dobroski

Mike Dobroski

Chicago, IL | mike@dobroski.net | linkedin.com/in/mike-dob | dobroski.net

Security Engineer | Security Automation, Detection & Response, Microsoft 365 Security

Compliance-focused version: /resume/compliance/. Data as JSON: /resume.json.

Summary

Security engineer protecting 150+ Microsoft 365 environments at a managed service provider. Builds security automation end to end: alert pipelines, API integrations, and response workflows in Rewst, PowerShell, and Python. Hands-on with EDR/ITDR triage, Entra ID and Intune baselines, DNS and email security, and log management. Every workflow ships least-privilege, auditable, and documented.

Experience

Cybersecurity Engineer

Rouse Consulting Group
Moline, IL
Oct 2025 to Present
  • Built and tuned a multi-tenant Microsoft 365 alerting pipeline in CIPP across 150+ tenants, routing enriched alerts for triage alongside the Huntress managed SOC.
  • Led a Cisco Umbrella DNS security revitalization: policy baselining, standardized resolver configuration (firewalls, DHCP, domain controllers), and enforcement validation with Liongard, raising workstation enforcement from ~50% to 95%+ in 60 days; built Rewst-ImmyBot API automation and runbooks to sustain it.
  • Engineered a quarterly typosquatting detection pipeline for premium clients: DNSTwist permutations of every client domain, automated reports, and Rewst tickets to block malicious registrations before they are used.
  • Built automated reporting to audit SPF, DKIM, and DMARC across all Microsoft 365 tenants; drove remediation with account managers and clients, taking enforced DMARC (no p=none) from 65% to 100% of domains.
  • Triages ~10 critical and ~50 non-critical EDR/ITDR alerts monthly with sub-30-minute response on criticals; coordinates containment and post-incident analysis with the Huntress SOC.
  • Rebuilt Graylog into a multi-tenant syslog collector with per-client attribution across ~150 environments, queryable by staff through an MCP-connected AI agent.
  • Ships every security policy change through a standard process: pilot group, per-client alert visibility, and a documented rollback plan. Used it for CIS-aligned Entra ID and Intune baselines (Inforcer), Huntress ISPM controls, and a Defender for Office 365 overhaul across 150+ tenants.
  • Primary AI engineer: designed, secured, and deployed six Microsoft Copilot Studio agents (SOC, multi-tenant M365 admin, Graylog, Liongard, Hudu, ConnectWise PSA) with MCP integrations, used by 20 technical staff; authored the governing AI security framework.
  • Runs compliance reviews and client advisory sessions about twice weekly; works with auditors, forensic investigators, and legal firms on active investigations; supports a CMMC 2.0 Level 2 (NIST SP 800-171) program for a defense contract client.

Network Administrator

Rouse Consulting Group
Moline, IL
Jul 2024 to Oct 2025
  • Administered Microsoft 365, Entra ID, and Active Directory across SMB clients: provisioning, licensing, group and OU design, Group Policy, Conditional Access and MFA enforcement, and user lifecycle.
  • Supported SonicWall, FortiGate, Meraki, and UniFi firewalls: access rules, geo-IP exclusions, client and site-to-site VPN troubleshooting; resolved authentication failures and lockouts through log analysis.

Certifications

  • CompTIA Security+
  • CompTIA Network+
  • ISC2 Certified in Cybersecurity (CC)
  • ConnectSecure Certified Administrator

Technical skills

Security Operations
Huntress (EDR, ITDR, SIEM, ISPM), CIPP, Graylog, Wazuh, ConnectSecure, Nessus, Cisco Umbrella, Liongard
Automation & Code
Rewst, PowerShell, Python, Bash, Jinja2, REST APIs, MCP servers, Microsoft Copilot Studio, n8n
Identity & Email
Entra ID, Conditional Access, Intune, Active Directory, Defender for Office 365, SPF/DKIM/DMARC, Inforcer
Network Security
SonicWall, FortiGate, Meraki, UniFi, pfSense, Snort IDS/IPS, VLAN segmentation, VPN, HAProxy, nginx
Frameworks
CIS Controls and Benchmarks, CMMC 2.0, NIST SP 800-171, HIPAA, PCI-DSS

Projects

Homelab: Security Operations Lab

dobroski.net
  • Proxmox lab mirroring a small SOC: Wazuh SIEM/XDR on all hosts, Graylog, Nessus Essentials, Grafana over OpenSearch; pfSense with Snort IDS/IPS, VLAN segmentation, and strict ACLs; Tailscale and Cloudflare Tunnel for zero-trust access.

Education

  • B.S.E. Computer Science & Engineering (Computer Networks) | University of Iowa | GPA 3.5 | May 2022
  • Graduate coursework, M.S. Computer Science (Cybersecurity) | Johns Hopkins University | 12 credits, 4.0 GPA | 2023 to 2024