenSearch; pfSense with Snort IDS/IPS, VLAN segmentation, and strict ACLs; Tailscale and Cloudflare Tunnel for zero-trust access."
      ]
    }
  ]
}