Available for remote contract work

Nathan Fanelli

Detection engineering and security operations.

I build and tune the detection layer. Log source onboarding, correlation logic across identity, email, network and endpoint telemetry, and the incident response that follows when something fires.

Sole security owner for a 50-person organization on Microsoft Defender XDR and Sentinel. Now deploying CrowdStrike Falcon Next-Gen SIEM on LogScale across MSP partner environments at a channel-exclusive MDR provider.

Location
Fully remote
Coverage
US business hours
Focus
Detection, SIEM, M365
Status
Open to contract

Experience

SIEM Solutions Engineer

Vijilan Security

Channel-exclusive MDR provider · CrowdStrike Falcon NG-SIEM on LogScale · Remote

  • Deploy and onboard CrowdStrike Falcon Next-Gen SIEM on LogScale for MSP partners and enterprise clients. Log source scoping, ingest architecture, parser development, retention modeling.
  • Author detection content on Next-Gen SIEM data: CQL correlation rules, custom IOAs, and managed rules across third-party telemetry including Entra ID, Defender, Fortinet, Mimecast and Sysmon.
  • Tune deployed detections for signal quality. False positive reduction, threshold calibration, and governed exclusions carrying a named approver and an expiry.
  • Run threat hunting across non-Falcon data sources, correlating identity, email, network and endpoint events into single investigable cases.
  • Technical lead on MSP and enterprise opportunities. Discovery, architecture sessions, proof-of-value evaluations, and engagement scoping into statements of work.
  • Serve as the detection and response authority for a book of 20 MSP and MSSP partners and their end clients.

Security-Focused IT Systems Administrator

Friede and Associates, Inc.

Sole IT and security owner · 50-person organization · Defender XDR, Sentinel, Entra, Intune

  • Ran Microsoft Defender XDR and Sentinel in production as the only security operator. Daily endpoint alert triage, investigation, KQL hunting, and incident response end to end.
  • Wrote and tuned Sentinel analytics rules to cut false positive volume, and built the escalation and containment process from nothing.
  • Engineered identity controls in Entra ID: Conditional Access policy design, MFA enforcement, privileged access review. Hardened mail flow against phishing and payload delivery.
  • Operated vulnerability management with Qualys on a fixed patch and remediation cadence across endpoints and servers.
  • Managed Intune device configuration, compliance policy, and endpoint hardening baselines across the fleet.
  • Authored a NIST SP 800-34 disaster recovery plan and maintained SP 800-171 control documentation through audit.
  • Migrated all IT and security operations in-house from an outside MSP in six weeks. Saved $53,200 annually and cut a further $5,120 from Azure spend.

Product Support Specialist II

J. J. Keller and Associates, Inc.

Enterprise technical support · Fleet telematics and ELD platform · Remote

  • Root-caused a critical vulnerability in a fleet ELD application driving more than half of high-volume support tickets, then drove remediation through to close with engineering.
  • Owned escalated technical troubleshooting for enterprise clients across device, network and application layers.
  • Authored the runbooks and knowledge base the rest of the support team worked from.

Lab record

TryHackMe th4d1g1m0rtal View profile
#230US all time
#2018Global
Top 1%Percentile
469Rooms cleared
57Badges
  • SOC Level 1 and Level 2Both paths worked end to end. SIEM query and correlation, alert triage workflow, escalation criteria, and case handling under a defined process.
  • Phishing and email analysisHeader and payload inspection, URL and attachment detonation, sender infrastructure pivoting, and investigation of user-reported mail.
  • Endpoint and network forensicsWindows event log analysis, process lineage and persistence hunting, memory artifacts, and packet inspection with Wireshark.
  • Threat hunting and detectionMITRE ATT&CK technique mapping, IOC pivoting, and writing queries against attacker behavior rather than static signatures.

Certifications

CredentialIssuerExamStatus
CySA+ CompTIA CS0-003 Held
Security+ CompTIA SY0-701 Held
Network+ CompTIA N10-009 Held
CSAP Security Analytics Professional CompTIA Stackable Held
Core Certified User Splunk SPLK-1001 Held
Certified Falcon Administrator CrowdStrike CCFA In progress

Capabilities

SIEM

CrowdStrike Falcon Next-Gen SIEM on LogScale (CQL), Microsoft Sentinel (KQL), Splunk (SPL). Log source onboarding, parser development, correlation rule authoring, detection tuning.

Endpoint and XDR

Microsoft Defender XDR, Defender for Endpoint, CrowdStrike Falcon. Behavioral detection, containment actions, and endpoint hardening baselines.

Triage and response

Alert triage, false positive reduction, phishing and BEC investigation, containment and eradication, and the NIST incident response lifecycle applied in production.

Identity and cloud

Entra ID, Conditional Access, MFA enforcement, privileged access review, Microsoft 365, Azure, Intune, Active Directory and Group Policy.

Tooling

Qualys, Nmap, Wireshark, Burp Suite, PowerShell, Bash. Freshservice and ticket-driven case handling.

Frameworks

MITRE ATT&CK for detection mapping. NIST CSF, SP 800-53, SP 800-171 and SP 800-34 for control and continuity work.

Contact

nathan@nathanfanelli.com

Fully remote, US business hours. Open to contract and full-time work in detection engineering, SOC operations, and Microsoft 365 security.

github.com/th4d1g1m0rtal tryhackme.com/p/th4d1g1m0rtal