Bradley Baker
Microsoft identity & Senior Cyber Security Engineer
Bulverde, TX · email on request · bradbaker-it.com · linkedin.com/in/bradley-baker1 · github.com/Patriot7Six
Summary
Microsoft identity and Senior Cyber Security Engineer with 21 years in regulated enterprise IT. Served as Microsoft 365 Global Administrator and identity lead for a 4,300-user multinational tenant, running Entra ID Conditional Access, MFA and passwordless methods, Azure PIM under zero standing privilege, Intune, Exchange Online, and email security, and acting as the escalation point for identity and email-security incidents. Retired an AD FS farm to Entra ID, moving roughly 30 relying parties in under a month. Automates in PowerShell and Microsoft Graph under Azure DevOps pull-request review. Compliance history under HIPAA, PCI DSS, SOX, and CJIS. U.S. Army veteran, 82nd Airborne Division.
Experience
IT Applications Administrator (Identity & M365 Lead), Worldwide Clinical Trials
New Braunfels, TX · Jan 2021 – Sep 2026
- Owned Entra ID administration: Conditional Access design, MFA enforcement, self-service password reset, role and group lifecycle, and hybrid identity through Entra Connect.
- Ran new Conditional Access policies in report-only mode through a full business cycle before enforcement, and configured FIDO2 security keys, Windows Hello for Business, certificate-based authentication, and Identity Protection risk policies.
- Ran Azure PIM so consultant, vendor, and internal administrator accounts activated roles just in time under zero standing privilege, with approval workflow and periodic access validation.
- Onboarded enterprise applications to SSO over SAML 2.0 and OIDC/OAuth 2.0, managing app registrations, service principals, API permission grants, and consent policy.
- Upgraded the AD FS farm through 2012 R2, 2016, and 2019, recovered it from a catastrophic crash, then moved roughly 30 relying parties to Entra ID in under a month and decommissioned the farm.
- Administered roughly 200 Mimecast policies across 35+ categories, including DLP for PHI, PII, and clinical-trial data, enforced DMARC, SPF, and DKIM tenant-wide, and closed a mail-flow path that let senders deliver around the gateway.
- Contained three coordinated mail-bomb campaigns against 30 to 45 high-value mailboxes within 5 to 15 minutes of each first wave, with no business disruption.
- Administered Defender for Endpoint (EDR policy, alert triage, device isolation), Defender Vulnerability Management, and Defender for Office 365 investigations, and worked phishing triage with the SOC across hundreds of reports a month.
- Ran Intune enrollment for corporate and BYOD devices, compliance and configuration policies, and app deployment and protection.
- Deployed and administered Microsoft 365 Copilot for the tenant and built 20 agents in Copilot Studio.
- Automated tenant administration in PowerShell and Microsoft Graph, exported policy state before every change, and ran scripts through Azure DevOps branches and pull requests for about two years.
- Wrote security policies the company adopted and coached Tier 1 and Tier 2 staff near-daily with documented resolutions.
System Administrator, City of New Braunfels
New Braunfels, TX · Dec 2019 – Jan 2021
- Administered Active Directory account lifecycle, Group Policy, and AD FS, plus Microsoft 365 identity, mail flow, and endpoint configuration.
- Applied CJIS Security Policy controls to city systems that handled criminal justice information.
- Deployed software and patches through SCCM, ran vulnerability scans, and made firewall rule and ACL changes.
- Configured Microsoft Purview, ran the internal AD CS certificate authority, and wrote security policies the city adopted.
- Rebuilt SQL Server maintenance plans for legacy line-of-business databases, and supported staff, department heads, and elected officials at Tier 2 and Tier 3.
IT Systems Manager, Capstone Real Estate Services
Austin, TX · Jan 2015 – Dec 2019
- Led IT operations, identity, infrastructure, backup, and security policy across the Microsoft stack.
- Ran Office 365 and Exchange Online end to end: user lifecycle, mail flow, mobile devices, SharePoint site builds, permissions, and AD FS-federated SSO for line-of-business SaaS.
- Designed and deployed the company's Hyper-V environment in an infrastructure refresh that added hybrid on-site and cloud backup, redundant offsite servers, and power backup.
- Held HIPAA and PCI DSS posture through patching, vulnerability scanning, firewall and ACL management, risk reviews, and access-policy enforcement.
