Josh LEON

• Microsoft 365 DLP Program : Led a Proof of Concept for Data Loss Prevention controls across Exchange, SharePoint, and Teams. Authored the RFP, evaluated vendors, and built the final project plan. Directed implementation and change management with legal, compliance, and SOC stakeholders. • Full Cloud Migration from On-Prem Datacenter : Planned and executed a data-center exit to Azure: lift-and-shift of eligible workloads and re-platforming where needed. Decommissioned legacy applications and replaced suitable services with SaaS alternatives. Implemented landing zone standards (governance, cost management, monitoring). • Citrix VDI to Azure Virtual Desktop (DaaS): Transitioned from on-prem Citrix VDI to Azure Virtual Desktop, including image strategy, FSLogix profiles, and autoscaling. Optimized identity, Conditional Access, and endpoint posture for secure remote access. Ran pilot → phased rollout with performance baselines and user experience KPIs. • Windows End-of-Life & ESU Strategy : Conducted a security risk assessment for legacy Windows fleets approaching end of support. Defined and executed the Extended Security Updates (ESU) plan (scope, budgeting, rollout, tracking). Aligned remediation priorities with vulnerability exposure and business criticality. • Migration of Trading Platform to BlackRock Aladdin: Defined and deployed a separation-of-duties access model; migrated IAM governance to BlackRock’s Aladdin platform with zero operational downtime. • RSA to Azure MFA Deployment: Led replacement of RSA tokens with native Entra ID MFA, ensuring uninterrupted authentication through pilot and production phases. Re-designed the authentication stack and onboarding using Temporary Access Pass (TAP) while keeping the tenant fully protected by MFA. Reconfigured Conditional Access Policies (CAPs) and performed batch migrations of users. Drove end-user communications and adoption (runbooks, how-to guides, FAQs). • Certificate Lifecycle Management: Re-engineered TLS certificate issuance/renewal across Citrix and cloud, aligned with NIST SP 1800-16; prepared migration to a SaaS CLM platform. • Post-Incident Recovery Plan: Directed execution with Microsoft DART; implemented Privileged Access Management (PAM) and DLP policies. • Active Directory Hardening & RBAC with Varonis: Forensic permission analysis and rollout of an RBAC model eliminating legacy privileges on NAS shares and Active Directory. • Zero-Trust Architecture for SharePoint Online / M365: Enforced least-privilege on collaborative sites and instituted periodic access reviews with business owners. • Intranet Hardening & Migration: Managed controlled isolation of the legacy intranet and specified technical requirements (WAF, MFA, centralized logging) for the new platform. • Alternative M365 Backup Strategy: Benchmarked Veeam, Cohesity, Rubrik, and AWS S3; delivered a business case validating adoption of a hybrid backup approach. • Endpoint Lifecycle Management – Windows 10/11/Server 2016/2019: Coordinated Windows end-of-life plan and legacy app compatibility on newer Windows versions; optimized Extended Security Updates budget. • Infrastructure Redundancy: Advised on resilience of market-risk analytics infrastructure; identified redundancy gaps and proposed HA solutions.

Global Active Directory Administration: • Multi-site AD Federation: Administered a large-scale AD federation with domain controllers across 150 global sites. • Global Administration: Global administrator for federated domains; ensured availability, security, and performance. • Technology Integration: Coordinated integration of new technologies and systems; provided ongoing technical support to users. • AD DS Expertise: Expert in AD DS, security policies, replication, and administration of Windows Server 2012 R2/2016/2019/2022. • Hyper-V Management: Configured and maintained Hyper-V hosts and VMs; resolved technical incidents. • Team Leadership: Lead an offshore team of engineers and administrators, leveraging strong communication and leadership skills.

Project Manager: Infrastructure Modernisation servers SCCM DP & FTP VM/On premise. - Offshore Resource Management - IPAM - VLAN Config - Installation and configuration of Hyper-V - VMs - Windows Server 2012 - 2016 - 2022 Global Administrator - Active Directory Domain Services & AD Sites and Services - DNS modification AAA NAME, CNAME, ROUND ROBIN, IPAM - FTP infrastructure configuration (IIS Manager) - Hyper-V - Host & Virtual Machines configuration, OS Windows Server 2016 - 2022