Joshua Newton

I’m a security engineer with 6+ years administering the Microsoft security stack across enterprise environments. I run Microsoft Defender for Endpoint and Sentinel day to day, triaging alerts and hunting threats to drive incidents to closure.

My work focuses on vulnerability and exposure reduction—owning vulnerability scanning, endpoint hardening, and secure-configuration baselines. I lead threat hunting with KQL and manage enterprise scanning using Rapid7 and Microsoft Defender Vulnerability Management.

I also own identity and device controls, including Conditional Access, Microsoft Entra ID, and Intune device compliance policies. I’ve deployed Duo MFA and managed PKI certificate creation and renewals, alongside tools like BeyondTrust EPM to remove standing local administrator rights.

In regulated environments, I’m comfortable producing audit evidence and maintaining risk registers, incident-response runbooks, and NIST-aligned SOPs. I like using automation and secure-configuration baselines—leveraging Python, PowerShell, Bash, and KQL query development—to reduce risk at scale.