Diante Weddington

Aligned work to HIPAA/HITECH, FedRAMP, SOC 1, and SOC 2 frameworks, contributing to secure-by-design architectures and audit readiness across client environments. Prepared audit reports and quarterly Executive Business Reviews translating cyber risk into prioritized remediation, risk metrics, and roadmaps for leadership.

Served as primary escalation point for 24/7 incident response, leading investigations across endpoints, identities, and cloud using Sentinel, Defender for Cloud, and Defender XDR, including IoC analysis, containment, remediation, and post-incident reporting.

Authored custom Sentinel rules detecting high-risk identity activity (unauthorized MFA changes, unactioned risky sign-ins), closing detection gaps for SOC triage. Built Logic Apps automation re-evaluating password-spray alerts against sign-in telemetry, cutting low-value alerts while preserving signal on real compromises. Wrote KQL queries supporting IR and threat hunting across phishing, RAT, and AiTM cases, correlating telemetry to scope incidents and drive containment.

Used PowerShell/Bash via Azure Cloud Shell to deploy and validate security configurations at scale, automating Defender onboarding and compliance checks. Onboarded new clients onto the Microsoft security stack, building connectors, rules, and playbooks from scratch.

Performed posture assessments on inherited environments, identifying gaps across Sentinel, Defender XDR, Entra ID, and Intune, then remediated with DevOps/infrastructure teams. Optimized log ingestion to cut cost while preserving detection fidelity.

Enforced identity controls (MFA, Conditional Access, PIM) via Entra ID and administered Intune for device compliance/ASR baselines. Implemented SOAR automation via Sentinel playbooks to orchestrate response and reduce false positives.

Mentored Analyst II/SOC Tier 1 staff via training and coaching; authored SOPs and tuning guides that accelerated ramp-up and standardized deployments.