- Built a self-service knowledge base and onboarding material for new external customers, which cut repeat support tickets.
Systems Administrator, EZCORP
Austin, TX · Jun 2014 – Jan 2015
- Stood up a patching process through Configuration Manager where none had existed.
- Resolved more than twice the Exchange ticket volume of peers with a 99% first-time-right rate.
- Supported SOX compliance, SolarWinds SIEM monitoring, and Exchange legal hold and eDiscovery with the security team.
Systems Administrator (five roles in nine years), PPD
Austin, TX · Aug 2005 – Jun 2014
- Administered Active Directory, AD FS, Group Policy, DNS, and DHCP, owning account lifecycle and security baselines.
- Kept 1,000+ servers at roughly 50 global sites on uniform monthly patch cycles through Configuration Manager, with compliance reporting.
- Administered Citrix application virtualization, stood up MDM for corporate devices, and kept in-scope systems SOX compliant.
- Set up change-distribution control for desktop environment changes and worked SolarWinds SIEM with the security team.
Technical skills
- Identity & access
- Entra ID (Conditional Access, MFA, SSPR, Identity Protection risk policies); Passwordless (FIDO2 security keys, Windows Hello for Business, certificate-based authentication); Privileged access (Azure PIM, just-in-time activation, zero standing privilege, access validation); Federation & SSO (AD FS, SAML 2.0, OIDC/OAuth 2.0, app registrations, service principals, consent policy); Hybrid directory (Active Directory, Entra Connect, Group Policy, DNS, DHCP); PKI (AD CS certificate authorities, certificate lifecycle)
- Microsoft 365
- Exchange Online (Mail flow rules, connectors, hybrid routing, DMARC, SPF, DKIM); SharePoint, OneDrive, Teams (Configuration, permission governance, guest and external sharing); Copilot (Microsoft 365 Copilot administration, Copilot Studio agents); Purview (Sensitivity labels, retention, eDiscovery)
- Endpoint
- Intune (Corporate and BYOD enrollment, compliance, configuration, app protection); Configuration Manager (Patch cycles, software deployment, compliance reporting); Hardening (CIS Benchmarks, Microsoft security baselines, Group Policy); Virtualization (Hyper-V, Citrix application virtualization)
- Security operations
- Defender XDR (Defender for Endpoint, Defender Vulnerability Management, Defender for Office 365); Email security (Mimecast policy and DLP, phishing triage, message-trace forensics); Secure web gateway (Zscaler Internet Access policy); Network controls (Firewall rules, ACLs, vulnerability scanning)
- Compliance
- HIPAA, PCI DSS, SOX, CJIS (Control operation, audit readiness, access reviews, evidence preparation); NIST SP 800-171 / CMMC 2.0 L2 (Control mapping and automated evidence); NIST SP 800-53 Rev 5 (Control-to-service mapping for cloud infrastructure)
- Automation & software
- PowerShell & Microsoft Graph (Tenant administration, inventory, migration scripting); Azure DevOps (Pipelines, branches, pull-request review for tenant automation); GitHub Actions (OIDC federation to AWS, tflint, tfsec, Checkov, pytest); Terraform (Multi-account AWS organization, SCPs, delegated security services); Python (Log analysis, pytest, Nornir network automation); TypeScript & Node.js (CLIs, zod validation, Anthropic SDK); React & Next.js (App Router, server components, server actions); Postgres & Supabase (Row-level security, security-definer functions, auth); Cloudflare Workers (Edge rendering, rate-limit bindings, static assets)
Education
B.S., Information Systems Security, ITT Technical Institute, 2014. Honors graduate, 3.64 GPA.
A.S., Computer Electronics Engineering Technology, ITT Technical Institute, 2004
Military service
U.S. Army, Mar 1996 – Jul 2002. 11B Infantryman. Honorable discharge. Service-connected disabled veteran.
- Team Leader (E-4), 82nd Airborne Division, Mar 1996 – Mar 1999. Led a three-person fire team and was accountable for $250K in equipment.
- Squad Leader (Sergeant (E-5)), 172nd Infantry Brigade, Apr 1999 – Jul 2002. Led an eight-person infantry squad and held personal accountability for government equipment valued over $500K.
- Deployed to Saudi Arabia and Thailand. Expert Infantryman Badge, a multi-day evaluation of infantry skills that a small fraction of candidates pass. Leadership Development Training.